Google Cloud → AWS and Azure
AWS and Azure equivalents of Workload Identity Federation
The closest AWS equivalents of Google Cloud Workload Identity Federation are IAM Roles Anywhere and AWS Identity and Access Management (IAM); on Azure, Microsoft Entra workload identity federation.
About Workload Identity Federation
| Provider | Google Cloud |
|---|---|
| Status | Generally available |
| What it is | Lets workloads on AWS, Azure, or OIDC/SAML identity providers access Google Cloud without service account keys. |
| Documentation | docs.cloud.google.com |
| Pricing | No separate pricing page |
Mappings (1)
| Capability | AWS | Match (GCP vs AWS) | Azure |
|---|---|---|---|
| Federation for workloads outside the cloud | IAM Roles Anywhere, AWS Identity and Access Management (IAM) | Direct match | Microsoft Entra workload identity federation |
Federation for workloads outside the cloud Direct match
IAM Roles Anywhere maps to Workload Identity Federation, which lets workloads on AWS, Azure, or any OIDC or SAML 2.0 identity provider access Google Cloud without service account keys.
- Workload Identity Federation also accepts X.509 client certificates, similar to Roles Anywhere.
- Federated identities get short-lived tokens; no long-lived keys are stored.