Skip to content
All guidesGetting started

Connect Google Cloud using WIF — Keyless

Workload Identity Federation: Cybermatic authenticates to Google Cloud with no service account key ever existing.

  1. 1Connecting Cybermatic.ai to Google Cloud using Workload Identity Federation — Keyless.
  2. 2Step 1 — Select the correct project. 1. Open the Google Cloud Console. 2. Click the project selector at the top. 3. Select the project you want to connect to Cybermatic. 4. Confirm that the correct project name appears at the top.
  3. 3Step 2 — Confirm "Allowed external Identity Providers for workloads in Cloud IAM" is configured correctly. 1. Go to: Navigation menu → IAM & Admin → Organization Policies. 2. In the Name column, find "Allowed external Identity Providers for workloads in Cloud IAM". This corresponds to iam.workloadIdentityPoolProviders in the ID column. It may also be shown under iam.managed.workloadIdentityPoolProviders. 3. Click "Allowed external Identity Providers for workloads in Cloud IAM". 4. Click Manage policy. 5. Click Enforced. 6. Click Edit in the allowedProviders row. 7. Under Value, enter: https://sts.amazonaws.com 8. Click Save. The parameters should show as: allowedProviders → https://sts.amazonaws.com (User-defined) defaultAwsProvider → https://sts.amazonaws.com (Default) defaultXmlServiceProvider → KEY_UPLOAD (Default) 9. Click Done. 10. Click Set policy.
  4. 4Step 3 — Create the Cybermatic service account. 1. Open the navigation menu in the upper-left corner. 2. Go to: IAM & Admin → Service Accounts. 3. Confirm that the correct project is selected. 4. Click Create service account. 5. Enter the following: Service account name: cybermatic-scanner Service account ID: Google should automatically create: cybermatic-scanner The resulting email address will resemble: cybermatic-scanner@YOUR_PROJECT_ID.iam.gserviceaccount.com Service account description: Read-only service account used by Cybermatic to scan Google Cloud resources and security configurations. 6. Click Create and continue. Google generates the service-account ID from the name. The ID cannot be changed after the service account is created.
  5. 5Step 4 — Grant the Viewer role. You should now see the section named: Grant this service account access to project. 1. Click the Select a role field. 2. Search for: Viewer 3. Select: Viewer 4. Verify that you selected Viewer, not: • Editor • Owner • Service Account User 5. Click Continue. 6. Leave the optional service-account user and administrator fields blank. 7. Click Done. The legacy Viewer role provides project-wide read-only access and generally allows viewing — but not modifying — existing Google Cloud resources.
  6. 6Step 5 — Enable the required Google Cloud APIs. Go to: Navigation menu → APIs & Services → Library. Make sure you are still working in the correct project. Google's normal process is to search for an API, open its page, and click Enable. If the page shows Manage, the API is already enabled. 1. Enable Identity and Access Management (IAM) API — search for it, open it, click Enable. 2. Enable IAM Service Account Credentials API — return to the Library, search, open, click Enable. 3. Enable Security Token Service API — return to the Library, search, open, click Enable. 4. Enable Cloud Resource Manager API — return to the Library, search, open, click Enable. Verify the APIs: 1. Go to: APIs & Services → Enabled APIs & services. 2. Search for each of these: Identity and Access Management (IAM) API IAM Service Account Credentials API Security Token Service API Cloud Resource Manager API All four should appear in the enabled API list.
  7. 7Step 6 — Create the Workload Identity Pool. 1. Open the navigation menu. 2. Go to: IAM & Admin → Workload Identity Federation. Depending on the state of the project, the button may say: Create pool Get started Create workload identity pool 3. Select Create pool. 4. Enter: Name: Cybermatic Pool Pool ID: cybermatic-pool Description: Allows Cybermatic's AWS workload to authenticate without a service account key If Google automatically generates the Pool ID from the name, select Edit and make sure the ID is exactly (this step is important): cybermatic-pool Pool IDs cannot be changed after creation. 5. Make sure the pool is Enabled. 6. Select Continue.
  8. 8Step 7 — Add the AWS provider. Under Add a provider to the pool, enter the following. 1. Provider type — select: AWS 2. Provider details — enter: Provider name: Cybermatic AWS Provider ID: cybermatic-aws AWS account ID: 530374616608 Make sure the provider ID is exactly: cybermatic-aws Provider IDs cannot be changed after creation. The AWS provider is configured with the 12-digit AWS account ID that Google should trust. 3. Select Continue.
  9. 9Step 8 — Configure the provider attribute mappings. This is the step that makes the attribute.aws_account IAM binding work. On the Configure provider attributes screen, select: Edit mapping. Remove or replace the mappings as necessary so that the following two mappings exist. Mapping 1 — Google attribute: google.subject AWS attribute: assertion.arn Mapping 2 — Google attribute: attribute.aws_account AWS attribute: assertion.account The completed mapping should logically be: google.subject = assertion.arn attribute.aws_account = assertion.account Select Save or Create. You should now have: Pool: cybermatic-pool Provider: cybermatic-aws Type: AWS Account: 530374616608 Status: Enabled
  10. 10Step 9 — Grant the pool permission to impersonate the service account. 1. Return to: IAM & Admin → Workload Identity Federation. 2. Select the pool: cybermatic-pool 3. Select Grant access. 4. Choose: Grant access using Service Account impersonation. 5. Under Service accounts, select: cybermatic-scanner@YOUR_PROJECT_ID.iam.gserviceaccount.com 6. For Attribute name, select: aws_account It may display as: attribute.aws_account 7. For Attribute value, enter: 530374616608 8. Select Save. 9. Select Dismiss.
  11. 11Step 10 — Collect the five Cybermatic connection values. Replace with your actual information: Project ID → YOUR_PROJECT_ID Project number → YOUR_NUMERIC_PROJECT_NUMBER Workload identity pool ID → cybermatic-pool Provider ID → cybermatic-aws Service account email → cybermatic-scanner@YOUR_PROJECT_ID.iam.gserviceaccount.com Example: Project ID: my-company-prod Project number: 123456789012 Workload identity pool ID: cybermatic-pool Provider ID: cybermatic-aws Service account email: cybermatic-scanner@my-company-prod.iam.gserviceaccount.com Do not enter the pool display name Cybermatic Pool when Cybermatic asks for the pool ID. Enter: cybermatic-pool Do not enter the provider display name Cybermatic AWS. Enter: cybermatic-aws
  12. 12Step 11 — Connect Google Cloud in Cybermatic. 1. Sign in to Cybermatic. 2. Open Connections. 3. Under Connect a cloud or SaaS account. 4. Choose: Google Cloud. 5. Keep the authentication method set to: Keyless — recommended. 6. Enter: Project ID Project number Workload identity pool ID Provider ID Service account email 7. Select Connect. The first scan starts immediately.

Tip: The Step 9 impersonation grant is the entire trust relationship — removing it instantly and completely revokes Cybermatic's access, a cleaner kill-switch than any key rotation.

More in Getting started