entials JSON to clients instead (not recommended).A GCP project is required and the connector may only be used to access GCP resources in the specified roject. This project must be the same as the one for which the external account was configured.

If you already have the GOOGLE_APPLICATION_CREDENTIALS environment variable configured to point to an external account key JSON file, it will be automatically picked up when auto-configuration is used.

The following assumes the following prerequisites are met, as covered in the GCP documentation on how to configure workload identity federation with AWS:

the ZenML server is deployed in AWS in an EKS cluster (or any other AWS compute environment)

the ZenML server EKS pods are associated with an AWS IAM role by means of an IAM OIDC provider, as covered in the AWS documentation on how to associate a IAM role with a service account. Alternatively, the IAM role associated with the EKS/EC2 nodes can be used instead. This AWS IAM role provides the implicit AWS IAM identity and credentials that will be used to authenticate to GCP services.

a GCP workload identity pool and AWS provider are configured for the GCP project where the target resources are located, as covered in the GCP documentation on how to configure workload identity federation with AWS.

a GCP service account is configured with permissions to access the target resources and granted the roles/iam.workloadIdentityUser role for the workload identity pool and AWS provider

a GCP external account JSON file is generated for the GCP service account. This is used to configure the GCP connector.

zenml service-connector register gcp-workload-identity --type gcp \

--auth-method external-account --project_id=zenml-core \

--external_account_json=@clientLibraryConfig-aws-zenml.json

Example Command Output

Successfully registered service connector `gcp-workload-identity` with access to the following resources:

┏━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