








<!doctype html>
<html 
      lang="en"
      dir="ltr">
  <head>
    <meta name="google-signin-client-id" content="721724668570-nbkv1cfusk7kk4eni4pjvepaus73b13t.apps.googleusercontent.com"><meta name="google-signin-scope"
          content="profile email https://www.googleapis.com/auth/developerprofiles https://www.googleapis.com/auth/developerprofiles.award https://www.googleapis.com/auth/devprofiles.full_control.firstparty"><meta property="og:site_name" content="Google Cloud Documentation">
    <meta property="og:type" content="website"><meta name="theme-color" content="#1a73e8"><meta charset="utf-8">
    <meta content="IE=Edge" http-equiv="X-UA-Compatible">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    

    <link rel="manifest" href="/_pwa/clouddocs/manifest.json"
          crossorigin="use-credentials">
    <link rel="preconnect" href="//www.gstatic.com" crossorigin>
    <link rel="preconnect" href="//fonts.googleapis.com" crossorigin>
    <link rel="preconnect" href="//www.google-analytics.com" crossorigin><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap">
      <link rel="stylesheet"
            href="//fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block"><link rel="stylesheet" href="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/css/app.css">
      
        <link rel="stylesheet" href="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/css/dark-theme.css" disabled>
      <link rel="shortcut icon" href="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/favicons/onecloud/favicon.ico">
    <link rel="apple-touch-icon" href="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/favicons/onecloud/super_cloud.png"><link rel="canonical" href="https://docs.cloud.google.com/iam/docs/workload-identity-federation"><link rel="search" type="application/opensearchdescription+xml"
            title="Google Cloud Documentation" href="https://docs.cloud.google.com/s/opensearch.xml">
      <link rel="alternate" hreflang="en"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation" /><link rel="alternate" hreflang="x-default" href="https://docs.cloud.google.com/iam/docs/workload-identity-federation" /><link rel="alternate" hreflang="zh-Hans"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=zh-cn" /><link rel="alternate" hreflang="zh-Hant"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=zh-tw" /><link rel="alternate" hreflang="fr"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=fr" /><link rel="alternate" hreflang="de"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=de" /><link rel="alternate" hreflang="he"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=he" /><link rel="alternate" hreflang="id"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=id" /><link rel="alternate" hreflang="it"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=it" /><link rel="alternate" hreflang="ja"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=ja" /><link rel="alternate" hreflang="ko"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=ko" /><link rel="alternate" hreflang="pt-BR"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=pt-br" /><link rel="alternate" hreflang="pt"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=pt" /><link rel="alternate" hreflang="es"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=es" /><link rel="alternate" hreflang="es-419"
          href="https://docs.cloud.google.com/iam/docs/workload-identity-federation?hl=es-419" /><link rel="alternate" hreflang="en"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation" /><link rel="alternate" hreflang="x-default" href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation" /><link rel="alternate" hreflang="zh-Hans"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=zh-cn" /><link rel="alternate" hreflang="zh-Hant"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=zh-tw" /><link rel="alternate" hreflang="fr"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=fr" /><link rel="alternate" hreflang="de"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=de" /><link rel="alternate" hreflang="he"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=he" /><link rel="alternate" hreflang="id"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=id" /><link rel="alternate" hreflang="it"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=it" /><link rel="alternate" hreflang="ja"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=ja" /><link rel="alternate" hreflang="ko"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=ko" /><link rel="alternate" hreflang="pt-BR"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=pt-br" /><link rel="alternate" hreflang="pt"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=pt" /><link rel="alternate" hreflang="es"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=es" /><link rel="alternate" hreflang="es-419"
          href="https://berlin.devsitetest.how/iam/docs/workload-identity-federation?hl=es-419" /><title>Workload Identity Federation &nbsp;|&nbsp; Identity and Access Management (IAM) &nbsp;|&nbsp; Google Cloud Documentation</title>

<meta property="og:title" content="Workload Identity Federation &nbsp;|&nbsp; Identity and Access Management (IAM) &nbsp;|&nbsp; Google Cloud Documentation"><meta property="og:url" content="https://docs.cloud.google.com/iam/docs/workload-identity-federation"><meta property="og:image" content="https://docs.cloud.google.com/_static/cloud/images/social-icon-google-cloud-1200-630.png">
  <meta property="og:image:width" content="1200">
  <meta property="og:image:height" content="630"><meta property="og:locale" content="en"><meta name="twitter:card" content="summary_large_image"><script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "Article",
    
    "headline": "Workload Identity Federation"
  }
</script><script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [{
      "@type": "ListItem",
      "position": 1,
      "name": "IAM",
      "item": "https://docs.cloud.google.com/iam/docs"
    },{
      "@type": "ListItem",
      "position": 2,
      "name": "Identity and Access Management (IAM)",
      "item": "https://docs.cloud.google.com/iam/docs"
    },{
      "@type": "ListItem",
      "position": 3,
      "name": "Workload Identity Federation",
      "item": "https://docs.cloud.google.com/iam/docs/workload-identity-federation"
    }]
  }
  </script>
  
    














































































































































  



























  


















































































































































































 
 
 































 
 












 
 

 
 
 





















 
 






























































































































































































































































































































































    

    
    
    
    
    
  

    </head>
  <body class="color-scheme--light"
        template="page"
        theme="clouddocs-theme"
        type="article"
        
        appearance
        
        layout="docs"
        
        
        free-trial
        
        
        display-toc
        pending>
  
    <devsite-progress type="indeterminate" id="app-progress"></devsite-progress>
  
  
    <a href="#main-content" class="skip-link button">
      
      Skip to main content
    </a>
    <section class="devsite-wrapper">
      <devsite-cookie-notification-bar></devsite-cookie-notification-bar>
        <cloudx-track userCountry="AU"></cloudx-track>

<devsite-header role="banner" keep-tabs-visible>
  
    





















<div class="devsite-header--inner" data-nosnippet>
  <div class="devsite-top-logo-row-wrapper-wrapper">
    <div class="devsite-top-logo-row-wrapper">
      <div class="devsite-top-logo-row">
        <button type="button" id="devsite-hamburger-menu"
          class="devsite-header-icon-button button-flat material-icons gc-analytics-event"
          data-category="Site-Wide Custom Events"
          data-label="Navigation menu button"
          visually-hidden
          aria-label="Open menu">
        </button>
        
<div class="devsite-product-name-wrapper">

  <a href="/" class="devsite-site-logo-link gc-analytics-event"
   data-category="Site-Wide Custom Events" data-label="Site logo" track-type="globalNav"
   track-name="googleCloudDocumentation" track-metadata-position="nav"
   track-metadata-eventDetail="nav">
  
  <picture>
    
    <source srcset="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/lockup_dark_theme.svg"
            media="(prefers-color-scheme: dark)"
            class="devsite-dark-theme">
    
    <img src="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/lockup_full_color.svg" class="devsite-site-logo" alt="Google Cloud Documentation">
  </picture>
  
</a>



</div>
        <div class="devsite-top-logo-row-middle">
          <div class="devsite-header-upper-tabs">
            
              
              
  <devsite-tabs class="upper-tabs">

    <nav class="devsite-tabs-wrapper" aria-label="Upper tabs">
      
        
          <tab class="devsite-dropdown
    
    devsite-active
    devsite-clickable
    ">
  
    <a href="https://docs.cloud.google.com/docs"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/docs"
    
       track-type="nav"
       track-metadata-position="nav - docs-home"
       track-metadata-module="primary nav"
       aria-label="Technology areas, selected" 
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Technology areas"
         
           track-name="docs-home"
         
           track-link-column-type="single-column"
         
       >
    Technology areas
  
    </a>
    
      <button
         aria-haspopup="menu"
         aria-expanded="false"
         aria-label="Dropdown menu for Technology areas"
         track-type="nav"
         track-metadata-eventdetail="https://docs.cloud.google.com/docs"
         track-metadata-position="nav - docs-home"
         track-metadata-module="primary nav"
         
          
            data-category="Site-Wide Custom Events"
          
            data-label="Tab: Technology areas"
          
            track-name="docs-home"
          
            track-link-column-type="single-column"
          
        
         class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button>
    
  
  <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden>
    <div class="devsite-tabs-dropdown-content">
      
        <button class="devsite-tabs-close-button material-icons button-flat gc-analytics-event"
                data-category="Site-Wide Custom Events"
                data-label="Close dropdown menu"
                aria-label="Close dropdown menu"
                track-type="nav"
                track-name="close"
                track-metadata-eventdetail="#"
                track-metadata-position="nav - docs-home"
                track-metadata-module="tertiary nav">close</button>
      
      
        <div class="devsite-tabs-dropdown-column
                    ">
          
            <ul class="devsite-tabs-dropdown-section
                       ">
              
              
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/ai-ml"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/ai-ml"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      AI and ML
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/application-development"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/application-development"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Application development
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/application-hosting"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/application-hosting"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Application hosting
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/compute-area"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/compute-area"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Compute
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/data"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/data"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Data analytics and pipelines
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/databases"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/databases"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Databases
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/dhm-cloud"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/dhm-cloud"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Distributed, hybrid, and multicloud
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/industry"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/industry"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Industry solutions
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/migration"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/migration"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Migration
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/networking"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/networking"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Networking
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/observability"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/observability"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Observability and monitoring
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/security"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/security"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Security
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/storage"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/storage"
                     track-metadata-position="nav - docs-home"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Storage
                    </div>
                    
                  </a>
                </li>
              
            </ul>
          
        </div>
      
    </div>
  </div>
</tab>
        
      
        
          <tab class="devsite-dropdown
    
    
    devsite-clickable
    ">
  
    <a href="https://docs.cloud.google.com/docs/cross-product-overviews"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/docs/cross-product-overviews"
    
       track-type="nav"
       track-metadata-position="nav - crossproduct"
       track-metadata-module="primary nav"
       
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Cross-product tools"
         
           track-name="crossproduct"
         
           track-link-column-type="single-column"
         
       >
    Cross-product tools
  
    </a>
    
      <button
         aria-haspopup="menu"
         aria-expanded="false"
         aria-label="Dropdown menu for Cross-product tools"
         track-type="nav"
         track-metadata-eventdetail="https://docs.cloud.google.com/docs/cross-product-overviews"
         track-metadata-position="nav - crossproduct"
         track-metadata-module="primary nav"
         
          
            data-category="Site-Wide Custom Events"
          
            data-label="Tab: Cross-product tools"
          
            track-name="crossproduct"
          
            track-link-column-type="single-column"
          
        
         class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button>
    
  
  <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden>
    <div class="devsite-tabs-dropdown-content">
      
        <button class="devsite-tabs-close-button material-icons button-flat gc-analytics-event"
                data-category="Site-Wide Custom Events"
                data-label="Close dropdown menu"
                aria-label="Close dropdown menu"
                track-type="nav"
                track-name="close"
                track-metadata-eventdetail="#"
                track-metadata-position="nav - crossproduct"
                track-metadata-module="tertiary nav">close</button>
      
