Identity Design Challenges in GCP

Most cloud providers tightly integrate access to their services with principals or entities defined within their identity management offerings. For GCP, this identity management solution is Cloud Identity. Access to cloud services is granted by assigning permissions to the principals managed by Cloud Identity. Therefore, to enable your users to access GCP services, they must be represented within GCP Cloud Identity.

One way to achieve this representation is by syncing enterprise Active Directory (AD) with GCP Cloud Identity. There may be concerns with this approach as replicating the whole AD forest into GCP may not be appropriate if only a small part of the organization is being onboarded to GCP.

One solution approach would be to extend your Windows AD into GCP Cloud to avoid syncing enterprise AD with Cloud Identity, while this approach would allow using Windows AD instances in the cloud to authenticate users, we cannot assign GCP service access permissions through windows AD. This will force you to create and manage service credentials to enable user access to GCP cloud services— a scenario one should avoid due to the associated management overhead and potential security risks.

GCP does offer an option called Workforce Identity Federation that enables organizations to use their existing Active Directory (AD) users to access GCP services without the need to directly sync enterprise AD with GCP Cloud Identity. However, this approach does require you to map AD users to principals in Cloud Identity and grant service access to those mapped principals. With this approach, you can leverage your current AD infrastructure for authentication, provided that the mapping between AD users and GCP principals is defined in GCP Cloud Identity. It's important to note that this mapping process must be done manually, as there are no automation options available.

While Workforce Identity Federation helps bypass the need for full AD synchronization, it requires careful management of user-to-principal mappings within Cloud Identity, essentially duplicating the user definitions in AD with the mapping definitions in Cloud Identity.

Essentially, it will be a toss-up between using the ‘AD Sync’ approach, which comes with mapping automation, and the ‘Workforce Identity Federation’ approach, which requires manual mapping. For both options, the location of the Windows AD is not an issue, as long as there is stable connectivity to it.