gcp-login

The gcp-login provider enables you to log in to Google Cloud using OpenID Connect or by providing static credentials. The provider will return a set of credentials that can be used to access Google Cloud resources or fetch secrets using the gcp-secrets provider.

Examples

Using outputs with Pulumi IaC

The Pulumi Google Cloud provider reads the project and OAuth access token from the environment:

values:
  gcp:
    login:
      fn::open::gcp-login:
        project: 123456789
        oidc:
          workloadPoolId: pulumi-esc
          providerId: pulumi-esc
          serviceAccount: pulumi-esc@foo-bar-123456.iam.gserviceaccount.com
  environmentVariables:
    # The Pulumi Google Cloud provider reads the project (as a numeric ID) and the access token
    GOOGLE_CLOUD_PROJECT: ${gcp.login.project}
    GOOGLE_OAUTH_ACCESS_TOKEN: ${gcp.login.accessToken}

Using outputs with the gcloud CLI

The gcloud CLI reads the project ID (a string identifier, not the numeric project number used by the Pulumi provider) and the access token from its own CLOUDSDK_* environment variables, which differ from the ones the Pulumi provider uses:

values:
  gcp:
    login:
      fn::open::gcp-login:
        project: 123456789
        oidc:
          workloadPoolId: pulumi-esc
          providerId: pulumi-esc
          serviceAccount: pulumi-esc@foo-bar-123456.iam.gserviceaccount.com
  environmentVariables:
    # CLOUDSDK_CORE_PROJECT takes the project ID string (e.g. "my-project-12345"), not the numeric project number used by GOOGLE_CLOUD_PROJECT above
    # See: https://cloud.google.com/sdk/docs/properties#setting_properties_using_environment_variables
    CLOUDSDK_CORE_PROJECT: my-project-12345
    CLOUDSDK_AUTH_ACCESS_TOKEN: ${gcp.login.accessToken}

Schema reference

Reference schemas last updated on 2026-07-11, synced automatically from the Pulumi Cloud ESC API.

Inputs

• accessToken object optional
  Options for access token login.
• ↳ accessToken string required
  The token used to authenticate with Google Cloud.
• ↳ serviceAccount string optional
  The service account to impersonate, if any.
• ↳ tokenLifetime string optional
  The lifetime of the temporary credentials when impersonating a service account.
• oidc object optional
  Options for OIDC login.
• ↳ providerId string required
  The ID of the identity provider associated with the workload pool.
• ↳ region string optional
  The region of the GCP project.
• ↳ serviceAccount string required
  The email address of the service account to use.
• ↳ subjectAttributes array[string] optional
  The attributes used to issue the oidc token subject.
• ↳ tokenLifetime string optional
  The lifetime of the temporary credentials.
• ↳ workloadPoolId string required
  The ID of the workload pool to use.
• project number required
  The GCP project number. This can be fetched using the gcloud CLI: gcloud projects describe [project ID] --format="get(projectNumber)"

Outputs

• accessToken string required
  The access token used to authenticate with Google Cloud.
• expiry string optional
  The access token’s expiry time.
• project number required
  The GCP project number.
• tokenType string required
  The type of the access token.

Configuring OIDC

To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and Google Cloud, see the OpenID Connect integration documentation.