      
        <div class="devsite-tabs-dropdown-column
                    ">
          
            <ul class="devsite-tabs-dropdown-section
                       ">
              
              
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/access-resources"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/access-resources"
                     track-metadata-position="nav - crossproduct"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Access and resources management
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/costs-usage"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/costs-usage"
                     track-metadata-position="nav - crossproduct"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Costs and usage management
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/iac"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/iac"
                     track-metadata-position="nav - crossproduct"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      Infrastructure as code
                    </div>
                    
                  </a>
                </li>
              
                <li class="devsite-nav-item">
                  <a href="https://docs.cloud.google.com/docs/devtools"
                    
                     track-type="nav"
                     track-metadata-eventdetail="https://docs.cloud.google.com/docs/devtools"
                     track-metadata-position="nav - crossproduct"
                     track-metadata-module="tertiary nav"
                     
                     tooltip
                  >
                    
                    <div class="devsite-nav-item-title">
                      SDK, languages, frameworks, and tools
                    </div>
                    
                  </a>
                </li>
              
            </ul>
          
        </div>
      
    </div>
  </div>
</tab>
        
      
    </nav>

  </devsite-tabs>

            
           </div>
          
<devsite-search
    enable-signin
    enable-search
    enable-suggestions
      
    
    enable-search-summaries
    project-name="Identity and Access Management (IAM)"
    tenant-name="Google Cloud Documentation"
    project-scope="/iam/docs"
    url-scoped="https://docs.cloud.google.com/s/results/iam/docs"
    
    
    
    >
  <form class="devsite-search-form" action="https://docs.cloud.google.com/s/results" method="GET">
    <div class="devsite-search-container">
      <button type="button"
              search-open
              class="devsite-search-button devsite-header-icon-button button-flat material-icons"
              
              aria-label="Open search"></button>
      <div class="devsite-searchbox">
        <input
          aria-activedescendant=""
          aria-autocomplete="list"
          
          aria-label="Search"
          aria-expanded="false"
          aria-haspopup="listbox"
          autocomplete="off"
          class="devsite-search-field devsite-search-query"
          name="q"
          
          placeholder="Search"
          role="combobox"
          type="text"
          value=""
          >
          <div class="devsite-search-image material-icons" aria-hidden="true">
            
              <svg class="devsite-search-ai-image" width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
                  <g clip-path="url(#clip0_6641_386)">
                    <path d="M19.6 21L13.3 14.7C12.8 15.1 12.225 15.4167 11.575 15.65C10.925 15.8833 10.2333 16 9.5 16C7.68333 16 6.14167 15.375 4.875 14.125C3.625 12.8583 3 11.3167 3 9.5C3 7.68333 3.625 6.15 4.875 4.9C6.14167 3.63333 7.68333 3 9.5 3C10.0167 3 10.5167 3.05833 11 3.175C11.4833 3.275 11.9417 3.43333 12.375 3.65L10.825 5.2C10.6083 5.13333 10.3917 5.08333 10.175 5.05C9.95833 5.01667 9.73333 5 9.5 5C8.25 5 7.18333 5.44167 6.3 6.325C5.43333 7.19167 5 8.25 5 9.5C5 10.75 5.43333 11.8167 6.3 12.7C7.18333 13.5667 8.25 14 9.5 14C10.6667 14 11.6667 13.625 12.5 12.875C13.35 12.1083 13.8417 11.15 13.975 10H15.975C15.925 10.6333 15.7833 11.2333 15.55 11.8C15.3333 12.3667 15.05 12.8667 14.7 13.3L21 19.6L19.6 21ZM17.5 12C17.5 10.4667 16.9667 9.16667 15.9 8.1C14.8333 7.03333 13.5333 6.5 12 6.5C13.5333 6.5 14.8333 5.96667 15.9 4.9C16.9667 3.83333 17.5 2.53333 17.5 0.999999C17.5 2.53333 18.0333 3.83333 19.1 4.9C20.1667 5.96667 21.4667 6.5 23 6.5C21.4667 6.5 20.1667 7.03333 19.1 8.1C18.0333 9.16667 17.5 10.4667 17.5 12Z" fill="#5F6368"/>
                  </g>
                <defs>
                <clipPath id="clip0_6641_386">
                <rect width="24" height="24" fill="white"/>
                </clipPath>
                </defs>
              </svg>
            
          </div>
          <div class="devsite-search-shortcut-icon-container" aria-hidden="true">
            <kbd class="devsite-search-shortcut-icon">/</kbd>
          </div>
      </div>
    </div>
  </form>
  <button type="button"
          search-close
          class="devsite-search-button devsite-header-icon-button button-flat material-icons"
          
          aria-label="Close search"></button>
</devsite-search>

        </div>

        

  

  
    <a class="devsite-header-link devsite-top-button button gc-analytics-event button-with-icon"
    href="//console.cloud.google.com/"
    data-category="Site-Wide Custom Events"
    data-label="Site header link: Console"
    
      
        referrerpolicy="no-referrer-when-downgrade"
      
        track-name="console"
      
        track-metadata-eventDetail="nav"
      
        track-type="globalNav"
      
        track-metadata-position="nav"
      
    >
  Console
</a>
  

  

  <devsite-appearance-selector></devsite-appearance-selector>

  
<devsite-language-selector>
  <ul role="presentation">
    
    
    <li role="presentation">
      <a role="menuitem" lang="en"
        >English</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="de"
        >Deutsch</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="es"
        >Español</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="es_419"
        >Español – América Latina</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="fr"
        >Français</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="id"
        >Indonesia</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="it"
        >Italiano</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="pt"
        >Português</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="pt_br"
        >Português – Brasil</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="he"
        >עברית</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="zh_cn"
        >中文 – 简体</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="zh_tw"
        >中文 – 繁體</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="ja"
        >日本語</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="ko"
        >한국어</a>
    </li>
    
  </ul>
</devsite-language-selector>




        
          <devsite-user 
                        
                        
                          enable-profiles
                        
                        
                          fp-auth
                        
                        id="devsite-user">
            
              
              <span class="button devsite-top-button" aria-hidden="true" visually-hidden>Sign in</span>
            
          </devsite-user>
        
        
        
      </div>
    </div>
  </div>



  <div class="devsite-collapsible-section
    ">
    <div class="devsite-header-background">
      
        
          <div class="devsite-product-id-row"
           >
            <div class="devsite-product-description-row">
              
                
                <div class="devsite-product-id">
                  
                    
  
  <a href="https://docs.cloud.google.com/iam/docs">
    
  <div class="devsite-product-logo-container"
       
       
       
    size="medium"
  >
  
    <picture>
      
      <source class="devsite-dark-theme"
              media="(prefers-color-scheme: dark)"
              srcset=" /_static/clouddocs/images/icons/categories/security-and-identity-white.svg"
              sizes="64px">
      
      <img class="devsite-product-logo"
           alt=""
           src="https://docs.cloud.google.com/_static/clouddocs/images/icons/categories/security-and-identity-color.svg"
           srcset=" /_static/clouddocs/images/icons/categories/security-and-identity-color.svg"
           sizes="64px"
           loading="lazy"
           >
    </picture>
  
  </div>
  
  </a>
  

                  
                  
                  
                    <ul class="devsite-breadcrumb-list"
  
    aria-label="Lower header breadcrumb">
  
  <li class="devsite-breadcrumb-item
             ">
    
    
    
      
        
  <a href="https://docs.cloud.google.com/iam/docs"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Lower Header"
      
        data-value="1"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="1"
      
        track-metadata-eventdetail="Identity and Access Management (IAM)"
      
    >
    
          IAM
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/iam/docs"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Lower Header"
      
        data-value="2"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="2"
      
        track-metadata-eventdetail="Identity and Access Management (IAM)"
      
    >
    
          Identity and Access Management (IAM)
        
  </a>
  
      
    
  </li>
  
</ul>
                </div>
                
              
              
            </div>
            
              <div class="devsite-product-button-row">
  

  
  <a href="//console.cloud.google.com/freetrial"
  
    class="cloud-free-trial-button button button-primary
      "
    
    
      
        track-metadata-eventDetail="nav"
      
        track-type="freeTrial"
      
        track-name="gcpCta"
      
        track-metadata-position="nav"
      
        referrerpolicy="no-referrer-when-downgrade"
      
    
    >Start free</a>

</div>
            
          </div>
          
        
      
      
        <div class="devsite-doc-set-nav-row">
          
          
            
            
  <devsite-tabs class="lower-tabs">

    <nav class="devsite-tabs-wrapper" aria-label="Lower tabs">
      
        
          <tab  >
            
    <a href="https://docs.cloud.google.com/iam/docs"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/iam/docs"
    
       track-type="nav"
       track-metadata-position="nav - overview"
       track-metadata-module="primary nav"
       
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Overview"
         
           track-name="overview"
         
       >
    Overview
  
    </a>
    
  
          </tab>
        
      
        
          <tab  class="devsite-active">
            
    <a href="https://docs.cloud.google.com/iam/docs/overview"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/iam/docs/overview"
    
       track-type="nav"
       track-metadata-position="nav - guides"
       track-metadata-module="primary nav"
       aria-label="Guides, selected" 
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Guides"
         
           track-name="guides"
         
       >
    Guides
  
    </a>
    
  
          </tab>
        
      
        
          <tab  >
            
    <a href="https://docs.cloud.google.com/iam/docs/apis"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/iam/docs/apis"
    
       track-type="nav"
       track-metadata-position="nav - reference"
       track-metadata-module="primary nav"
       
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Reference"
         
           track-name="reference"
         
       >
    Reference
  
    </a>
    
  
          </tab>
        
      
        
          <tab  >
            
    <a href="https://docs.cloud.google.com/iam/docs/samples"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/iam/docs/samples"
    
       track-type="nav"
       track-metadata-position="nav - samples"
       track-metadata-module="primary nav"
       
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Samples"
         
           track-name="samples"
         
       >
    Samples
  
    </a>
    
  
          </tab>
        
      
        
          <tab  >
            
    <a href="https://docs.cloud.google.com/iam/docs/resources"
    class="devsite-tabs-content gc-analytics-event "
      track-metadata-eventdetail="https://docs.cloud.google.com/iam/docs/resources"
    
       track-type="nav"
       track-metadata-position="nav - resources"
       track-metadata-module="primary nav"
       
       
         
           data-category="Site-Wide Custom Events"
         
           data-label="Tab: Resources"
         
           track-name="resources"
         
       >
    Resources
  
    </a>
    
  
          </tab>
        
      
    </nav>

  </devsite-tabs>

          
          
        </div>
      
    </div>
  </div>

</div>



  

  
</devsite-header>
        <devsite-book-nav scrollbars >
          
            





















