Workload Identity Federation error: Invalid principal member

[originaltrini0]

Hello:

Using this documentation link, I am attempting to set up an Identity Federation between Google Cloud and Gitlab.

Given this pool:

$ gcloud iam workload-identity-pools list --location=global
---
displayName: test
name: projects/01234567890/locations/global/workloadIdentityPools/test
state: ACTIVE

And this provider:

$ gcloud iam workload-identity-pools providers list --workload-identity-pool=test --location=global
---
attributeCondition: assertion.project_id=='87654321'
attributeMapping:
  attribute.namespace_id: assertion.namespace_id
  attribute.project_id: assertion.project_id
  google.subject: assertion.sub
displayName: test-wip
name: projects/01234567890/locations/global/workloadIdentityPools/test/providers/test-wip
oidc:
  allowedAudiences:
  - https://gitlab.com
  issuerUri: https://gitlab.com
state: ACTIVE

When I attempt to grant direct access using an attribute like this:

$ gcloud storage buckets add-iam-policy-binding gs://my-storage-bucket \
  --role=roles/storage.objectAdmin \
  --member="principal://iam.googleapis.com/projects/01234567890/locations/global/workloadIdentityPools/test/attribute.project_id/87654321"

I get the following error:
ERROR: (gcloud.storage.buckets.add-iam-policy-binding) HTTPError 400: Invalid principal member (principal://iam.googleapis.com/projects/01234567890/locations/global/workloadIdentityPools/test/attribute.project_id/87654321).

Where am I going wrong? Any insight would be appreciated.

Thanks

[originaltrini0 · Accepted solution]

I figured out the issue.  It is a user error with a typo in the member's formatting:

Incorrect:
principal://iam.googleapis.com/projects/01234567890/locations/global/workloadIdentityPools/test/attribute.project_id/87654321

Correct:
principalSet://iam.googleapis.com/projects/01234567890/locations/global/workloadIdentityPools/test/attribute.project_id/87654321

Thanks