Workload Identity Federation and Gmail SOAR Integration

[samryanturner]

Looking to reduce the amount of service account keys being used for services in SecOps. I see that the Gmail integration supports Workload Identity Federation with Domain Wide Delegated associated service accounts.

Has anyone got this setup successfully? If so, how are you going about securing that service account/conditions on the WIF pool?

[vaskenh]

Hi @samryanturner.  I've provided a link here related to using short-lived credentials with WIF.  If this is still not close to what you're looking for can you provide some more architectural details on how the scenario differs from the docs?  Thanks!

https://cloud.google.com/iam/docs/workforce-obtaining-short-lived-credentials

[samryanturner]

Hey, thanks.

This is for Workforce Identity Federation however. The docs state I should be able to use a Workload Identity Email address instead of a Service Account Key JSON file for the integration - https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/gmail#integrate

[dnehoda]

I can set it up in my lab and get a better understanding of the integration.  How would this minimize the use of service account keys though - you are still going to need one here.  

[samryanturner]

WIF should remove the requirement for keys -

"Optional

The client email address of your workload identity.

You can configure this parameter or the Service Account JSON File Content parameter.

To impersonate service accounts with the workload identity email address, grant the Service Account Token Creator role to your service account. For more details about workload identities and how to work with them, see Identities for workloads."

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/gmail#integrate

WIF is normally for workloads authenticating from outside of GCP, documentation on setting up a pool for Workspace is non-existent from initial searches.

[samryanturner · Accepted solution]

This medium blog has resolved my issues - https://medium.com/@mr.landovskiy/how-to-authenticate-to-google-cloud-integrations-using-workload-id...