<div class="devsite-book-nav-filter"
     >
  <span class="filter-list-icon material-icons" aria-hidden="true"></span>
  <input type="text"
         placeholder="Filter"
         
         aria-label="Type to filter"
         role="searchbox">
  
  <span class="filter-clear-button hidden"
        data-title="Clear filter"
        aria-label="Clear filter"
        role="button"
        tabindex="0"></span>
</div>

<nav class="devsite-book-nav devsite-nav nocontent" data-nosnippet
     aria-label="Side menu">
  <div class="devsite-mobile-header">
    <button type="button"
            id="devsite-close-nav"
            class="devsite-header-icon-button button-flat material-icons gc-analytics-event"
            data-category="Site-Wide Custom Events"
            data-label="Close navigation"
            aria-label="Close navigation">
    </button>
    <div class="devsite-product-name-wrapper">

  <a href="/" class="devsite-site-logo-link gc-analytics-event"
   data-category="Site-Wide Custom Events" data-label="Site logo" track-type="globalNav"
   track-name="googleCloudDocumentation" track-metadata-position="nav"
   track-metadata-eventDetail="nav">
  
  <picture>
    
    <source srcset="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/lockup_dark_theme.svg"
            media="(prefers-color-scheme: dark)"
            class="devsite-dark-theme">
    
    <img src="https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/lockup_full_color.svg" class="devsite-site-logo" alt="Google Cloud Documentation">
  </picture>
  
</a>


</div>
  </div>

  <div class="devsite-book-nav-wrapper">
    <div class="devsite-mobile-nav-top">
      
        <ul class="devsite-nav-list">
          
            <li class="devsite-nav-item">
              
  
  <a href="/docs"
    
       class="devsite-nav-title gc-analytics-event
              
              devsite-nav-active"
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Technology areas"
      
        track-name="docs-home"
      
        track-link-column-type="single-column"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Technology areas"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Technology areas
   </span>
    
  
  </a>
  

  
    <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu
               ">
      
<li class="devsite-nav-item">

  
  <span
    
       class="devsite-nav-title"
       tooltip
    
    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Technology areas"
      
        track-name="docs-home"
      
        track-link-column-type="single-column"
      
    >
  
    <span class="devsite-nav-text" tooltip menu="Technology areas">
      More
   </span>
    
    <span class="devsite-nav-icon material-icons" data-icon="forward"
          menu="Technology areas">
    </span>
    
  
  </span>
  

</li>

    </ul>
  
              
                <ul class="devsite-nav-responsive-tabs">
                  
                    
                    
                    
                    <li class="devsite-nav-item">
                      
  
  <a href="/iam/docs"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Overview"
      
        track-name="overview"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Overview"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Overview
   </span>
    
  
  </a>
  

  
                    </li>
                  
                    
                    
                    
                    <li class="devsite-nav-item">
                      
  
  <a href="/iam/docs/overview"
    
       class="devsite-nav-title gc-analytics-event
              
              devsite-nav-active"
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Guides"
      
        track-name="guides"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Guides"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip menu="_book">
      Guides
   </span>
    
  
  </a>
  

  
                    </li>
                  
                    
                    
                    
                    <li class="devsite-nav-item">
                      
  
  <a href="/iam/docs/apis"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Reference"
      
        track-name="reference"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Reference"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Reference
   </span>
    
  
  </a>
  

  
                    </li>
                  
                    
                    
                    
                    <li class="devsite-nav-item">
                      
  
  <a href="/iam/docs/samples"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Samples"
      
        track-name="samples"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Samples"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Samples
   </span>
    
  
  </a>
  

  
                    </li>
                  
                    
                    
                    
                    <li class="devsite-nav-item">
                      
  
  <a href="/iam/docs/resources"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Resources"
      
        track-name="resources"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Resources"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Resources
   </span>
    
  
  </a>
  

  
                    </li>
                  
                </ul>
              
            </li>
          
            <li class="devsite-nav-item">
              
  
  <a href="/docs/cross-product-overviews"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Cross-product tools"
      
        track-name="crossproduct"
      
        track-link-column-type="single-column"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Cross-product tools"
     track-type="globalNav"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Cross-product tools
   </span>
    
  
  </a>
  

  
    <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu
               ">
      
<li class="devsite-nav-item">

  
  <span
    
       class="devsite-nav-title"
       tooltip
    
    
      
        data-category="Site-Wide Custom Events"
      
        data-label="Tab: Cross-product tools"
      
        track-name="crossproduct"
      
        track-link-column-type="single-column"
      
    >
  
    <span class="devsite-nav-text" tooltip menu="Cross-product tools">
      More
   </span>
    
    <span class="devsite-nav-icon material-icons" data-icon="forward"
          menu="Cross-product tools">
    </span>
    
  
  </span>
  

</li>

    </ul>
  
              
            </li>
          
          
    
    
<li class="devsite-nav-item">

  
  <a href="//console.cloud.google.com/"
    
       class="devsite-nav-title gc-analytics-event button-with-icon"
    

    
      
        referrerpolicy="no-referrer-when-downgrade"
      
        track-name="console"
      
        track-metadata-eventDetail="nav"
      
        track-type="globalNav"
      
        track-metadata-position="nav"
      
    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Console"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Console
   </span>
    
  
  </a>
  

</li>

  
          
        </ul>
      
    </div>
    
      <div class="devsite-mobile-nav-bottom">
        
          
          <ul class="devsite-nav-list" menu="_book">
            <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Discover</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Product overview</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Get started</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/grant-role-console"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Grant roles in the Google Cloud console</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/write-policy-client-libraries"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Grant roles using client libraries</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/iam-security-architecture"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>IAM and your security architecture</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/google-identities"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Identity management for Google Cloud</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Configure identities for users</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/user-identities"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Identities for users</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/groups-in-cloud-console"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and manage Google groups in the Google Cloud console</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/groups-best-practices"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for using Google groups</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Federate identities for users</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/workforce-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Workforce identity federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/federated-identity-architectures"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Architecture patterns for identity federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/best-practices-workforce-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for using Workforce Identity Federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-identity-federation-scim"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>SCIM provisioning for Workforce Identity Federation</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Configure Workforce Identity Federation</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-microsoft-entra-id"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Microsoft Entra ID</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-microsoft-entra-id-scalable-groups"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Microsoft Entra ID with a large number of groups</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-okta"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Okta</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-pingfederate"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>PingFederate</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-pingone"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>PingOne AIC</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/configuring-workforce-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Other OIDC or SAML 2.0</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-sign-in-power-bi"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Access BigQuery data in Power BI with Microsoft Entra</span></a></li></ul></div></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Configure SCIM</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/configure-scim-ms-entra"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Microsoft Entra ID</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/configure-scim-okta"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Okta</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/configure-scim-oidc-saml"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>OIDC or SAML 2.0</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-obtaining-short-lived-credentials"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Obtain short-lived credentials for Workforce Identity Federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/manage-workforce-identity-pools-providers"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage workforce identity pools and providers</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-delete-user-data"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Delete Workforce Identity Federation users and their data</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-console-sso"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Set up user access to console (federated)</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-log-in-gcloud"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Sign in to the gcloud CLI with your federated identity</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Integrate OAuth applications</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/workforce-oauth-app"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>OAuth application integration overview</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workforce-manage-oauth-app"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage OAuth applications</span></a></li></ul></div></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Configure identities for workloads</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/workload-identities"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Identities for workloads</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Create and manage service accounts</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>About service accounts</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/service-account-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-account-creds"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service account credentials</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-account-impersonation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service account impersonation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-account-types"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service account types</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-account-permissions"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Roles for service account authentication</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/create-service-agents"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and grant roles to service agents</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-create"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create service accounts</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Manage service accounts</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-list-edit"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>List and edit service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-disable-enable"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Disable and enable service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-delete-undelete"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Delete and undelete service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-tags"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage tags for service accounts</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/attach-service-accounts"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Attach service accounts to resources</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-accounts-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies for service accounts and keys</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Service account best practices</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/best-practices-service-accounts"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for using service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/best-practices-for-using-service-accounts-in-deployment-pipelines"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for using service accounts in deployment pipelines</span></a></li></ul></div></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Use managed workload identities</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/managed-workload-identity"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>About managed workload identities</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Compute Engine</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/create-managed-workload-identities"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create managed workload identities for GCE</span></a></li></ul></div></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>GKE</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/create-managed-workload-identities-gke"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create managed workload identities for GKE</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/troubleshoot-managed-workload-identities-gke"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot managed workload identities for GKE</span></a></li></ul></div></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Cloud load balancing</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/create-managed-workload-identities-load-balancing"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create managed workload identities for load balancers</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/managed-workload-identity-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Federate identities for external workloads</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Workload Identity Federation</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Configure Workload Identity Federation</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-other-clouds"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>AWS or Azure</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-active-directory"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Active Directory</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-deployment-pipelines"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Deployment pipelines</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-kubernetes"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Kubernetes</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-x509-certificates"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Workloads with X.509 certificates</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-with-other-providers"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Other identity providers</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/authenticate-with-auth-libraries"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Authenticate workloads using Google auth libraries</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/manage-workload-identity-pools-providers"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage workload identity pools and providers</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/best-practices-for-using-workload-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for using Workload Identity Federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/use-workload-identity-federation-to-let-customers-access-their-cloud-resources"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Let customers access their Google Cloud resources from your product or service</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-download-cred-and-grant-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Download credential configuration and grant access</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/tutorial-cloud-run-workload-id-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Integrate Cloud Run and Workload Identity Federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/workload-identity-federation-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Create and manage service account keys</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/migrate-from-service-account-keys"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Migrate from service account keys</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/key-rotation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service account key rotation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/keys-create-delete"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and delete service account keys</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/keys-list-get"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>List and get service account keys</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/keys-upload"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Upload a public key</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/keys-disable-enable"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Disable and enable service account keys</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/best-practices-for-managing-service-account-keys"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for managing service account keys</span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/built-in-resource-identities"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Built-in identities for resources</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Configure identities for agents</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/agent-identity-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Agent Identity overview</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/create-and-deploy-agent"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and deploy an agent with Agent CLI and Agent Identity</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/auth-agent-own-identity"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Authenticate using an agent&#39;s own identity</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-expandable
           devsite-nav-preview"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Agent Identity auth manager</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/auth-manager-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Agent Identity auth manager overview</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/auth-with-3lo-v2"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Authenticate using 3-legged OAuth</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/auth-with-2lo-v2"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Authenticate using 2-legged OAuth</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/auth-with-api-key-v2"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Authenticate using an API key</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/manage-auth-providers-v2"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage auth providers</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/migrate-to-agent-identity-api"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Migrate to the Agent Identity API</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/auth-manager-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies for auth manager</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Control access to resources</span>
      </div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>About IAM access controls</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/roles-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Roles and permissions</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/principals-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Principals</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/policy-types"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Policy types</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/allow-policies"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Allow policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/resource-hierarchy-access-control"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Allow policy inheritance</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/deny-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Deny policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/principal-access-boundary-policies"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Principal access boundary policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/access-change-propagation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Access change propagation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/conditions-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>IAM Conditions</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Choose roles to grant</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/choose-role-type"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Choose which type of role to use</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/choose-predefined-roles"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Find the right predefined roles</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/role-picker-gemini"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Get predefined role suggestions with Gemini assistance</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/viewing-grantable-roles"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>View grantable roles</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Roles for specific job functions</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/job-functions/roles-for-job-functions"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Predefined roles for job functions</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/job-functions/billing"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Billing-related job functions</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/job-functions/networking"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Networking-related job functions</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/job-functions/auditing"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Auditing-related job functions</span></a></li></ul></div></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Create and manage custom roles</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/creating-custom-roles"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and manage custom roles</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/custom-roles-tags"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage tags for custom roles</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Grant access</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/granting-changing-revoking-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage access to projects, folders, and organizations</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/manage-access-service-accounts"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage access to service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/manage-access-other-resources"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage access to other resources</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/test-policy-changes"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Test allow policy changes</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Grant access conditionally</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/managing-conditional-role-bindings"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Manage conditional role bindings</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/configuring-temporary-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Configure temporary access</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/configuring-resource-based-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Configure resource-based access</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/tags-access-control"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Tags and conditional access</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/setting-limits-on-granting-roles"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Set limits on granting roles</span></a></li><li class="devsite-nav-item
           devsite-nav-alpha"><a href="/iam/docs/linting-policies"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Lint conditions in allow policies</span><span class="devsite-nav-icon material-icons"
        data-icon="alpha"
        data-title="Alpha"
        aria-hidden="true"></span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/deny-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Deny access</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Restrict the resources that a principal can access</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/principal-access-boundary-policies-create"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create and apply principal access boundary policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/principal-access-boundary-policies-view"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>View principal access boundary policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/principal-access-boundary-policies-edit"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Edit principal access boundary policies</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/principal-access-boundary-policies-remove"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Remove principal access boundary policies</span></a></li></ul></div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Temporary elevated access</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/temporary-elevated-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Temporary elevated access overview</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Control temporary elevated access with PAM</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/pam-overview"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>PAM overview</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-permissions-and-setup"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Permissions and setup</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-create-entitlements"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create entitlements</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-view-update-delete-entitlements"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>View, update, and delete entitlements</span></a></li><li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/pam-configure-settings"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Configure PAM settings</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li><li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/pam-view-export-settings"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>View and export PAM settings</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-view-grants"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>View grants</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-revoke-grants"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Revoke grants</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-audit-entitlement-events"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Audit entitlement and grant events</span></a></li><li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/pam-remediate-iam-recommendations"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Remediate excessive permissions with PAM</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li><li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/pam-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies for Privileged Access Manager</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-best-practices"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Best practices for PAM</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/pam-request-temporary-elevated-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Request temporary elevated access with PAM</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-withdraw-grants"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Withdraw grants</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/pam-approve-deny-grants"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Approve or deny grants with PAM</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/create-short-lived-credentials-direct"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create short-lived credentials for a service account</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/create-short-lived-credentials-delegated"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create short-lived credentials for multiple service accounts</span></a></li><li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Restrict a credential&#39;s Cloud Storage permissions</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/downscoping-short-lived-credentials"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Credential Access Boundaries for Cloud Storage</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/create-downscoped-short-lived-credentials"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Create a downscoped short-lived credential</span></a></li></ul></div></li><li class="devsite-nav-item"><a href="/iam/docs/migrating-to-credentials-api"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Migrate to the Service Account Credentials API</span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/restore-iam-policy"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Restore a previous version of an allow policy</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/testing-permissions"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Test permissions for custom user interfaces</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/org-policy-custom-constraints"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use custom organization policies for allow policies</span></a></li>

