1つの Workload Identity 連携から、複数の Google Cloud プロジェクトにアクセスしてみる

# 環境変数の設定
$ export PROJECT_A="your-project-a-id"
$ export PROJECT_B="your-project-b-id"
$ export AWS_ACCOUNT_ID="123456789012"

$ export POOL_ID="aws-pool-260331"
$ export PROVIDER_ID="aws-provider-260331"

# プロジェクトAに切り替え
$ gcloud config set project $PROJECT_A

# Workload Identity プールの作成
$ gcloud iam workload-identity-pools create $POOL_ID \
    --location="global" \
    --display-name="AWS Pool"

# Workload Identity プロバイダーの作成（AWS 用）
$ gcloud iam workload-identity-pools providers create-aws $PROVIDER_ID \
    --location="global" \
    --workload-identity-pool=$POOL_ID \
    --account-id=$AWS_ACCOUNT_ID \
    --attribute-mapping="google.subject=assertion.arn,attribute.aws_account=assertion.account"

# サービスアカウントの作成
$ gcloud iam service-accounts create sa-for-aws \
    --display-name="SA for AWS Workload"

# Workload Identity プールから権限借用を許可
$ gcloud iam service-accounts add-iam-policy-binding \
    sa-for-aws@${PROJECT_A}.iam.gserviceaccount.com \
    --role="roles/iam.workloadIdentityUser" \
    --member="principalSet://iam.googleapis.com/projects/$(gcloud projects describe $PROJECT_A --format='value(projectNumber)')/locations/global/workloadIdentityPools/${POOL_ID}/*"

# 検証用バケットの作成
$ gcloud storage buckets create gs://${PROJECT_A}-wi-test --location=asia-northeast1

# サービスアカウントにバケットへのアクセス権を付与
$ gcloud storage buckets add-iam-policy-binding gs://${PROJECT_A}-wi-test \
    --member="serviceAccount:sa-for-aws@${PROJECT_A}.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

# プロジェクトBに切り替え
$ gcloud config set project $PROJECT_B

# 検証用バケットの作成
$ gcloud storage buckets create gs://${PROJECT_B}-wi-test --location=asia-northeast1

# プロジェクトAのサービスアカウントにプロジェクトBのバケットへのアクセス権を付与
$ gcloud storage buckets add-iam-policy-binding gs://${PROJECT_B}-wi-test \
    --member="serviceAccount:sa-for-aws@${PROJECT_A}.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

# Cloud Shell で実行
$ gcloud config set project $PROJECT_A

# 認証情報ファイルの生成
$ gcloud iam workload-identity-pools create-cred-config \
    projects/$(gcloud projects describe $PROJECT_A --format='value(projectNumber)')/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID} \
    --service-account=sa-for-aws@${PROJECT_A}.iam.gserviceaccount.com \
    --aws \
    --enable-imdsv2 \
    --output-file=credential-config.json

# 中身を表示してコピー
$ cat credential-config.json

{
  "universe_domain": "googleapis.com",
  "type": "external_account",
  "audience": "//iam.googleapis.com/projects/<プロジェクト番号>/locations/global/workloadIdentityPools/aws-pool-260331/providers/aws-provider-260331",
  "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
  "token_url": "https://sts.googleapis.com/v1/token",
  "credential_source": {
    "environment_id": "aws1",
    "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
    "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
    "imdsv2_session_token_url": "http://169.254.169.254/latest/api/token"
  },
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa-for-aws@<プロジェクトID>.iam.gserviceaccount.com:generateAccessToken"
}

$ cat <<'EOF' > ~/credential-config.json
{ここに Cloud Shell でコピーした JSON をペースト}
EOF

$ sudo yum install -y python3.11 python3.11-pip
$ python3.11 -m pip install google-cloud-storage

# 認証情報ファイルのパスを環境変数に設定
$ export GOOGLE_APPLICATION_CREDENTIALS=~/credential-config.json

$ cat <<'EOF' > test_project_a.py
from google.cloud import storage

client = storage.Client(project="<プロジェクトAのID>")

blobs = client.list_blobs("<プロジェクトAのバケット名>")
for blob in blobs:
    print(blob.name)
EOF

$ python3.11 test_project_a.py

$ cat <<'EOF' > test_project_b.py
from google.cloud import storage

client = storage.Client(project="<プロジェクトBのID>")

blobs = client.list_blobs("<プロジェクトBのバケット名>")
for blob in blobs:
    print(blob.name)
EOF

$ python3.11 test_project_b.py