The successful integration of Google Cloud into an existing AWS-centric CI/CD pipeline hinges on the ability to maintain a unified audit trail across disparate infrastructure platforms. As organizations scale their digital presence across multiple providers, the traditional approach of managing long-lived credentials becomes a significant liability, leading many security architects to reconsider how identities are shared between clouds. The shift toward multi-cloud architectures often introduces friction, particularly when DevOps teams are forced to juggle different security paradigms and secret management systems that do not communicate natively. By prioritizing a keyless architecture, engineering teams can bridge the gap between Amazon Web Services and Google Cloud Platform without compromising on the strict compliance requirements that govern modern financial and healthcare sectors. This evolution in cloud-to-cloud trust represents a departure from the secret-heavy workflows of the early 2020s, moving instead toward a more fluid and secure verification process that relies on temporary, short-lived tokens. The result is a system where a runner sitting in an AWS-hosted Kubernetes cluster can seamlessly provision a database in Google Cloud, all while the primary state remains safely tucked away in an S3 bucket that never leaves its home region.
Maintaining operational continuity during a cross-cloud expansion requires a disciplined approach to identity management and infrastructure as code. When a centralized platform team oversees thousands of resources, the introduction of a second cloud provider can easily double the administrative burden if the authentication logic is not streamlined. The challenge lies in creating a secure handshake between two ecosystems that were not originally designed to trust one another implicitly. To solve this, technical leads are increasingly turning to Workload Identity Federation (WIF), a mechanism that allows external identities to assume specific roles within Google Cloud based on verifiable attributes provided by the AWS environment. This method effectively treats the AWS IAM role as a first-class citizen in the Google Cloud ecosystem, eliminating the need for developers to manually generate, rotate, or secure JSON service account keys. By focusing on a keyless integration, a business can maintain its high-velocity deployment cycles while simultaneously reducing its attack surface and simplifying its regulatory audit responses.
1. Core Constraints for the Keyless Pipeline
The architectural blueprint for a modern, secure pipeline begins with a set of non-negotiable constraints that protect the integrity of the existing infrastructure while enabling new capabilities. One of the most critical requirements is the preservation of the Terraform state within Amazon S3. For teams that have spent years perfecting their state locking and backup procedures within the AWS environment, moving these files to Google Cloud Storage represents an unnecessary migration risk and a potential disruption to established backup policies. By keeping the state in S3, the pipeline ensures that all resource mapping and historical data remains in a familiar, high-durability environment that is already integrated with existing logging and monitoring tools. This decision allows the engineering team to treat Google Cloud as a target for resource deployment rather than a new storage backend, maintaining a “source of truth” that is physically located where the majority of the current workloads reside.
Furthermore, operational efficiency dictates that the existing CI/CD infrastructure, such as GitHub Actions runners hosted on Amazon EKS, should be utilized rather than managing a separate fleet of runners in a different cloud. Managing a single, unified pool of runners reduces the complexity of patching, scaling, and networking, as the team can apply the same security groups and VPC configurations they have already vetted. The ultimate goal of this constraint is to achieve a state where “long-lived JSON credentials” are banned entirely. Service account keys are notorious for being accidentally committed to version control or poorly managed in secret stores, where they can sit valid for years. By insisting on a keyless model, the pipeline replaces these static risks with dynamic, identity-based access. This shift ensures that even if a runner is compromised, the access granted is temporary and tied specifically to the identity of the AWS workload, making unauthorized lateral movement across cloud providers significantly more difficult to execute.
2. Why Service Account Impersonation Was Selected
Choosing the right method for cross-cloud access involves weighing the simplicity of direct resource access against the granular control provided by service account impersonation. The engineering team ultimately moved forward with impersonation because it significantly minimizes the overhead of linking identities between the two providers. In a direct access model, every individual AWS role would need to be meticulously mapped to specific permissions inside Google Cloud, creating a management nightmare as the number of roles grows. By using a middle-layer service account in Google Cloud, the team only needs to establish a single point of federation. The federated AWS identity is restricted to one specific action: impersonating a designated Google Cloud service account. This centralization makes it far easier to update permissions or rotate configurations without having to touch dozens of disparate policy documents across both platforms, effectively creating a single “chokepoint” for security reviews.
Beyond the ease of management, service account impersonation ensures universal compatibility with the vast array of Google Cloud APIs. While some newer Google services support direct identity federation, many legacy or niche services still rely on the presence of a service account to function correctly. By adopting impersonation from the start, the DevOps team avoids hitting a wall where certain infrastructure components cannot be managed via Terraform because the underlying API does not recognize the external AWS identity. Moreover, this method provides a familiar set of metrics and monitoring tools that security teams already understand. Alerts can be configured to trigger whenever a service account is impersonated, providing a reliable audit trail of who is doing what and when. In the event of a suspected breach, the service account acts as a “kill switch” that can be disabled instantly, cutting off all federated access from AWS without affecting other unrelated parts of the cloud environment.
