Question

Your organization runs applications on AWS EC2 instances that need to read objects from a Cloud Storage bucket in a GCP project. You have already created a workload identity pool and an AWS provider. Security requires that only EC2 instances running under a specific AWS IAM role named 'prod-reader' be permitted to obtain Google credentials, and that no service account keys be created. What is the most appropriate way to enforce this restriction?

Accepted Answer

Map the AWS ARN to the google.subject attribute and add an attribute condition on the pool provider that requires the assumed-role ARN to match 'prod-reader', then grant the pool principalSet access to impersonate a service account with storage.objectViewer.

Answer

Create a service account key for the storage reader service account and distribute it to the EC2 instances that run under the 'prod-reader' role.

Answer

Grant the AWS account's root user roles/iam.workloadIdentityUser on the service account and rely on AWS IAM policies alone to limit which instances assume the role.

Answer

Add the EC2 instances as members of a Cloud Identity group and grant the group storage.objectViewer directly on the bucket.