Professional Cloud Security EngineerConfiguring access within a cloud solution environmentMedium
A large enterprise has recently acquired a smaller company. The acquired company's developers need to access specific Google Cloud projects within the acquiring enterprise's organization. The acquired company uses its own Okta identity provider for user authentication. The security team wants to enable these developers to use their existing Okta credentials to access Google Cloud resources without migrating their identities to Google Cloud Identity. Which Google Cloud service should be configured?
- AIdentity Platform
- BGoogle Cloud Directory Sync (GCDS)
- CCloud Identity-Aware Proxy (IAP)
- DWorkforce Identity Federation
Show answer & explanationAnswer & explanation
Correct answer: D. Workforce Identity Federation
Workforce Identity Federation is designed to allow employees and partners from an external identity provider (like Okta) to access Google Cloud resources. It enables federated access without needing to sync or migrate user identities to Google Cloud Identity, making it ideal for scenarios involving mergers, acquisitions, or external contractors.
Why the other options are wrong
- A. Identity Platform is for customer-facing identity management, not for federating enterprise (workforce) identities.
- B. GCDS synchronizes on-premises directories to Google Cloud Identity, which is not the requirement here (they want to use existing Okta identities without migration).
- C. IAP provides secure access to applications running on Google Cloud, not for federating external identity providers for general Google Cloud resource access.
Workforce Identity Federation
A Google Cloud service that allows employees (workforce users) from external identity providers (like Okta, Azure AD) to authenticate and access Google Cloud resources without syncing identities to Google Cloud Identity.
- Supports various external IdPs (SAML 2.0, OIDC).
- Enables access to Google Cloud projects and resources.
- Ideal for multi-cloud, multi-IdP, or M&A scenarios.
Memory trick: Workforce Federation is the 'bridge' for your 'external team' to 'GCP'.