3. How the Keyless Authentication Flow Works
The internal mechanics of a keyless authentication flow involve a sophisticated series of handshakes that occur in seconds before Terraform ever touches a resource. It begins when the AWS-hosted runner requests short-term credentials for its assigned IAM role via the Amazon EC2 metadata service or the EKS OIDC provider. Once the runner has these credentials, it utilizes the Google Cloud authentication library to generate a signed AWS request. This request serves as a cryptographic proof of identity, asserting that the caller truly possesses the AWS role it claims to have. This signed request is then sent to the Google Cloud Security Token Service (STS). The STS acts as a neutral arbiter, verifying the signature against the AWS public keys and checking for specific conditions, such as ensuring the request originated from the correct AWS account ID and role name. This verification process ensures that no other AWS user—even one within the same organization—can spoof the identity of the authorized runner.
Once the identity is validated, the Security Token Service issues a temporary federated token to the runner. This token, while valid for making some calls, is typically restricted to the act of service account impersonation. The runner then presents this federated token to the Google Cloud IAM API to request an access token for the target service account. If the federated identity has been granted the roles/iam.serviceAccountTokenCreator permission, Google Cloud issues a final, short-lived OAuth 2.0 access token. The Terraform Google provider then consumes this token to authenticate all subsequent API calls for resource provisioning. Throughout this entire process, the runner simultaneously maintains its original AWS connection to the S3 bucket using its native AWS IAM permissions. This dual-identity state allows the runner to read the state file from Amazon and apply the changes to Google Cloud in a single, seamless execution block without a single static password or key ever touching the local disk of the CI/CD environment.
4. Managing the Deployment and Rollout
Successfully rolling out a cross-cloud pipeline requires more than just technical configuration; it demands a rigorous testing strategy that ensures stability for both the new and existing environments. The team initiated the process by piloting the policy framework using synthetic tests designed to fine-tune risk thresholds and security scoring. By simulating various deployment scenarios in a sandbox environment, the engineers were able to observe how the Workload Identity Federation responded to different IAM configurations and network conditions. This phase was crucial for identifying the precise permissions required for the “Service Account Token Creator” role, ensuring that the principle of least privilege was strictly upheld. During these tests, the team also focused on the timing of token expiration, verifying that long-running Terraform “apply” operations would not be interrupted by a token timeout, which could potentially leave the infrastructure in an inconsistent or “half-baked” state.
Following the policy tuning, the team performed a comprehensive validation of every stage of the workflow, including planning, applying, and destroying resources. It was essential to confirm that the Terraform plan generated in the AWS environment accurately reflected the state of resources in Google Cloud, and that the “destroy” command could clean up resources just as effectively as the “apply” command created them. A critical component of this rollout was a dedicated check to ensure that the existing AWS-native pipelines remained completely unaffected by the new multi-cloud logic. Because many teams share the same CI/CD runners, any change to the underlying authentication libraries or environment variables had to be backward-compatible. By isolating the Google Cloud authentication logic within specific Terraform modules and shell scripts, the team guaranteed that a developer working purely in AWS would never even notice the presence of the new Google Cloud integration, thereby preventing any disruption to the core business operations during the transition.
5. Essential Takeaways for Multi-Cloud CI/CD
The successful implementation of this keyless pipeline provided a wealth of knowledge for future infrastructure initiatives across the industry. Early in the process, the importance of identifying hidden project requirements became clear, particularly concerning the residency of state files and the existing network limitations of CI/CD runners. By auditing the infrastructure before writing a single line of code, the team avoided the common pitfall of reaching the middle of a migration only to realize that security policies forbade the storage of state files in a secondary cloud. Another vital lesson involved the communication of security benefits to stakeholders. Rather than presenting a purely conceptual argument for keyless access, the team delivered a functional prototype accompanied by audit evidence. This concrete demonstration allowed the security and compliance departments to see exactly how the temporary tokens were generated and revoked, which accelerated the approval process and built trust in the new architecture.
As the project reached its conclusion, several actionable steps were codified to ensure long-term stability and security for the platform. The team confirmed that choosing temporary federated identities over static service-account keys was the single most effective way to reduce the risk of credential leakage. During the final testing phases, they rigorously validated revocation procedures and token expiration as core product behaviors, ensuring that no access persisted beyond the lifetime of a specific deployment job. To maintain a clean security posture, the engineering group fully decommissioned all experimental setups and sandbox accounts once the proof of concept was finalized. This final cleanup step ensured that no “shadow” access or forgotten service accounts remained in the environment, leaving behind a streamlined, production-ready pipeline. This project ultimately proved that with a disciplined approach to identity federation, the complexities of multi-cloud management can be transformed into a secure and highly automated competitive advantage.