  <li class="devsite-nav-item"><a href="/solutions/help-secure-the-pipeline-from-your-data-lake-to-your-data-warehouse"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use IAM to help prevent exfiltration from data pipelines</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Optimize your IAM configuration</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/using-iam-securely"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Use IAM securely</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/policy-intelligence-tools"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Optimize IAM policies by using Policy Intelligence tools</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/secure-iam-vpc-sc"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Help secure IAM using VPC Service Controls</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Monitor</span>
      </div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Audit logging</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/audit-logging"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>IAM API audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-iamscim"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>IAM SCIM audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-iamcreds"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Service Account Credentials API audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-agentidentity"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Agent Identity API audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-agentidentitycredentials"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Agent Identity Credentials API audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-pam"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Privileged Access Manager audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/audit-logging-sts"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Security Token Service API audit logging</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/examples-service-accounts"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Example logs for service accounts</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/examples-workforce-identity"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Example logs for Workforce Identity Federation</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/examples-oauth-clients"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Example logs for Workforce OAuth application integration</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/audit-logging/examples-workload-identity"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Example logs for Workload Identity Federation</span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/analyze-access"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Analyze access to resources</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Monitor service account usage</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/service-account-usage-tools"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Tools to understand service account usage</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/service-account-monitoring"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Monitor usage patterns for service accounts and keys</span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/review-iam-policy-history"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Review allow policy history</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/review-security-insights"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Review security insights</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Troubleshoot</span>
      </div></li>

  <li class="devsite-nav-item
           devsite-nav-expandable"><div class="devsite-expandable-nav">
      <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button">
        <span class="devsite-nav-text" tooltip>Troubleshoot permission error messages</span>
      </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/iam/docs/permission-error-messages"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Permission error messages</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/request-missing-permissions"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Request missing permissions</span></a></li><li class="devsite-nav-item"><a href="/iam/docs/resolve-permission-errors"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Resolve permission errors</span></a></li></ul></div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/troubleshoot-policies"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot allow and deny policies</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/troubleshoot-org-policies"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot organization policy errors for service accounts</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/troubleshooting-withcond"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot &#34;withcond&#34; in policies and role bindings</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/troubleshooting-workforce-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot Workforce Identity Federation</span></a></li>

  <li class="devsite-nav-item"><a href="/iam/docs/troubleshooting-workload-identity-federation"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot Workload Identity Federation</span></a></li>

  <li class="devsite-nav-item
           devsite-nav-preview"><a href="/iam/docs/troubleshoot-auth-manager"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Troubleshoot Agent Identity auth manager</span><span class="devsite-nav-icon material-icons"
        data-icon="preview"
        data-title="Preview"
        aria-hidden="true"></span></a></li>

  <li class="devsite-nav-item
           devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path">
        <span class="devsite-nav-text" tooltip>Samples</span>
      </div></li>

  <li class="devsite-nav-item"><a href="/iam/docs/samples"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>All Identity and Access Management code samples</span></a></li>

  <li class="devsite-nav-item"><a href="/docs/samples"
        class="devsite-nav-title"
      ><span class="devsite-nav-text" tooltip>Code samples for all products</span></a></li>
          </ul>
        
        
          
    
      
      <ul class="devsite-nav-list" menu="Technology areas"
          aria-label="Side menu" hidden>
        
          
            
            
              
<li class="devsite-nav-item">

  
  <a href="/docs/ai-ml"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: AI and ML"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      AI and ML
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/application-development"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Application development"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Application development
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/application-hosting"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Application hosting"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Application hosting
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/compute-area"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Compute"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Compute
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/data"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Data analytics and pipelines"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Data analytics and pipelines
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/databases"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Databases"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Databases
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/dhm-cloud"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Distributed, hybrid, and multicloud"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Distributed, hybrid, and multicloud
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/industry"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Industry solutions"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Industry solutions
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/migration"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Migration"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Migration
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/networking"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Networking"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Networking
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/observability"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Observability and monitoring"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Observability and monitoring
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/security"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Security"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Security
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/storage"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Storage"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Storage
   </span>
    
  
  </a>
  

</li>

            
          
        
      </ul>
    
  
    
      
      <ul class="devsite-nav-list" menu="Cross-product tools"
          aria-label="Side menu" hidden>
        
          
            
            
              
<li class="devsite-nav-item">

  
  <a href="/docs/access-resources"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Access and resources management"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Access and resources management
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/costs-usage"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Costs and usage management"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Costs and usage management
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/iac"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: Infrastructure as code"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      Infrastructure as code
   </span>
    
  
  </a>
  

</li>

            
              
<li class="devsite-nav-item">

  
  <a href="/docs/devtools"
    
       class="devsite-nav-title gc-analytics-event
              
              "
    

    
     data-category="Site-Wide Custom Events"
     data-label="Responsive Tab: SDK, languages, frameworks, and tools"
     track-type="navMenu"
     track-metadata-eventDetail="globalMenu"
     track-metadata-position="nav">
  
    <span class="devsite-nav-text" tooltip >
      SDK, languages, frameworks, and tools
   </span>
    
  
  </a>
  

</li>

            
          
        
      </ul>
    
  
        
        
          
    
  
    
  
    
  
    
  
    
  
        
      </div>
    
  </div>
</nav>
          
        </devsite-book-nav>
      
      <section id="gc-wrapper">
        <main role="main" id="main-content" class="devsite-main-content"
            
              has-book-nav
              has-sidebar
            >
          <div class="devsite-sidebar">
            <div class="devsite-sidebar-content">
                
                <devsite-toc class="devsite-nav"
                            role="navigation"
                            aria-label="On this page"
                            depth="2"
                            scrollbars
                            data-nosnippet
                  ></devsite-toc>
                <devsite-recommendations-sidebar class="nocontent devsite-nav" data-nosnippet>
                </devsite-recommendations-sidebar>
            </div>
          </div>
          <devsite-content>
            
              










<article class="devsite-article">
  
  
  
  
  

  <div class="devsite-article-meta nocontent" role="navigation" data-nosnippet>
    
    
    <ul class="devsite-breadcrumb-list"
  
    aria-label="Breadcrumb">
  
  <li class="devsite-breadcrumb-item
             ">
    
    
    
      
        
  <a href="https://docs.cloud.google.com/"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="1"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="1"
      
        track-metadata-eventdetail="Google Cloud Documentation"
      
    >
    
          Home
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/docs"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="2"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="2"
      
        track-metadata-eventdetail="Documentation"
      
    >
    
          Documentation
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/docs/security"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="3"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="3"
      
        track-metadata-eventdetail="Security"
      
    >
    
          Security
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/iam/docs"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="4"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="4"
      
        track-metadata-eventdetail="Identity and Access Management (IAM)"
      
    >
    
          IAM
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/iam/docs"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="5"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="5"
      
        track-metadata-eventdetail="Identity and Access Management (IAM)"
      
    >
    
          Identity and Access Management (IAM)
        
