Workload Identity Federation support in the UI for GCP

[iJackWilson]

Feature search

• I have searched the existing issues and this feature has not been requested yet or is already in our Public Roadmap

Which component would this feature affect?

Prowler UI

Related to specific cloud provider?

GCP

New feature motivation

Self-hosted prowler deployed in GKE currently has no UI option to use Workload Identity Federation (WIF), only offering:

• Service account key
• Application default credentials

Both of which require long-lived credentials.

Solution Proposed

Add a third auth option for GCP providers to allow for configuration of Workload Identity Federation.

Use case and benefits

This removes the need for long-lived static credentials to access the GCP environments to perform scans, instead relying on OIDC and short-lived credentials.

Describe alternatives you've considered

Use either the two existing auth offerings, with the trade-offs being

• Long-lived static credentials
• Tedious to configure and manage static credentials across many GCP projects

Additional context

I also intend to open a related feature request around configuring GCP scanning at an org level (rather than a project level), something which appears to be supported in the CLI, but not the UI/self-hosted offering.

[iJackWilson]

Related issue for org-level scanning: #11552

[puchy22]

Hi @iJackWilson,

Thanks for the detailed write-up, the reasoning around avoiding long-lived static credentials is sound, and we agree it's a good direction in principle.

That said, adding Workload Identity Federation support to the GCP UI isn't on our roadmap at the moment, so it's not planned to be implemented for now. I'm going to leave this issue open so we can keep tracking the interest and revisit it later.

If our plans change, I'll follow up here to let you know.

Appreciate you raising it!