# iap (blogs) — RSS Amplifier Recent posts from the 1 feeds in the RSS Amplifier directory that cover iap. Page: Feed: --- ## [Authenticating to AWS by using a Google Cloud agent identity and AssumeRoleWithWebIdentity](https://jpassing.com/2026/08/17/authenticating-to-aws-by-using-a-google-cloud-agent-identity-and-assumerolewithwebidentity/) _2026-08-16 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ A long time ago, I wrote about how service accounts can authenticate to AWS by using AssumeRoleWithWebIdentity . To allow such federated authentication, we create an AWS role for Open ID Connect (OIDC) federation with Google as identity provider , and then tighten the role's trust policy so that it only allows role assumption if the incoming token meets certain requirements For example, to allow a… ## [Letting users delegate access from Gemini Enterprise to Agent Platform, redux](https://jpassing.com/2026/07/30/letting-users-delegate-access-from-gemini-enterprise-to-agent-platform-redux/) _2026-07-30 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Gemini Enterprise lets us register ADK agents and make them available in the Gemini Enterprise app. When registering an agent, we can configure authorization . Gemini Enterprise then prompts users to perform an OAuth 2.0 authorization flow and forwards the resulting access token to the agent. The ADK lets agents read the forwarded access token from context.session.state , but doesn’t have… ## [Authenticating to Azure using an agent identity's JWT-SVID](https://jpassing.com/2026/07/29/authenticating-to-azure-using-an-agent-identity-jwt-svid/) _2026-07-28 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ When deploying an agent to Agent Platform, we can choose to assign it an agent identity instead of a service account. When the agent requests an ID token from the metadata server, it then no longer receives a Google-issued ID token. Instead, it receives a JWT-SVID that looks similar to the following when decoded: { "alg": "RS256", "kid": "78ab40e4a0319f9ced58024f5bb66e6387d68066", "typ": "JWT" }.{… ## [Best practices for using Workforce Identity Federation](https://jpassing.com/2026/06/30/best-practices-for-using-workforce-identityif-ederation/) _2026-06-30 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ When federating Google Cloud with an identity provider like Entra, we need to decide whether to set up single sign-on using Cloud Identity/Workspace or whether to use Workforce Identity Federation. Which approach works best depends on a number of factors, but these factors aren’t always obvious. In a new set of articles published on the Google Cloud website, I’m trying to shed some light on… ## [AI Agent Authenticator, a new tool to simplify delegating access to Gemini Enterprise agents](https://jpassing.com/2026/03/30/aauth-a-new-tool-simplify-delegating-access-to-gemini-enterprise-agents/) _2026-03-29 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Gemini Enterprise lets us register custom ADK agents that run on Vertex AI Agent Engine. Once registered, users can find those agents in the Gemini Enterprise app and interact with them using chat. To do anything meaningful, most ADK agents need to interact with other APIs and services – MCP servers, Google Cloud APIs, custom applications deployed on Google Cloud or elsewhere. These APIs need… ## [Letting users delegate access from Gemini Enterprise to Agent Engine](https://jpassing.com/2026/01/27/letting-users-delegate-access-from-gemini-enterprise-to-agent-engine/) _2026-01-27 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Update : See here for an updated version of this post. Gemini Enterprise now supports registering custom ADK agents that run on Vertex AI Agent Engine. Once connected, Gemini Enterprise users can discover and interact with these agents via chat. As these ADK agents are chat-based, they generally fit the notion of an “assistant” or “interactive agent”: they operate in a… ## [The many types of tokens used by Google Cloud](https://jpassing.com/2025/09/04/the-many-types-of-tokens-used-by-google-cloud/) _2025-09-03 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Google Cloud uses token-based authentication to secure its APIs. But there’s more than one way to obtain a token, and there are well over a dozen different types of tokens. In a new set of articles on the Google Cloud website, I dive into the different types of tokens, their security properties, purposes, and ways to obtain them: Token overview describes how user authentication differs from… ## [Managing break-glass access to Google