Google Cloud

Enhanced Advanced

Configuring a Google Cloud integration in Posit Connect allows content to access Google Cloud APIs without a long-lived service account key. This integration uses workload identity federation to authenticate content using short-lived OpenID Connect (OIDC) tokens issued by Connect.

Component parts of the Google Cloud integration.
Component part Value
Provider registration A workload identity pool and OIDC provider that trust Connect, plus Identity and Access Management (IAM) bindings for the federated identity
Authentication types Workload Identity only
Configuration project_number, pool_id, provider_id, subject
Credential delivery Token exchange, via a credential configuration file the SDK reads
Content compatibility Interactive and rendered content; public access and share links supported

Provider registration

Performed by a Google Cloud administrator.

Prerequisites

  • A Google Cloud project, and the project number (not the project ID).
  • Permission to create workload identity pools and providers (the roles/iam.workloadIdentityPoolAdmin role).
  • Network connectivity from Google Cloud to Connect’s OIDC discovery endpoints.

Create a workload identity pool and provider

Create a workload identity pool, then add an OIDC provider that trusts Connect as an identity provider:

Terminal
# Set your Connect issuer URL. Use the value of IdentityProvider.Issuer if
# configured, otherwise use Server.Address (which includes a trailing slash).
export CONNECT_SERVER_ADDRESS="https://connect.example.org/"
export POOL_ID="posit-connect"
export PROVIDER_ID="posit-connect"

# Create the workload identity pool.
gcloud iam workload-identity-pools create "$POOL_ID" \
  --location="global" \
  --display-name="Posit Connect"

# Add an OIDC provider that trusts Connect.
gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" \
  --location="global" \
  --workload-identity-pool="$POOL_ID" \
  --issuer-uri="$CONNECT_SERVER_ADDRESS" \
  --attribute-mapping="google.subject=assertion.sub"
Important

The --issuer-uri value must exactly match the iss claim in Connect’s identity tokens. This is the value of IdentityProvider.Issuer if configured, otherwise Server.Address (which always includes a trailing slash).

Grant access to resources

Grant the federated identity (the connect subject) the IAM roles it needs. For example, to allow read access to a BigQuery dataset:

Terminal
export PROJECT_NUMBER="123456789012"

gcloud projects add-iam-policy-binding "my-project" \
  --role="roles/bigquery.dataViewer" \
  --member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/subject/connect"

Adjust the roles and resources according to your security requirements.

Transfer information to Connect administrator

The Google Cloud administrator shares the following information with the Connect administrator:

Field Description
project_number The numeric project identifier (not the project ID).
pool_id The workload identity pool ID.
provider_id The provider ID within the pool.
subject The subject claim used when granting access. Defaults to connect.

Authentication types

This integration only supports the Workload Identity authentication type. There is no Viewer or Service Account variant: all access is attributed to the federated connect identity, so every viewer of the content sees the same data.

Because no viewer identity is involved, this integration supports both interactive and rendered content, and both public access and share links.

Connect configuration

Performed by a Connect administrator.

Create the integration in Connect

Using the information from the Google Cloud administrator, the Posit Connect administrator creates an integration through the dashboard’s System > Integrations settings. Once the integration has been created in Connect, it is available for use by all publishers. See Access control lists for information on customizing access to specific users or groups.

Alternatively, the example below shows how to create a Google Cloud integration using curl and the Connect Server API.

Replace connect.example.org with the address of the Connect server.

Terminal
curl -H "Authorization: Key ${CONNECT_API_KEY}" \
  -XPOST https://connect.example.org/__api__/v1/oauth/integrations \
  --data '{
    "template": "google-cloud",
    "name": "Google Cloud",
    "description": "Access Google Cloud APIs using workload identity.",
    "config": {
      "project_number": "123456789012",
      "pool_id": "posit-connect",
      "provider_id": "posit-connect",
      "subject": "connect"
    }
  }'
# 200 OK
# {"guid": "<oauth-integration-guid>", ... }

Credential delivery

Content does not call the credential exchange endpoint itself. Instead, Connect writes a Google Cloud credential configuration file that points at a token file, sets GOOGLE_APPLICATION_CREDENTIALS to that configuration file, and keeps the token file refreshed for the life of the content process. Google Cloud client libraries discover GOOGLE_APPLICATION_CREDENTIALS automatically and exchange the token for Google credentials on their own.

Connect also sets CONNECT_GCP_INTEGRATION_GUID and CONNECT_GCP_AUDIENCE in the content environment. The session supervisor uses these to obtain and refresh the identity token.

Publisher usage

Once the integration is configured, publishers can use it in their content. The credentials are picked up automatically by Google Cloud client libraries, including:

No code changes should be required to authenticate correctly.