Impersonate Azure Service Principal from a Google Service Account

user_2962507 0
Viewed 357

I'd like to obtain temporary credentials for an Azure Service Principal (SP) using a Google Service Account JWT token. This is needed for calling Azure APIs from a GKE workload, without having to store long-term SP credentials in GKE.

Is such federation possible for GCP -> Azure (I know it is for Azure -> GCP, based on [1], as well as GCP -> AWS [2]), and how to achieve it?

[1] https://cloud.google.com/iam/docs/workload-identity-federation

[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html

google-iam azure-active-directory google-cloud-platform azure
2 Answers

Azure AD has a new capability in public preview called "Workload identity federation". This will allow you to use a Google issued JWT to get an access token for an Azure AD application/service principal.

I wrote this blog post and it provides more details on how to get this working: https://blog.identitydigest.com/azuread-federate-gcp/

user_139182620

I don't see why can't you store the credential in GKE, assuming that your workload is secure.

You will probably need a broker service that the service can authenticate to and fetch a temporary credential. In that case, you will not need to store the credential in GKE for long term.

However, the threat model is still the same, if your workload is compromised, the attacker can also impersonate your workload and fetch credential using the broker service.

user_13639130
Related