  </a>
  
      
    
  </li>
  
  <li class="devsite-breadcrumb-item
             ">
    
      
      <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div>
    
    
    
      
        
  <a href="https://docs.cloud.google.com/iam/docs/overview"
      
        class="devsite-breadcrumb-link gc-analytics-event"
      
        data-category="Site-Wide Custom Events"
      
        data-label="Breadcrumbs"
      
        data-value="6"
      
        track-type="globalNav"
      
        track-name="breadcrumb"
      
        track-metadata-position="6"
      
        track-metadata-eventdetail=""
      
    >
    
          Guides
        
  </a>
  
      
    
  </li>
  
</ul>
    
      
    <devsite-thumb-rating position="header">
    </devsite-thumb-rating>
  
    
  </div>
  
    <devsite-feedback
  position="header"
  project-name="Identity and Access Management (IAM)"
  product-id="717553"
  bucket="BYOID"
  context=""
  version="t-devsite-webserver-20260811-r00-rc00.479616194204729361"
  data-label="Send Feedback Button"
  track-type="feedback"
  track-name="sendFeedbackLink"
  track-metadata-position="header"
  class="nocontent"
  data-nosnippet
  
  
  
    
      project-icon="https://docs.cloud.google.com/_static/clouddocs/images/icons/categories/security-and-identity-color.svg"
    
  
  
  
  >

  <button>
  
    
    Send feedback
  
  </button>
</devsite-feedback>
  
    <h1 class="devsite-page-title" tabindex="-1">
      Workload Identity Federation<devsite-actions hidden data-nosnippet><devsite-feature-tooltip
      ack-key="AckCollectionsBookmarkTooltipDismiss"
      analytics-category="Site-Wide Custom Events"
      analytics-action-show="Callout Profile displayed"
      analytics-action-close="Callout Profile dismissed"
      analytics-label="Create Collection Callout"
      class="devsite-page-bookmark-tooltip nocontent"
      data-nosnippet
      dismiss-button="true"
      id="devsite-collections-dropdown"
      
      dismiss-button-text="Dismiss"

      
      close-button-text="Got it">

    
    
      <devsite-bookmark></devsite-bookmark>
    

    <span slot="popout-heading">
      
      Stay organized with collections
    </span>
    <span slot="popout-contents">
      
      Save and categorize content based on your preferences.
    </span>
  </devsite-feature-tooltip>
    <devsite-llm-tools></devsite-llm-tools></devsite-actions>
  
      
    </h1>
  

  <devsite-toc class="devsite-nav"
    depth="2"
    devsite-toc-embedded
    >
  </devsite-toc>
  
    
  <div class="devsite-article-body clearfix
  ">

  
    
    
    
  



<p>This document provides an overview of Workload Identity Federation.
Using Workload Identity Federation, you can provide on-premises or multicloud
workloads with access to Google Cloud resources by using federated identities
instead of a service account key.</p>

<p>You can use Workload Identity Federation with workloads that authenticate
using
<a href="/iam/docs/workload-identity-federation-with-x509-certificates">X.509 client certificates</a>;
that run on
<a href="/iam/docs/workload-identity-federation-with-other-clouds">Amazon Web Services (AWS) or Azure</a>;
on-premises
<a href="/iam/docs/workload-identity-federation-with-active-directory">Active Directory</a>;
deployment services, such as
<a href="/iam/docs/workload-identity-federation-with-deployment-pipelines">GitHub and GitLab</a>;
and with any identity provider (IdP) that supports
<a href="/iam/docs/workload-identity-federation-with-other-providers">OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) V2.0</a>.</p>

<h2 id="why" data-text="Why Workload Identity Federation?" tabindex="-1">Why Workload Identity Federation?</h2>

<p>Applications running outside Google Cloud can use
<a href="/iam/docs/service-account-creds#key-types">service account keys</a>
to access Google Cloud resources. However, service account keys are
powerful credentials, and can present a security risk if they are not managed
correctly. Workload Identity Federation eliminates the maintenance and
security burden associated with service account keys.</p>

<p>With Workload Identity Federation, you can use Identity and Access Management (IAM)
to grant <a href="/iam/docs/overview#roles">IAM roles</a> to <a href="/iam/docs/principals-overview">principals</a>
that are based on federated identities in a workload identity pool. You can
grant access to the principals on specific Google Cloud resources. This
approach is called <em>direct access</em>. Alternatively, you can grant access to a
service account, which can then access Google Cloud resources. This
approach is called <em>service account impersonation</em>.</p>

<h2 id="pools" data-text="Workload identity pools" tabindex="-1">Workload identity pools</h2>

<p>A <em>workload identity pool</em> is an entity that lets you manage external
identities.</p>

<p>In general, we recommend creating a new pool for each non-Google Cloud
environment that needs to access Google Cloud resources, such as
development, staging, or production environments.</p>

<h2 id="providers" data-text="Workload identity pool providers" tabindex="-1">Workload identity pool providers</h2>

<p>A <em>workload identity pool provider</em> is an entity that describes a relationship
between Google Cloud and your IdP, including the following:</p>

<ul>
<li>AWS</li>
<li>Microsoft Entra ID</li>
<li>GitHub</li>
<li>GitLab</li>
<li>Kubernetes clusters</li>
<li>Okta</li>
<li>On-premises Active Directory Federation Services (AD FS)</li>
<li>Terraform</li>
</ul>

<p>Workload Identity Federation follows the <a href="https://tools.ietf.org/html/rfc8693">OAuth 2.0 token exchange</a>
specification. You provide a credential from your IdP to the <a href="/iam/docs/reference/sts/rest">Security Token Service</a>,
which verifies the identity on the credential, and then returns a federated
token in exchange.</p>

<h3 id="oidc-credential-security" data-text="OIDC provider with local JWKs" tabindex="-1">OIDC provider with local JWKs</h3>

<p>To federate workloads that don&#39;t have a public OIDC endpoint, you can upload
OIDC JSON Web Key Sets (JWKS) directly to the pool. This is common if you have
Terraform or GitHub Enterprise hosted in your own environment or you have
regulatory requirements not to expose public URLs. For more information, see
<a href="/iam/docs/workload-identity-federation-with-other-providers#manage-oidc-keys">Manage OIDC JWKs (Optional)</a>.</p>

<h3 id="mapping" data-text="Attribute mappings" tabindex="-1">Attribute mappings</h3>

<p>The tokens issued by your external IdP contain one or more
attributes. Some IdPs refer to these attributes as <em>claims</em>.</p>

<p>Google Security Token Service tokens also contain one or more attributes, as listed
in the following table:</p>

<table>
  <tr>
    <th>Attribute</th>
    <th>Description</th>
  </tr>
  <tr>
    <td><code translate="no" dir="ltr">google.subject</code></td>
    <td>
      Required. A unique identifier for the user. This attribute is used in
      IAM <code translate="no" dir="ltr">principal://</code> role bindings and appears in
      Cloud Logging logs.
      The value must be unique and can't exceed 127 characters.
    </td>
  </tr>
  <tr>
    <td><code translate="no" dir="ltr">google.groups</code></td>
    <td>
      Optional. A set of groups that the identity belongs to. This attribute is
      used in IAM <code translate="no" dir="ltr">principalSet://</code> role bindings to
      grant access to all members of a group.
    </td>
  </tr>
  <tr>
    <td><code translate="no" dir="ltr">attribute.<var translate="no">NAME</var></code></td>
    <td>
      Optional. You can define up to 50 custom attributes and use these
      attributes in IAM <code translate="no" dir="ltr">principalSet://</code> role
      bindings to grant access to all identities with a certain attribute.
    </td>
  </tr>
</table>

<p>An attribute mapping defines how to derive the value of the Google
Security Token Service token attribute from an external token. For each Google
Security Token Service token attribute, you can define an attribute mapping,
formatted as follows:</p>

<p><code translate="no" dir="ltr"><var translate="no">TARGET_ATTRIBUTE</var></code>=<code translate="no" dir="ltr"><var translate="no">SOURCE_EXPRESSION</var></code></p>

<p>Replace the following:</p>

<ul>
<li><code translate="no" dir="ltr"><var translate="no">TARGET_ATTRIBUTE</var></code> is an attribute of the Google
Security Token Service token</li>
<li><code translate="no" dir="ltr"><var translate="no">SOURCE_EXPRESSION</var></code> is a
<a href="https://github.com/google/cel-spec/blob/master/doc/intro.md#introduction">Common Expression Language (CEL)</a>
expression that transforms one or more attributes from the tokens issued by
your external IdP</li>
</ul>

<p>The following list provides attribute mapping examples:</p>

<ul>
<li><p>Assign the assertion attribute <code translate="no" dir="ltr">sub</code> to <code translate="no" dir="ltr">google.subject</code>:</p>

<div></div><devsite-code><pre translate="no" dir="ltr" is-upgraded>
google.subject=assertion.sub
</pre></devsite-code></li>
<li><p>Concatenate multiple assertion attributes:</p>

<div></div><devsite-code><pre translate="no" dir="ltr" is-upgraded>
google.subject='myprovider::' + assertion.aud + '::' + assertion.sub
</pre></devsite-code></li>
<li><p>Map a GUID-valued assertion attribute <code translate="no" dir="ltr">workload_id</code>
to a name, and assign the result to a custom attribute named <code translate="no" dir="ltr">attribute.my_display_name</code>:</p>

<div></div><devsite-code><pre translate="no" dir="ltr" is-upgraded>
attribute.my_display_name={
  "8bb39bdb-1cc5-4447-b7db-a19e920eb111": "Workload1",
  "55d36609-9bcf-48e0-a366-a3cf19027d2a": "Workload2"
}[assertion.workload_id]
</pre></devsite-code></li>
<li><p>Use CEL <a href="https://github.com/google/cel-spec/blob/master/doc/langdef.md#list-of-standard-definitions">logical operators and functions</a>
to set a custom attribute named <code translate="no" dir="ltr">attribute.environment</code> to either
<code translate="no" dir="ltr">prod</code> or <code translate="no" dir="ltr">test</code>, depending on the identity&#39;s Amazon Resource Name (ARN):</p>

<div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded>
attribute.environment=assertion.arn.contains(":instance-profile/Production") ? "prod" : "test"
</pre></devsite-code></li>
<li><p>Use the <a href="/iam/docs/conditions-attribute-reference#extract"><code translate="no" dir="ltr">extract</code> function</a>
to populate a custom attribute <code translate="no" dir="ltr">aws_role</code> with the name of the assumed role or,
if no role has been assumed, with the identity&#39;s ARN.</p>

