gcloud: Wed Apr 27 09:13:09 UTC 2022

gcloud/beta/iam/service-accounts/sign-jwt

@@ -44,8 +44,10 @@ SEE ALSO
     https://cloud.google.com/appengine/docs/java/appidentity/.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud iam service-accounts sign-jwt
 
         $ gcloud alpha iam service-accounts sign-jwt
 

gcloud/beta/iam/workload-identity-pools/create-cred-config

@@ -10,7 +10,7 @@ SYNOPSIS
         [--app-id-uri=APP_ID_URI]
         [--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME]
         [--credential-source-headers=[key=value,...]]
-        [--credential-source-type=CREDENTIAL_SOURCE_TYPE]
+        [--credential-source-type=CREDENTIAL_SOURCE_TYPE] [--enable-imdsv2]
         [--service-account=SERVICE_ACCOUNT]
         [--subject-token-type=SUBJECT_TOKEN_TYPE] [GCLOUD_WIDE_FLAG ...]
 
@@ -43,7 +43,8 @@ EXAMPLES
         $ gcloud beta iam workload-identity-pools create-cred-config \
             projects/$PROJECT_NUMBER/locations/$REGION/\
         workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
-            --service-account=$EMAIL --aws --output-file=credentials.json
+            --service-account=$EMAIL --aws --enable-imdsv2 \
+            --output-file=credentials.json
 
     To create an Azure-based credential configuration for your project, run:
 
@@ -95,6 +96,10 @@ OPTIONAL FLAGS
      --credential-source-type=CREDENTIAL_SOURCE_TYPE
         The format of the credential source (JSON or text).
 
+     --enable-imdsv2
+        Adds the AWS IMDSv2 session token Url to the credential source to
+        enforce the AWS IMDSv2 flow.
+
      --service-account=SERVICE_ACCOUNT
         The email of the service account to impersonate.