# Identity and access management Type of document: How-to guide Product: NGINXaaS for Google Cloud --- F5 NGINXaaS for Google Cloud (NGINXaaS) uses Workload Identity Federation (WIF) to integrate with Google Cloud services. For example, with WIF configured, your NGINXaaS deployment can perform the following integrations: - export logs to Cloud Logging - export metrics to Cloud Monitoring - fetch secrets from Secret Manager To learn more, see [Google's Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation). ## Prerequisites - In the project you're configuring WIF in, you need the following roles to create a workload identity pool, provider, and policy bindings: - [iam.workloadIdentityPoolAdmin](https://cloud.google.com/iam/docs/roles-permissions/iam#iam.workloadIdentityPoolAdmin) - [resourcemanager.projectIamAdmin](https://cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) - An NGINXaaS deployment. See [our documentation on creating an NGINXaaS deployment](/nginxaas/google/deploy/create-deployment/) for a step-by-step guide. ## Configure WIF ### Create a Workload Identity Pool and Provider 1. Create a workload identity pool. See [Google's documentation on configuring Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#create-pool-provider) for a step-by-step guide. 1. Create an OIDC workload identity pool provider. See [Google's documentation on creating a workload identity pool provider](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#create-pool-provider) for a step-by-step guide. Set up the provider settings as follows: - `Issuer URL` must be `https://accounts.google.com`. - `Allowed audiences` must contain the full canonical resource name of the workload identity pool provider, for example, `https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/`. If `Allowed audiences` is empty, the full canonical resource name of the workload identity pool provider will be included by default. - Add the following **attribute mapping**: `google.subject=assertion.sub`. - Add the following **attribute condition**: `assertion.sub=='$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID'`, where `$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID` is the unique ID of your NGINXaaS deployment's service account. This ID can be found in the `F5 NGINXaaS Service Account Unique ID` field under the **Cloud Info** section in the **Details** tab of your deployment. ### Grant access to the WIF principal with your desired roles Depending on your use case, you will need to grant certain roles on specific resources. See [Google's documentation on granting access](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#access) for more information. #### Grant access to export logs to a Google project To grant access to export logs to a Google project, `$LOG_PROJECT_ID`, in the [Google Cloud Console](https://console.cloud.google.com/), 1. Go to the `$LOG_PROJECT_ID` project. 1. Go to the **IAM** page. 1. Select **Grant Access**. 1. Enter your principal, for example, `principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID`. 1. Assign the **Logs Writer** role. Alternatively, to use the Google Cloud CLI, you can run the following `gcloud` command: ```bash gcloud projects add-iam-policy-binding "$LOG_PROJECT_ID" \ --member="principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID" \ --role='roles/logging.logWriter' ``` #### Grant access to export metrics to a Google project To grant access to export metrics to a Google project, `$METRIC_PROJECT_ID` in the [Google Cloud Console](https://console.cloud.google.com/), perform the following steps. 1. Go to the `$METRIC_PROJECT_ID` project. 1. Go to the **IAM** page. 1. Select **Grant Access**. 1. Enter your principal, for example, `principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID`. 1. Assign the **Monitoring Metric Writer** role. Alternatively, to use the Google Cloud CLI, you can run the following `gcloud` command: ```bash gcloud projects add-iam-policy-binding "$METRIC_PROJECT_ID" \ --member="principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID" \ --role='roles/monitoring.metricWriter' ``` #### Grant access to fetch a secret from Secret Manager To grant access to fetch a secret, `$SECRET_ID`, in the [Google Cloud Console](https://console.cloud.google.com/), 1. Go to the secret, `$SECRET_ID`, in Secret Manager. 1. Select the **Permissions** tab. 1. Select **Grant Access**. 1. Enter your principal, for example, `principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID`. 1. Assign the **Secret Manager Secret Accessor** role. Alternatively, to use the Google Cloud CLI, you can run the following `gcloud` command: ```bash gcloud secrets add-iam-policy-binding "$SECRET_ID" \ --member="principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID" \ --role='roles/secretmanager.secretAccessor' ``` If you would like to fetch more than one secret, you will need to grant access on each secret or grant access on the project your secrets are in. ### Update your NGINXaaS deployment with the name of your workload identity pool provider In the NGINXaaS Console, 1. On the navigation menu, select **Deployments**. 1. Select the deployment you want to update and select **Edit**. 1. Enter your provider name, for example, `projects//locations//workloadIdentityPools//providers/`, under **Workload Identity Pool Provider Name**. 1. Select **Update**. ## What's next - [Monitor your deployment](/nginxaas/google/monitoring/enable-monitoring.md) - [Enable NGINX Logs](/nginxaas/google/monitoring/enable-nginx-logs.md)