1. Docs
  2. Secrets & Configuration
  3. Integrations
  4. Dynamic Login Credentials
  5. gcp-login

gcp-login

    The gcp-login provider enables you to log in to Google Cloud using OpenID Connect or by providing static credentials. The provider will return a set of credentials that can be used to access Google Cloud resources or fetch secrets using the gcp-secrets provider.

    Example

    Basic configuration

    values:
  gcp:
    login:
      fn::open::gcp-login:
        project: 123456789
        oidc:
          workloadPoolId: pulumi-esc
          providerId: pulumi-esc
          serviceAccount: pulumi-esc@foo-bar-123456.iam.gserviceaccount.com

    Using outputs with Pulumi IaC and gcloud CLI

    The gcp-login provider outputs credentials for use with both Pulumi’s Google Cloud provider and the gcloud CLI. This example shows how to configure both:

    values:
  gcp:
    login:
      fn::open::gcp-login:
        project: 123456789
        oidc:
          workloadPoolId: pulumi-esc
          providerId: pulumi-esc
          serviceAccount: pulumi-esc@foo-bar-123456.iam.gserviceaccount.com
  pulumiConfig:
    gcp:project: ${gcp.login.project}
  environmentVariables:
    # The Google Cloud SDK (used by Pulumi's GCP provider) requires the project to be set by number
    GOOGLE_CLOUD_PROJECT: ${gcp.login.project}
    # The gcloud CLI requires the project to be set by name, and via a different env var
    # See: https://cloud.google.com/sdk/docs/properties#setting_properties_using_environment_variables
    CLOUDSDK_CORE_PROJECT: my-project-name
    # Provide OAuth access tokens to both the Google Cloud SDK and gcloud CLI
    GOOGLE_OAUTH_ACCESS_TOKEN: ${gcp.login.accessToken}
    CLOUDSDK_AUTH_ACCESS_TOKEN: ${gcp.login.accessToken}

    Note that both GOOGLE_CLOUD_PROJECT (numeric project ID) and CLOUDSDK_CORE_PROJECT (project name) are set because the Google Cloud SDK and gcloud CLI have different requirements for project identification.

    This configuration enables:

    • Pulumi IaC: The pulumiConfig section sets the GCP project for Pulumi’s Google Cloud provider.
    • gcloud CLI: The environmentVariables section configures authentication for the gcloud command-line tool.

    Configuring OIDC

    To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and Google Cloud, see the OpenID Connect integration documentation.

    Inputs

    PropertyTypeDescription
    projectnumberThe numerical ID of the GCP project, aka project number. (e.g. 951040570662)
    accessTokenGCPLoginAccessToken[Optional] Options for access token login.
    oidcGCPLoginOIDC[Optional] Options for OIDC login.

    GCPLoginAccessToken

    PropertyTypeDescription
    accessTokenstringThe token used to authenticate with Google Cloud.
    serviceAccountstring[Optional] - The service account to impersonate, if any.
    tokenLifetimestring[Optional] - The lifetime of the temporary credentials when impersonating a service account.

    GCPLoginOIDC

    PropertyTypeDescription
    workloadPoolIdstringThe (short) ID of the workload pool to use.
    providerIdstringThe (short) ID of the identity provider associated with the workload pool.
    serviceAccountstringThe email address of the service account to use.
    regionstring[Optional] - The region of the GCP project.
    tokenLifetimestring[Optional] - The lifetime of the temporary credentials.
    subjectAttributesstring[][Optional] - Subject attributes to be included in the OIDC token. For more information see the OpenID subject customization documentation

    Outputs

    PropertyTypeDescription
    projectstringThe numerical ID of the GCP project, aka project number. (e.g. 951040570662)
    accessTokenstringThe access token used to authenticate with Google Cloud.
    tokenTypestringThe type of the access token.
    expirystring[Optional] - The access token’s expiry time.