gcloud-help/gcloud/iam/workload-identity-pools/create-cred-config

NAME
    gcloud iam workload-identity-pools create-cred-config - create a
        configuration file for generated credentials

SYNOPSIS
    gcloud iam workload-identity-pools create-cred-config AUDIENCE
        --output-file=OUTPUT_FILE
        (--aws | --azure | --credential-source-file=CREDENTIAL_SOURCE_FILE
          | --credential-source-url=CREDENTIAL_SOURCE_URL)
        [--app-id-uri=APP_ID_URI]
        [--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME]
        [--credential-source-headers=[key=value,...]]
        [--credential-source-type=CREDENTIAL_SOURCE_TYPE]
        [--service-account=SERVICE_ACCOUNT]
        [--subject-token-type=SUBJECT_TOKEN_TYPE] [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    This command creates a configuration file to allow access to authenticated
    Google Cloud actions from a variety of external accounts.

EXAMPLES
    To create a file-sourced credential configuration for your project, run:

        $ gcloud iam workload-identity-pools create-cred-config \
            projects/$PROJECT_NUMBER/locations/$REGION/\
        workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
            --service-account=$EMAIL \
            --credential-source-file=$PATH_TO_OIDC_ID_TOKEN \
            --output-file=credentials.json

    To create a URL-sourced credential configuration for your project, run:

        $ gcloud iam workload-identity-pools create-cred-config \
            projects/$PROJECT_NUMBER/locations/$REGION/\
        workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
            --service-account=$EMAIL \
            --credential-source-url=$URL_FOR_OIDC_TOKEN \
            --credential-source-headers=Key=Value \
            --output-file=credentials.json

    To create an AWS-based credential configuration for your project, run:

        $ gcloud iam workload-identity-pools create-cred-config \
            projects/$PROJECT_NUMBER/locations/$REGION/\
        workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
            --service-account=$EMAIL --aws --output-file=credentials.json

    To create an Azure-based credential configuration for your project, run:

        $ gcloud iam workload-identity-pools create-cred-config \
            projects/$PROJECT_NUMBER/locations/$REGION/\
        workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
            --service-account=$EMAIL --azure \
            --app-id-uri=$URI_FOR_AZURE_APP_ID \
            --output-file=credentials.json

    To use the resulting file for any of these commands, set the
    GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the
    generated file

POSITIONAL ARGUMENTS
     AUDIENCE
        The workload identity pool provider resource name.

REQUIRED FLAGS
     --output-file=OUTPUT_FILE
        Location to store the generated credential configuration file.

     Credential types.

     Exactly one of these must be specified:

       --aws
          Use AWS.

       --azure
          Use Azure.

       --credential-source-file=CREDENTIAL_SOURCE_FILE
          Location of the credential source file.

       --credential-source-url=CREDENTIAL_SOURCE_URL
          URL to obtain the credential from.

OPTIONAL FLAGS
     --app-id-uri=APP_ID_URI
        The custom Application ID URI for the Azure access token.

     --credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME
        The subject token field name (key) in a JSON credential source.

     --credential-source-headers=[key=value,...]
        Headers to use when querying the credential-source-url.

     --credential-source-type=CREDENTIAL_SOURCE_TYPE
        The format of the credential source (JSON or text).

     --service-account=SERVICE_ACCOUNT
        The email of the service account to impersonate.

     --subject-token-type=SUBJECT_TOKEN_TYPE
        The type of token being used for authorization.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

NOTES
    These variants are also available:

        $ gcloud alpha iam workload-identity-pools create-cred-config

        $ gcloud beta iam workload-identity-pools create-cred-config