<div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded>
attribute.aws_role=assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn
</pre></devsite-code></li>
<li><p>Use the <a href="https://pkg.go.dev/github.com/google/cel-go/ext#readme-split"><code translate="no" dir="ltr">split</code> function</a>
splits a string on the provided separator value. For example, to extract the attribute <code translate="no" dir="ltr">username</code> from an email address attribute by splitting its value at the <code translate="no" dir="ltr">@</code> and using the first string, use the following attribute mapping:
<div></div><devsite-code><pre translate="no" dir="ltr" is-upgraded>
attribute.username=assertion.email.split(&quot;@&quot;)[0]
</pre></devsite-code></p></li>
<li><p><a href="https://pkg.go.dev/github.com/google/cel-go/ext#readme-join"><code translate="no" dir="ltr">join</code> function</a>
joins a list of strings on the provided separator value. For example, to
populate the custom attribute <code translate="no" dir="ltr">department</code> by concatenating a list of
strings with <code translate="no" dir="ltr">.</code> as a separator, use the following attribute mapping:
<div></div><devsite-code><pre translate="no" dir="ltr" is-upgraded>
attribute.department=assertion.department.join(&quot;.&quot;)
</pre></devsite-code></p></li>
</ul>

<p>When you use X.509 client certificates, Google provides default mappings from
certificate attributes.</p>

<p>For AWS, Google provides default mappings, which cover most common scenarios.
You can also supply custom mappings.</p>

<p>For OIDC providers, you supply the mappings. To construct the mapping, consult
the provider&#39;s documentation for a list of attributes on their credentials.</p>

<p>For more details, see the API documentation for the
<a href="/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#WorkloadIdentityPoolProvider.FIELDS.attribute_mapping"><code translate="no" dir="ltr">attributeMapping</code> field</a>.</p>

<h3 id="conditions" data-text="Attribute conditions" tabindex="-1">Attribute conditions</h3>

<p>An <em>attribute condition</em> is a CEL expression that can check assertion attributes
and target attributes. If the attribute condition evaluates to <code translate="no" dir="ltr">true</code> for a
given credential, the credential is accepted. Otherwise, the credential is
rejected.</p>

<p>You can use an attribute condition to restrict which identities can authenticate
using your workload identity pool.</p>

<p>Attribute conditions are useful in scenarios such as the following:</p>

<ul>
<li><p>If your workload uses an IdP that&#39;s available to the general
public, you can restrict access so only the identities you choose have access
to your workload identity pool.</p></li>
<li><p>If you&#39;re using an IdP with multiple cloud platforms, you can
prevent credentials intended for use with another platform from being used
with Google Cloud, and vice-versa. This helps avoid the
<a href="https://wikipedia.org/wiki/Confused_deputy_problem">confused deputy problem</a>.</p></li>
</ul>

<p>The attribute condition for a workload identity pool provider can use the
<code translate="no" dir="ltr">assertion</code> keyword, which refers to a map that represents the authentication
credential issued by the IdP. You can use dot notation to access
the map&#39;s values. For example, AWS credentials include an <code translate="no" dir="ltr">arn</code> value, which you
can access as <code translate="no" dir="ltr">assertion.arn</code>. In addition, the attribute condition can use any
attribute that is defined in the provider&#39;s <a href="#mapping">attribute mapping</a>.</p>

<p>The following example only allows requests from identities that have a specific
AWS role:</p>

<div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">attribute.aws_role<span class="devsite-syntax-w"> </span><span class="devsite-syntax-o">==</span><span class="devsite-syntax-w"> </span><span class="devsite-syntax-s2">"<var translate="no">ROLE_MAPPING</var>"</span></pre></devsite-code>

<p>For more details, see the API documentation for the
<a href="/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#WorkloadIdentityPoolProvider.FIELDS.attribute_condition"><code translate="no" dir="ltr">attributeCondition</code> field</a>.</p>

<h2 id="access_management" data-text="Access management" tabindex="-1">Access management</h2>

<p>The token exchange flow returns a federated access token. You can use this
federated access token to grant your workload access on behalf of
<a href="#principal-types">principal identities</a> on Google Cloud resources and obtain a
<a href="/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth">short-lived OAuth 2.0 access token</a>.</p>

<p>You can use this access token to provide IAM access.</p>

<p>We recommend that you use Workload Identity Federation to provide access
<a href="#direct-resource-access">directly to a Google Cloud resource</a>.
Although most Google Cloud APIs support Workload Identity Federation,
some APIs have <a href="/iam/docs/federated-identity-supported-services">limitations</a>.
As an alternative, you can use <a href="#impersonation">service account impersonation</a>.</p>

<p>The short-lived access token lets you call any Google Cloud APIs that the
resource or service account has access to.</p>

<h3 id="direct-resource-access" data-text="Direct resource access" tabindex="-1">Direct resource access</h3>

<p>You can use <em>direct resource access</em> to grant to your external identity access
directly on a Google Cloud resource using resource-specific roles.</p>

<h3 id="impersonation" data-text="Alternative: Service account impersonation" tabindex="-1">Alternative: Service account impersonation</h3>

<p>As an alternative to providing <a href="#direct-resource-access">direct resource access</a> you
can use <a href="/iam/docs/workload-identity-federation-with-other-clouds#impersonation">service account impersonation</a>.</p>
<aside class="note"><strong>Note:</strong><span> Use fully qualified resource names when granting roles to external
identities, and use your <em>project number</em>, not your <em>project ID</em>.</span></aside>
<p>You must grant your service account the role Workload Identity User
(<code translate="no" dir="ltr">roles/iam.workloadIdentityUser</code>).</p>

<h3 id="security" data-text="Principal scopes and security" tabindex="-1">Principal scopes and security</h3>

<p>You grant access to principals or subsets thereof by using <a href="#principal-types">principal types</a>.</p>
<aside class="warning"><strong>Warning:</strong><span> Although you can grant access to all of the identities in a workload
identity pool, doing so can incur risk. We recommend that you limit access
using <a href="#mapping">attributes</a> and <a href="#conditions">conditions</a>.</span></aside>
<h2 id="principal-types" data-text="Principal types" tabindex="-1">Principal types</h2>

<p>The following table describes how to define principals as individuals and groups
of identities:</p>







<table>
  <thead>
    <tr>
      <th width="30%">Identities</th>
      
        <th>Identifier format</th>
      
    </tr>
  </thead>
  <tbody>

    

    

    
      <tr>
        <td>Single identity</td>
        
          <td>
            <code translate="no" dir="ltr">principal://iam.googleapis.com/projects/<var translate="no">PROJECT_NUMBER</var>/locations/global/<wbr />workloadIdentityPools/<var translate="no">POOL_ID</var>/subject/<var translate="no">SUBJECT_ATTRIBUTE_VALUE</var></code>
          </td>
        
      </tr>
    

    
      <tr>
        <td>All identities in a group</td>
        
          <td>
            <code translate="no" dir="ltr">principalSet://iam.googleapis.com/projects/<var translate="no">PROJECT_NUMBER</var>/locations/global/<wbr />workloadIdentityPools/<var translate="no">POOL_ID</var>/group/<var translate="no">GROUP_ID</var></code>
          </td>
        
      </tr>
    

    <tr>
      <td>
        All identities with a specific <em>attribute value</em>
      </td>
      
        <td>
          <code translate="no" dir="ltr">principalSet://iam.googleapis.com/projects/<var translate="no">PROJECT_NUMBER</var>/locations/global/<wbr />workloadIdentityPools/<var translate="no">POOL_ID</var>/attribute.<var translate="no">ATTRIBUTE_NAME</var>/<var translate="no">ATTRIBUTE_VALUE</var></code>
        </td>
      
    </tr>
  </tbody>
</table>

<h2 id="whats_next" data-text="What's next" tabindex="-1">What's next</h2>

<ul>
<li><p>Use Workload Identity Federation to let your workloads access resources
from <a href="/iam/docs/workload-identity-federation-with-other-clouds">AWS or Azure</a>,
<a href="/iam/docs/workload-identity-federation-with-x509-certificates">X.509 Certificates</a>,
<a href="/iam/docs/workload-identity-federation-with-active-directory">Active Directory</a>,
<a href="/iam/docs/workload-identity-federation-with-deployment-pipelines">Deployment pipelines</a>, or
<a href="/iam/docs/workload-identity-federation-with-other-providers">OIDC or SAML providers</a>.</p></li>
<li><p>Learn how to <a href="/iam/docs/manage-workload-identity-pools-providers">manage workload identity pools</a>
using the Google Cloud CLI or the REST API.</p></li>
</ul>


  
  

  
    <devsite-hats-survey class="nocontent" data-nosnippet
      hats-id="Nd7nTix2o0eU5NUYprb0ThtUc5jf"
      listnr-id="83405"></devsite-hats-survey>
  

  
</div>

  
    
    
      
    <devsite-thumb-rating position="footer">
    </devsite-thumb-rating>
  
       
         <devsite-feedback
  position="footer"
  project-name="Identity and Access Management (IAM)"
  product-id="717553"
  bucket="BYOID"
  context=""
  version="t-devsite-webserver-20260811-r00-rc00.479616194204729361"
  data-label="Send Feedback Button"
  track-type="feedback"
  track-name="sendFeedbackLink"
  track-metadata-position="footer"
  class="nocontent"
  data-nosnippet
  
  
  
    
      project-icon="https://docs.cloud.google.com/_static/clouddocs/images/icons/categories/security-and-identity-color.svg"
    
  
  
  
  >

  <button>
  
    
    Send feedback
  
  </button>
</devsite-feedback>
       
    
    
  

  <div class="devsite-floating-action-buttons"></div></article>


<devsite-content-footer class="nocontent" data-nosnippet>
  <p>Except as otherwise noted, the content of this page is licensed under the <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 License</a>, and code samples are licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache 2.0 License</a>. For details, see the <a href="https://developers.google.com/site-policies">Google Developers Site Policies</a>. Java is a registered trademark of Oracle and/or its affiliates.</p>
  <p>Last updated 2026-08-13 UTC.</p>
</devsite-content-footer>


<devsite-notification
>
</devsite-notification>


  
<div class="devsite-content-data">
  
    
    
    <template class="devsite-thumb-rating-feedback">
      <devsite-feedback
  position="thumb-rating"
  project-name="Identity and Access Management (IAM)"
  product-id="717553"
  bucket="BYOID"
  context=""
  version="t-devsite-webserver-20260811-r00-rc00.479616194204729361"
  data-label="Send Feedback Button"
  track-type="feedback"
  track-name="sendFeedbackLink"
  track-metadata-position="thumb-rating"
  class="nocontent"
  data-nosnippet
  
  
  
    
      project-icon="https://docs.cloud.google.com/_static/clouddocs/images/icons/categories/security-and-identity-color.svg"
    
  
  
  
  >

  <button>
  
    Need to tell us more?
  
