Authenticating to AWS by using a Google Cloud agent identity and AssumeRoleWithWebIdentity

A long time ago, I wrote about how service accounts can authenticate to AWS by using AssumeRoleWithWebIdentity . To allow such federated authentication, we create an AWS role for Open ID Connect (OIDC) federation with Google as identity provider , and then tighten the role's trust policy so that it only allows role assumption if the incoming token meets certain requirements For example, to allow a…