AWS-GCP Workload Identity Federation Auth

Minimal Python library for exchanging AWS EKS credentials for GCP credentials using Workload Identity Federation.

Installation

pip install aws-gcp-wif-auth

Usage

Auto-detect Environment (Recommended)

from aws_gcp_wif_auth import get_credentials

# Automatically uses WIF in EKS, ADC locally
credentials = get_credentials(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com"
)

Explicit WIF

from aws_gcp_wif_auth import get_wif_credentials

credentials = get_wif_credentials(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com",
    aws_region="us-east-1"
)

Local Development (ADC)

from aws_gcp_wif_auth import get_adc_credentials

# Uses: gcloud auth application-default login
credentials = get_adc_credentials()

Authenticated Session

from aws_gcp_wif_auth import get_authed_session

# Get session with auto-refreshing credentials
session = get_authed_session(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com"
)

# Make API requests
response = session.get("https://storage.googleapis.com/storage/v1/b")

Environment Detection

from aws_gcp_wif_auth import is_eks_environment

if is_eks_environment():
    print("Running in EKS")
else:
    print("Running locally")

Use with Google Cloud Libraries

from google.cloud import storage
from aws_gcp_wif_auth import get_credentials

credentials = get_credentials(
    project_number="123456789",
    pool_id="my-pool",
    provider_id="my-provider",
    service_account_email="sa@project.iam.gserviceaccount.com"
)

client = storage.Client(credentials=credentials)
buckets = list(client.list_buckets())

API Reference

get_credentials()

Auto-detect environment and return appropriate credentials.

Parameters:

• project_number: GCP project number (required for WIF)
• pool_id: Workload Identity Pool ID (required for WIF)
• provider_id: Workload Identity Provider ID (required for WIF)
• service_account_email: GCP service account email (required for WIF)
• aws_region: AWS region (default: "us-east-1")
• scopes: OAuth scopes list (default: cloud-platform)
• use_adc: Force ADC instead of auto-detection (default: False)

get_wif_credentials()

Explicitly use Workload Identity Federation.

get_adc_credentials()

Explicitly use Application Default Credentials.

get_authed_session()

Get authenticated session with auto-refreshing credentials.

is_eks_environment()

Check if running in EKS environment.

Requirements

• Python 3.8+
• Running in AWS EKS with IAM role for service account (for WIF)
• GCP Workload Identity Pool configured for AWS (for WIF)
• gcloud auth application-default login (for local ADC)

License

MIT