  </button>
</devsite-feedback>
    </template>
  
  
    <template class="devsite-content-data-template">
      [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-08-13 UTC."],[],[]]
    </template>
  
</div>
            
          </devsite-content>
        </main>
        <devsite-footer-promos class="devsite-footer">
          
            
          
        </devsite-footer-promos>
        <devsite-footer-linkboxes class="devsite-footer">
          
            
<nav class="devsite-footer-linkboxes nocontent"
     aria-label="Footer links"
     data-nosnippet>
  
  <ul class="devsite-footer-linkboxes-list">
    
    <li class="devsite-footer-linkbox ">
    <h3 class="devsite-footer-linkbox-heading no-link">Products and pricing</h3>
      <ul class="devsite-footer-linkbox-list">
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/products/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 1)"
            track-metadata-eventDetail="cloud.google.com/products/"track-type="footer link"track-name="see all products"track-metadata-module="footer"track-metadata-child_headline="products and pricing"track-metadata-position="footer">
            
          
            See all products
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/pricing/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 2)"
            track-metadata-child_headline="products and pricing"track-metadata-module="footer"track-metadata-position="footer"track-name="google cloud pricing"track-metadata-eventDetail="cloud.google.com/pricing/"track-type="footer link">
            
          
            Google Cloud pricing
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/marketplace/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 3)"
            track-name="google cloud marketplace"track-metadata-eventDetail="cloud.google.com/marketplace/"track-type="footer link"track-metadata-child_headline="resources"track-metadata-position="footer"track-metadata-module="footer">
            
          
            Google Cloud Marketplace
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/contact/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 4)"
            track-metadata-child_headline="engage"track-metadata-position="footer"track-name="contact sales"track-type="footer link"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/contact/">
            
              
              
            
          
            Contact sales
          
          </a>
          
          
        </li>
        
      </ul>
    </li>
    
    <li class="devsite-footer-linkbox ">
    <h3 class="devsite-footer-linkbox-heading no-link">Support</h3>
      <ul class="devsite-footer-linkbox-list">
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//discuss.google.dev/c/google-cloud/14/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 1)"
            track-type="footer link"track-metadata-child_headline="engage"target="_blank"track-name="google cloud community"track-metadata-module="footer"track-metadata-eventDetail="www.googlecloudcommunity.com"track-metadata-position="footer"rel="noopener">
            
          
            Community forums
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/support-hub/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 2)"
            track-metadata-child_headline="resources"track-metadata-eventDetail="cloud.google.com/support-hub/"track-metadata-position="footer"track-type="footer link"track-name="support"track-metadata-module="footer">
            
          
            Support
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//docs.cloud.google.com/release-notes"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 3)"
            track-type="footer link"track-metadata-child_headline="resources"track-name="release notes"track-metadata-position="footer"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/release-notes/">
            
          
            Release Notes
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//status.cloud.google.com"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 4)"
            track-metadata-position="footer"target="_blank"track-metadata-eventDetail="status.cloud.google.com"track-metadata-module="footer"track-name="system status"track-metadata-child_headline="resources"track-type="footer link">
            
              
              
            
          
            System status
          
          </a>
          
          
        </li>
        
      </ul>
    </li>
    
    <li class="devsite-footer-linkbox ">
    <h3 class="devsite-footer-linkbox-heading no-link">Resources</h3>
      <ul class="devsite-footer-linkbox-list">
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//github.com/googlecloudPlatform/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 1)"
            track-name="github"track-type="footer link"track-metadata-eventDetail="github.com/googlecloudPlatform/"track-metadata-position="footer"track-metadata-child_headline="resources"track-metadata-module="footer">
            
          
            GitHub
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="/docs/get-started/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 2)"
            track-metadata-eventDetail="cloud.google.com/docs/get-started/"track-metadata-module="footer"track-type="footer link"track-name="google cloud quickstarts"track-metadata-position="footer"track-metadata-child_headline="resources">
            
          
            Getting Started with Google Cloud
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="/docs/samples"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 3)"
            track-metadata-position="footer"track-name="code samples"track-type="footer link"track-metadata-eventDetail="cloud.google.com/docs/samples"track-metadata-module="footer"track-metadata-child_headline="resources">
            
          
            Code samples
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="/architecture/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 4)"
            track-metadata-eventDetail="cloud.google.com/architecture/"track-metadata-child_headline="resources"track-metadata-module="footer"track-metadata-position="footer"track-name="cloud architecture center"track-type="footer link">
            
          
            Cloud Architecture Center
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/learn/training/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 5)"
            track-metadata-module="footer"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/learn/training/"track-name="training"track-type="footer link"track-metadata-child_headline="resources">
            
              
              
            
          
            Training and Certification
          
          </a>
          
          
        </li>
        
      </ul>
    </li>
    
    <li class="devsite-footer-linkbox ">
    <h3 class="devsite-footer-linkbox-heading no-link">Engage</h3>
      <ul class="devsite-footer-linkbox-list">
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/blog/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 1)"
            track-type="footer link"track-metadata-position="footer"track-metadata-child_headline="engage"track-name="blog"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/blog/">
            
          
            Blog
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//cloud.google.com/events/"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 2)"
            track-name="events"track-type="footer link"track-metadata-eventDetail="cloud.google.com/events/"track-metadata-position="footer"track-metadata-child_headline="engage"track-metadata-module="footer">
            
          
            Events
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//x.com/googlecloud"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 3)"
            track-metadata-eventDetail="x.com/googlecloud"track-metadata-module="footer"rel="noopener"track-metadata-position="footer"target="_blank"track-type="footer link"track-name="follow on x"track-metadata-child_headline="engage">
            
          
            X (Twitter)
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//www.youtube.com/googlecloud"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 4)"
            rel="noopener"track-type="footer link"track-metadata-position="footer"track-name="google cloud on youtube"track-metadata-eventDetail="www.youtube.com/googlecloud"track-metadata-child_headline="engage"track-metadata-module="footer"target="_blank">
            
          
            Google Cloud on YouTube
          
          </a>
          
          
        </li>
        
        <li class="devsite-footer-linkbox-item">
          
          <a href="//www.youtube.com/googlecloudplatform"
             class="devsite-footer-linkbox-link gc-analytics-event"
             data-category="Site-Wide Custom Events"
            
             data-label="Footer Link (index 5)"
            track-metadata-module="footer"track-metadata-position="footer"track-metadata-eventDetail="www.youtube.com/googlecloudplatform"track-metadata-child_headline="engage"track-name="google cloud tech on youtube"track-type="footer link"rel="noopener"target="_blank">
            
              
              
            
          
            Google Cloud Tech on YouTube
          
          </a>
          
          
        </li>
        
      </ul>
    </li>
    
  </ul>
  
</nav>
          
        </devsite-footer-linkboxes>
        <devsite-footer-utility class="devsite-footer">
          
            

<div class="devsite-footer-utility nocontent" data-nosnippet>
  

  
  <nav class="devsite-footer-utility-links" aria-label="Utility links">
    
    <ul class="devsite-footer-utility-list">
      
      <li class="devsite-footer-utility-item
                 ">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//about.google/"
           data-category="Site-Wide Custom Events"
           data-label="Footer About Google link"
         
           track-type="footer link"
         
           track-name="about google"
         
           track-metadata-eventDetail="//about.google/"
         
           track-metadata-position="footer"
         
           target="_blank"
         
           track-metadata-module="utility footer"
         >
          About Google
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 devsite-footer-privacy-link">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//policies.google.com/privacy"
           data-category="Site-Wide Custom Events"
           data-label="Footer Privacy link"
         
           track-metadata-position="footer"
         
           track-metadata-module="utility footer"
         
           track-type="footer link"
         
           target="_blank"
         
           track-metadata-eventDetail="//policies.google.com/privacy"
         
           track-name="privacy"
         >
          Privacy
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 ">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//policies.google.com/terms?hl=en"
           data-category="Site-Wide Custom Events"
           data-label="Footer Site terms link"
         
           track-name="site terms"
         
           track-metadata-position="footer"
         
           target="_blank"
         
           track-type="footer link"
         
           track-metadata-eventDetail="//www.google.com/intl/en/policies/terms/regional.html"
         
           track-metadata-module="utility footer"
         >
          Site terms
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 ">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//cloud.google.com/product-terms"
           data-category="Site-Wide Custom Events"
           data-label="Footer Google Cloud terms link"
         
           track-metadata-eventDetail="//cloud.google.com/product-terms"
         
           track-name="google cloud terms"
         
           track-type="footer link"
         
           track-metadata-module="utility footer"
         
           track-metadata-position="footer"
         >
          Google Cloud terms
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 glue-cookie-notification-bar-control">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="#"
           data-category="Site-Wide Custom Events"
           data-label="Footer Manage cookies link"
         
           track-type="footer link"
         
           track-name="Manage cookies"
         
           track-metadata-module="utility footer"
         
           track-metadata-eventDetail="#"
         
           aria-hidden="true"
         
           track-metadata-position="footer"
         >
          Manage cookies
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 devsite-footer-carbon-button">
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//cloud.google.com/sustainability"
           data-category="Site-Wide Custom Events"
           data-label="Footer Our third decade of climate action: join us link"
         
           track-name="Our third decade of climate action: join us"
         
           track-type="footer link"
         
           track-metadata-module="utility footer"
         
           track-metadata-eventDetail="/sustainability/"
         
           track-metadata-position="footer"
         >
          Our third decade of climate action: join us
        </a>
        
      </li>
      
      <li class="devsite-footer-utility-item
                 devsite-footer-utility-button">
        
        <span class="devsite-footer-utility-description">Sign up for the Google Cloud newsletter</span>
        
        
        <a class="devsite-footer-utility-link gc-analytics-event"
           href="//cloud.google.com/newsletter/"
           data-category="Site-Wide Custom Events"
           data-label="Footer Subscribe link"
         
           track-metadata-eventDetail="/newsletter/"
         
           track-metadata-module="utility footer"
         
           track-metadata-position="footer"
         
           track-name="subscribe"
         
           track-type="footer link"
         >
          Subscribe
        </a>
        
      </li>
      
    </ul>
    
    
<devsite-language-selector>
  <ul role="presentation">
    
    
    <li role="presentation">
      <a role="menuitem" lang="en"
        >English</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="de"
        >Deutsch</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="es"
        >Español</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="es_419"
        >Español – América Latina</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="fr"
        >Français</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="id"
        >Indonesia</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="it"
        >Italiano</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="pt"
        >Português</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="pt_br"
        >Português – Brasil</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="he"
        >עברית</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="zh_cn"
        >中文 – 简体</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="zh_tw"
        >中文 – 繁體</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="ja"
        >日本語</a>
    </li>
    
    <li role="presentation">
      <a role="menuitem" lang="ko"
        >한국어</a>
    </li>
    
  </ul>
</devsite-language-selector>

  </nav>
</div>
          
        </devsite-footer-utility>
        <devsite-panel>
          
        </devsite-panel>
        
      </section>
      </section>
    <devsite-sitemask></devsite-sitemask>
    <devsite-snackbar></devsite-snackbar>
    <devsite-tooltip ></devsite-tooltip>
    <devsite-heading-link></devsite-heading-link>
    <devsite-analytics>
      
