oidc-in-google-cloud-platform.md

title	Configuring OpenID Connect in Google Cloud Platform
shortTitle	OIDC in Google Cloud Platform
intro	Use OpenID Connect within your workflows to authenticate with Google Cloud Platform.
versions	fpt ghec ghes * * *
redirect_from	/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform /actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform /actions/how-tos/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
contentType	how-tos
category	Secure your workflows

{% data reusables.actions.enterprise-github-hosted-runners %}

Overview

OpenID Connect (OIDC) allows your {% data variables.product.prodname_actions %} workflows to access resources in Google Cloud Platform (GCP), without needing to store the GCP credentials as long-lived {% data variables.product.prodname_dotcom %} secrets.

This guide gives an overview of how to configure GCP to trust {% data variables.product.prodname_dotcom %}'s OIDC as a federated identity, and includes a workflow example for the google-github-actions/auth action that uses tokens to authenticate to GCP and access resources.

Prerequisites

{% data reusables.actions.oidc-link-to-intro %}

{% data reusables.actions.oidc-security-notice %}

{% data reusables.actions.oidc-on-ghecom %}

For repositories created after July 15, 2026, and repository renames or transfers after that date, use an immutable default OIDC sub claim that includes owner and repository IDs (not available on {% data variables.product.prodname_ghe_server %}). Existing repositories keep the previous format unless they opt in. For more information, see AUTOTITLE.

{% ifversion ghes %} {% data reusables.actions.oidc-endpoints %}

Note

Google Cloud Platform does not have fixed IP ranges defined for these endpoints.

• Make sure that the value of the issuer claim that's included with the JSON Web Token (JWT) is set to a publicly routable URL. For more information, see AUTOTITLE. {% endif %}

Adding a Google Cloud Workload Identity Provider

To configure the OIDC identity provider in GCP, you will need to perform the following configuration. For instructions on making these changes, refer to the GCP documentation.

1. Create a new identity pool.
2. Configure the mapping and add conditions.
3. Connect the new pool to a service account.

Additional guidance for configuring the identity provider:

• For security hardening, make sure you've reviewed {% ifversion ghec %}AUTOTITLE{% else %}AUTOTITLE{% endif %}. For an example, see AUTOTITLE.
• For the service account to be available for configuration, it needs to be assigned to the roles/iam.workloadIdentityUser role. For more information, see the GCP documentation.
• The Issuer URL to use: {% ifversion ghes %}https://HOSTNAME/_services/token{% else %}https://token.actions.githubusercontent.com{% endif %}

Updating your {% data variables.product.prodname_actions %} workflow

To update your workflows for OIDC, you will need to make two changes to your YAML:

1. Add permissions settings for the token.
2. Use the google-github-actions/auth action to exchange the OIDC token (JWT) for a cloud access token.

{% data reusables.actions.oidc-deployment-protection-rules %}

Adding permissions settings

{% data reusables.actions.oidc-permissions-token %}

Requesting the access token

The google-github-actions/auth action receives a JWT from the {% data variables.product.prodname_dotcom %} OIDC provider, and then requests an access token from GCP. For more information, see the GCP documentation.

This example has a job called Get_OIDC_ID_token that uses actions to request a list of services from GCP.

• WORKLOAD-IDENTITY-PROVIDER: Replace this with the path to your identity provider in GCP. For example, projects/example-project-id/locations/global/workloadIdentityPools/name-of-pool/providers/name-of-provider
• SERVICE-ACCOUNT: Replace this with the name of your service account in GCP.

This action exchanges a {% data variables.product.prodname_dotcom %} OIDC token for a Google Cloud access token, using Workload Identity Federation.

{% data reusables.actions.actions-not-certified-by-github-comment %}
name: List services in GCP
on:
  pull_request:
    branches:
      - main

permissions:
  id-token: write

jobs:
  Get_OIDC_ID_token:
    runs-on: ubuntu-latest
    steps:
    - id: 'auth'
      name: 'Authenticate to GCP'
      uses: 'google-github-actions/auth@f1e2d3c4b5a6f7e8d9c0b1a2c3d4e5f6a7b8c9d0'
      with:
          create_credentials_file: 'true'
          workload_identity_provider: 'WORKLOAD-IDENTITY-PROVIDER'
          service_account: 'SERVICE-ACCOUNT'
    - id: 'gcloud'
      name: 'gcloud'
      run: |-
        gcloud auth login --brief --cred-file="{% raw %}${{ steps.auth.outputs.credentials_file_path }}{% endraw %}"
        gcloud services list

Further reading

{% data reusables.actions.oidc-further-reading %}