Authenticate from GCP Cloud Functions to Azure

Question

Hello,

I would like to understand the available options for authenticating from a Google Cloud Platform (GCP) Cloud Function to Azure services. However, there are a couple of important constraints to keep in mind:

I am not allowed to assign private keys to GCP service accounts.

I am not allowed to create applications in Azure App Registrations.

Given these guardrails, what are the recommended approaches or best practices to securely authenticate and access Azure resources from a GCP Cloud Function?

Any guidance or examples would be greatly appreciated.

Thank you!

Answer 1

Hello @Zorghost
I Understand that you would like to understand the available options for securely authenticating and accessing Azure services from a Google Cloud Platform (GCP) Cloud Function. However, there are two key constraints to consider: assigning private keys to GCP service accounts is not permitted, and creating applications in Azure App Registrations is not allowed.

To authenticate from a Google Cloud Platform (GCP) Cloud Function to Azure services—without using private keys for GCP service accounts or creating applications in Azure App Registrations—you can utilize managed identities and workload identity federation. Managed identities for Azure resources enable authentication with services that support Microsoft Entra ID. For a list of supported Azure services, see services that support managed identities for Azure resources. These identities can be used directly or configured as a federated identity credential within a Microsoft Entra ID application.

The steps involved in using managed identities are as follows:

1. Create a managed identity in Azure. You can choose between system-assigned managed identity or user-assigned managed identity. When using a user-assigned managed identity, you assign the managed identity to the source Azure Resource, such as a Virtual Machine, Azure Logic App or an Azure Web App.
2. Authorize the managed identity to have access to the target service.
3. Use the managed identity to access a resource. In this step, you can use any of the client libraries. Some source resources offer connectors that know how to use Managed identities for the connections. In that case, you use the identity as a feature of that source resource.

Workload Identity Federation enables using a managed identity as a credential, just like certificate or password, on Entra ID Applications. Whenever an Entra ID app is required, this is the recommended way to be credential-free. There's a limit of 20 FICs when using managed identities as FIC on an Entra ID App.

A workload acting in the capacity of Entra ID application can be hosted on any Azure compute which has a managed identity. The workload uses the managed identity to acquire a token to be exchanged for an Entra ID Application token, via workload identity federation. This feature is also referred to as managed identity as FIC (Federated Identity Credentials). For more information, see configure an application to trust a managed identity.

Google Cloud. First, configure a trust relationship between your user-assigned managed identity or app in Microsoft Entra ID and an identity in Google Cloud. Then configure your software workload running in Google Cloud to get an access token from Microsoft identity provider and access Microsoft Entra protected resources. See Access Microsoft Entra protected resources from an app in Google Cloud.

For Additional information Refer these documents: https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview

Do Let us know if you have any Queries. We are happy to assist you further.