        <script type="application/json" analytics>[]</script>
<script type="application/json" tag-management>{&#34;at&#34;: &#34;True&#34;, &#34;ga4&#34;: [], &#34;ga4p&#34;: [], &#34;gtm&#34;: [{&#34;id&#34;: &#34;GTM-5CVQBG&#34;, &#34;purpose&#34;: 1}], &#34;parameters&#34;: {&#34;internalUser&#34;: &#34;False&#34;, &#34;language&#34;: {&#34;machineTranslated&#34;: &#34;False&#34;, &#34;requested&#34;: &#34;en&#34;, &#34;served&#34;: &#34;en&#34;}, &#34;pageType&#34;: &#34;article&#34;, &#34;projectName&#34;: &#34;Identity and Access Management (IAM)&#34;, &#34;signedIn&#34;: &#34;False&#34;, &#34;tenant&#34;: &#34;clouddocs&#34;, &#34;recommendations&#34;: {&#34;sourcePage&#34;: &#34;&#34;, &#34;sourceType&#34;: 0, &#34;sourceRank&#34;: 0, &#34;sourceIdenticalDescriptions&#34;: 0, &#34;sourceTitleWords&#34;: 0, &#34;sourceDescriptionWords&#34;: 0, &#34;experiment&#34;: &#34;&#34;}, &#34;experiment&#34;: {&#34;ids&#34;: &#34;&#34;}}}</script>
      
    </devsite-analytics>
    
      <devsite-badger></devsite-badger>
    
    
    
<cloudx-user></cloudx-user>




  
    <cloudx-free-trial-eligible-store freeTrialEligible="true"></cloudx-free-trial-eligible-store>
  

    
<script nonce="mUwC9OrtEKIzrKHdEjr+/o8KVU/434">
  
  (function(d,e,v,s,i,t,E){d['GoogleDevelopersObject']=i;
    t=e.createElement(v);t.async=1;t.src=s;E=e.getElementsByTagName(v)[0];
    E.parentNode.insertBefore(t,E);})(window, document, 'script',
    'https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/js/app_loader.js', '[39,"en",null,"/js/devsite_app_module.js","https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f","https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs","https://clouddocs-dot-devsite-v2-prod.appspot.com",null,null,["/_pwa/clouddocs/manifest.json","https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/images/video-placeholder.svg","https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/favicons/onecloud/favicon.ico","https://www.gstatic.com/devrel-devsite/prod/vfaab1c846319b03545a380628f94a5f2242cc1b4a1f651e46c0205139cef731f/clouddocs/images/lockup_full_color.svg","https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"],1,null,[1,6,8,12,14,17,21,25,50,52,63,70,75,76,80,87,91,92,93,97,98,100,101,102,103,104,105,107,108,109,110,112,113,116,117,118,120,122,124,125,126,127,129,130,131,132,133,134,135,136,138,140,141,147,148,149,151,152,156,157,158,159,161,163,164,168,169,170,179,180,182,183,186,191,193,196],"AIzaSyAP-jjEJBzmIyKR4F-3XITp8yM9T1gEEI8","AIzaSyB6xiKGDR5O3Ak2okS4rLkauxGUG7XP0hg","docs.cloud.google.com","AIzaSyAQk0fBONSGUqCNznf6Krs82Ap1-NV6J4o","AIzaSyCCxcqdrZ_7QMeLCRY20bh_SXdAYqy70KY",null,null,null,["MiscFeatureFlags__enable_explicit_template_dependencies","Profiles__enable_targeted_hero","Profiles__enable_developer_profiles_callout","DevPro__enable_free_benefits","Search__enable_ai_search_summaries_for_all","Profiles__enable_public_developer_profiles","CloudShell__cloud_code_overflow_menu","DevPro__remove_eu_tax_intake_form","MiscFeatureFlags__enable_variable_operator_index_yaml","Search__enable_suggestions_from_borg","Profiles__enable_purchase_prompts","DevPro__enable_developer_subscriptions","Cloud__fast_free_trial","Cloud__enable_cloud_shell","Profiles__enable_completequiz_endpoint","Search__enable_page_map","Profiles__enable_profile_collections","MiscFeatureFlags__fix_lower_breadcrumbs","Cloud__cache_serialized_dynamic_content","Search__enable_dynamic_content_confidential_banner","DevPro__enable_embed_profile_creation","TpcFeatures__proxy_prod_host","DevPro__enable_vertex_credit_card","DevPro__enable_code_assist","EngEduTelemetry__enable_engedu_telemetry","Profiles__enable_stripe_subscription_management","MiscFeatureFlags__enable_framebox_badge_methods","OnSwitch__enable","Profiles__enable_awarding_url","MiscFeatureFlags__enable_view_transitions","Concierge__enable_pushui","Analytics__enable_clearcut_logging","Profiles__require_profile_eligibility_for_signin","Profiles__enable_dashboard_curated_recommendations","DevPro__enable_enterprise","Cloud__enable_free_trial_server_call","Cloud__enable_cloud_shell_fte_user_flow","Profiles__enable_recognition_badges","SignIn__enable_l1_signup_flow","Profiles__enable_developer_profile_pages_as_content","DevPro__enable_google_one_card","MiscFeatureFlags__remove_cross_domain_tracking_params","Profiles__enable_complete_playlist_endpoint","Profiles__enable_page_saving","DevPro__enable_google_payments_buyflow","Cloud__enable_cloudx_experiment_ids","Concierge__enable_remove_info_panel_tags","Concierge__enable_devsite_llm_tools","AIStudioInteractionsToggle__interactions_are_default","DevPro__enable_payments_first_batch","DevPro__enable_cloud_innovators_plus","Cloud__enable_cloud_dlp_service","Concierge__enable_actions_menu","Experiments__reqs_query_experiments","Profiles__enable_completecodelab_endpoint","Profiles__enable_auto_apply_credits","DevPro__enable_nvidia_credits_card","CloudShell__cloud_shell_button","MiscFeatureFlags__enable_project_variables","MiscFeatureFlags__developers_footer_dark_image","DevPro__enable_g1_ineligible_redirect","DevPro__enable_devsite_captcha","MiscFeatureFlags__enable_dark_theme","Profiles__enable_user_type","Profiles__enable_developer_profile_benefits_ui_redesign","DevPro__enable_g1_integration","Cloud__enable_legacy_calculator_redirect","Profiles__enable_callout_notifications","Profiles__enable_playlist_community_acl","BookNav__enable_tenant_cache_key","Analytics__enable_devpro_interaction_logging","MiscFeatureFlags__enable_firebase_utm","MiscFeatureFlags__developers_footer_image","TpcFeatures__enable_unmirrored_page_left_nav","Profiles__enable_join_program_group_endpoint","MiscFeatureFlags__gdp_dashboard_reskin_enabled","MiscFeatureFlags__enable_variable_operator","DevPro__enable_firebase_workspaces_card","MiscFeatureFlags__enable_appearance_cookies","Search__enable_ai_eligibility_checks","DevPro__enable_credits_banner","MiscFeatureFlags__enable_explain_this_code","DevPro__enable_devpro_offers","Concierge__enable_concierge_restricted"],null,null,"AIzaSyBLEMok-5suZ67qRPzx0qUtbnLmyT_kCVE","https://developerscontentserving-pa.clients6.google.com","AIzaSyCM4QpTRSqP5qI4Dvjt4OAScIN8sOUlO-k","https://developerscontentsearch-pa.clients6.google.com",1,4,1,"https://developerprofiles-pa.clients6.google.com",[39,"clouddocs","Google Cloud Documentation","docs.cloud.google.com",null,"clouddocs-dot-devsite-v2-prod.appspot.com",null,null,[1,1,null,null,null,null,null,null,null,null,null,[1],null,null,null,null,null,1,[1],[null,null,null,[1,20],"/terms/recommendations"],[1],null,[1],[1,null,1],null,[1]],null,[54,null,null,null,null,null,"/images/lockup_full_color.svg","/images/favicons/onecloud/apple-icon.png",null,null,null,1,1,1,1,null,[],null,null,[[],[],[],[],[],[],[],[]],null,1,null,null,null,"/images/lockup_dark_theme.svg",[]],[],null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[6,1,14,15,22,23,29,37],null,[[null,null,null,null,null,null,[1,[["docType","Choose a content type",[["ApiReference",null,null,null,null,null,null,null,null,"API reference"],["Sample",null,null,null,null,null,null,null,null,"Code sample"],["ReferenceArchitecture",null,null,null,null,null,null,null,null,"Reference architecture"],["Tutorial",null,null,null,null,null,null,null,null,"Tutorial"]]],["category","Choose a topic",[["AiAndMachineLearning",null,null,null,null,null,null,null,null,"Artificial intelligence and machine learning (AI/ML)"],["ApplicationDevelopment",null,null,null,null,null,null,null,null,"Application development"],["BigDataAndAnalytics",null,null,null,null,null,null,null,null,"Big data and analytics"],["Compute",null,null,null,null,null,null,null,null,"Compute"],["Containers",null,null,null,null,null,null,null,null,"Containers"],["Databases",null,null,null,null,null,null,null,null,"Databases"],["HybridCloud",null,null,null,null,null,null,null,null,"Hybrid and multicloud"],["LoggingAndMonitoring",null,null,null,null,null,null,null,null,"Logging and monitoring"],["Migrations",null,null,null,null,null,null,null,null,"Migrations"],["Networking",null,null,null,null,null,null,null,null,"Networking"],["SecurityAndCompliance",null,null,null,null,null,null,null,null,"Security and compliance"],["Serverless",null,null,null,null,null,null,null,null,"Serverless"],["Storage",null,null,null,null,null,null,null,null,"Storage"]]]]]],[1],null,1],[[null,null,null,null,null,["GTM-5CVQBG"],null,null,null,null,null,[["GTM-5CVQBG",2]],1],null,null,null,null,null,1],"mwETRvWii0eU5NUYprb0Y9z5GVbc",4],null,"pk_live_5170syrHvgGVmSx9sBrnWtA5luvk9BwnVcvIi7HizpwauFG96WedXsuXh790rtij9AmGllqPtMLfhe2RSwD6Pn38V00uBCydV4m",1,1,"https://developerscontentinsights-pa.clients6.google.com","AIzaSyCg-ZUslalsEbXMfIo9ZP8qufZgo3LSBDU","AIzaSyDxT0vkxnY_KeINtA4LSePJO-4MAZPMRsE","https://developers.clients6.google.com",null,null,"AIzaSyBQom12tzI-rybN7Sf-KfeL4nwm-Rf7PmI\n",null,null,"https://developers.googleapis.com"]')
  
</script>

    <devsite-a11y-announce></devsite-a11y-announce>
  </body>
</html>