Cloud](https://jpassing.com/2025/08/12/managing-break-glass-access-to-google-cloud/) _2025-08-12 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Emergency access users tend to be highly privileged and as such, require robust protection through measures like multi-factor authentication or context-aware access. However, this protection also increases the risk of being unable to utilize them during an actual emergency. In a new article, Best practices for continuous access to Google Cloud , I outlined some strategies for balancing the need to… ## [Using JIT Groups to manage just-in-time, self-service access to Kubernetes resources](https://jpassing.com/2025/07/23/using-jit-groups-to-manage-just-in-time-self-service-access-to-kubernetes-resources/) _2025-07-23 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Although Kubernetes resources are best managed using infrastructure-as-code (IaC), it’s sometimes useful to be able to interact with the cluster directly – whether that’s for diagnostics or other purposes. However, as with any other access, it’s best to grant such access only when needed and to let it auto-expire when it’s no longer required. One option to manage… ## [Securing apps and resources on Google Cloud using context-aware access](https://jpassing.com/2025/07/22/securing-apps-and-resources-on-google-cloud-using-context-aware-access/) _2025-07-21 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Context-aware access is Google’s approach to zero trust. Using context-aware access, we can protect access to the Google Cloud Console, APIs, VMs, Workspace, and many other resources in a way that not only takes the user’s identity into account, but also other factors such as their location, browser, and device posture. However, context-aware access isn’t a singular service or… ## [Prime Noise-Cancelling Picks (Sponsored)](https://crawlproof.com/a/ETg83JVgSDWj) _2025-07-20 · **Sponsored**_ Browse Prime-eligible, 4-star-and-up noise-cancelling earbuds with fast shipping and deals ## [Using domain-wide delegation without service account keys, Java edition](https://jpassing.com/2025/03/26/using-domain-wide-delegation-without-service-account-keys-java-edition/) _2025-03-26 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Before we can call a Google API, we have to obtain an OAuth access token. As we learned before, there are different types of access tokens , and service account access tokens are a little different from user access tokens . The vast majority of Google Cloud APIs don’t discriminate between these two types of token and work with both. But beyond Google Cloud, there are still many Google APIs… ## [Given an OAuth Client ID, how to find the corresponding Google Cloud project](https://jpassing.com/2025/03/25/given-an-oauth-clientid-how-to-find-the-corresponding-google-cloud-project/) _2025-03-25 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Given an OAuth client ID such as 1234567890-9iuxy238472ny4qmfad0ppg77s61vabo14j0s.apps.googleusercontent.com , how can we find out which Google Cloud project the OAuth client belongs to? If we look closely at OAuth client IDs, we notice that they follow a common pattern: NUMBER-GIBBERISH.apps.googleusercontent.com This pattern isn’t a coincidence: NUMBER is the project number of the Google Cloud… ## [Using Workforce Identity Federation and Entra App roles to control access to Google Cloud](https://jpassing.com/2025/03/20/using-workforce-identity-federation-and-entra-approles-to-control-access-to-google-cloud/) _2025-03-20 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ Google Cloud IAM implements discretionary access control , meaning each resource - be it a folder, project, or VM - has an IAM policy. We can think of this policy as an access control list, outlining who can access the resource and what actions they’re permitted to take. This model is extremely flexible. But as we scale, management can become a challenge: As the number of resources, IAM… ## [JIT Groups, or what's next for the JIT Access project](https://jpassing.com/2024/09/06/jit-groups-or-whats-next-for-the-jit-access-project/) _2024-09-05 · Posts on Identity, access, and stuff - Johannes Passing's blog about IAM_ The primary focus of JIT Access has been privileged access management (PAM) – enabling users to request just-in-time privileged access to Google Cloud projects on a temporary basis. When I published the project in 2022, Google Cloud didn’t provide any such capabilities as part of the platform, so the project filled an important gap. With Privileged Access Manager in preview now, that…