Docs · Integrations

GCP integration

Workload Identity Federation — no long-lived credentials, no service account keys.

Keyless by design

DriftGuard connects to Google Cloud through Workload Identity Federation, so there are no service-account JSON keys to generate, rotate, or store. Drift detection needs only read access to compare your Terraform plan against live state — roles/viewer is sufficient.

1. Set up federation

Create a workload identity pool and bind DriftGuard's principal to a read-only role:

setup.sh

# Create a workload identity pool + provider (one time)
gcloud iam workload-identity-pools create driftguard \
  --location=global --display-name="DriftGuard"

# Grant DriftGuard's principal read-only viewer on the project
gcloud projects add-iam-policy-binding acme-prod \
  --role=roles/viewer \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUM/locations/global/workloadIdentityPools/driftguard/*"

2. Register in DriftGuard

Enter the project ID, provider resource name, and GCS state backend in the dashboard (Settings → GCP). The dashboard stores the binding; the repo config documents which project and state DriftGuard reads:

.github/driftguard.yml

# .github/driftguard.yml
integrations:
  gcp:
    project_id: acme-prod
    workload_identity_provider: projects/PROJECT_NUM/locations/global/workloadIdentityPools/driftguard/providers/github
    state_backend: gs://acme-tfstate/prod/default.tfstate

GCP access is optional — only live-state drift detection uses it. All other checks run from the plan alone. DriftGuard is in early access.