Skip to content


To use Terrateam with GCP, authentication and authorization need to be configured for your GCP account. Setup only takes a few minutes.

OpenID Connect (OIDC)

What is OIDC

OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in GCP, without having to store any credentials as long-lived GitHub secrets.

A Terraform module is available to easily create all of the GCP resources that Terrateam requires.


    module "terraform_gcp_terrateam_setup" {
    source = ""
    github_org = "GITHUB_ORG"
    project_id = "PROJECT_ID"
    service_account_description = "Terrateam service account"
    workload_identity_pool_id = "terrateam-pool"
    workload_identity_provider = "terrateam-provider"
    service_account_name = "terrateam"
    service_account_role = "roles/editor"
    output "google_iam_workload_identity_pool_provider_github_provider_name" {
    value = module.terraform_gcp_terrateam_setup
  2. Apply changes

    terraform apply

Configure Terrateam for OIDC

Create the .terrateam/config.yml configuration file at the root of your Terraform repository.

- type: oidc
provider: gcp
service_account: ""
workload_identity_provider: "WORKLOAD_IDENTITY_PROVIDER"

Manual instructions

Follow the instructions below to manually configure GCP for Terrateam authentication and authorization.

Expand for step-by-step OIDC and static credentials instructions
  1. Create a Terrateam service account
    Terminal window
    gcloud iam service-accounts create terrateam \
    --description="Terrateam" \
    --display-name="Terrateam" \
  2. Create the workload identity pool
    Terminal window
    gcloud iam workload-identity-pools create "terrateam-pool" \
    --project="${PROJECT_ID}" \
    --location="global" \
    --display-name="Terrateam pool"
  3. Create the OIDC provider
    Terminal window
    gcloud iam workload-identity-pools providers create-oidc "terrateam-provider" \
    --project="${PROJECT_ID}" \
    --location="global" \
    --workload-identity-pool="terrateam-pool" \
    --display-name="Terrateam provider" \
    --attribute-mapping="google.subject=assertion.sub,,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
  4. Create IAM policy bindings
    Terminal window
    gcloud iam service-accounts add-iam-policy-binding "terrateam@${PROJECT_ID}" \
    --project="${PROJECT_ID}" \
    --role="roles/iam.workloadIdentityUser" \
    Terminal window
    gcloud projects add-iam-policy-binding ${PROJECT_ID} \
    --member="serviceAccount:terrateam@${PROJECT_ID}" \
  5. Configure Terrateam for OIDC

You are now able to use Terrateam for plan and apply operations against GCP resources.

We use cookies and similar technologies to provide certain features, enhance the user experience and deliver content that is relevant to your interests. Depending on their purpose, analysis and marketing cookies may be used in addition to technically necessary cookies. By clicking on "Agree and continue", you declare your consent to the use of the aforementioned cookies. Here you can make detailed settings or revoke your consent (in part if necessary) with effect for the future. For further information, please refer to our Privacy Policy .