Member-only story
Modern GCP Authentication in GitHub Actions
Stop Storing Service Account Keys
It’s 2026 and we need to stop storing long-running access keys and service account keys anywhere. If an attacker gets access to valid keys, they are able to get direct and potentially unmonitored access to your infrastructure.
In this article, we’ll describe how you can set up a clean, keyless authentication between GitHub Actions and Google Cloud Platform (GCP) so you never have to copy-paste a service account key again.
GCP Workload Identity Federation
Google Cloud Platform (GCP) Workload Identity Federation (GCP WIF) lets workloads running outside of GCP access GCP resources without using long-running credentials or tokens.
At a high level, WIF creates a trust relationship between GitHub Actions jobs in specific repositories and GCP projects and service accounts. We can define, for example, that jobs running in a backend repository are allowed to assume a service account that can build Docker images and deploy Cloud Run functions. Or, we can define that jobs running in a frontend repository may assume a service account that can deploy new versions to Firebase.
This is what happens on a technical level:
- GitHub Actions requests a token from…
