Cloud Deployment — GCP & Azure

~11 min · gcp, azure, oidc

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Same OIDC pattern, different IAM names

GCP — Workload Identity Federation

Create a Workload Identity Pool.
Add an OIDC provider for GitHub: issuer https://token.actions.githubusercontent.com.
Create a Service Account; grant it the deploy permissions.
Bind the SA to the pool with attribute condition matching your repo.
In CI: google-github-actions/auth action.

Azure — Federated credential on a Service Principal

Create an App Registration / Service Principal.
Under Federated credentials, add an entry for GitHub Actions with subject repo:my-org/my-repo:ref:refs/heads/main.
Grant the SP role assignments (Contributor, AcrPush, etc.).
In CI: azure/login with client-id, tenant-id, subscription-id.

Deploy targets

GCP: Cloud Run, GKE, App Engine, Cloud Functions, Cloud Storage.
Azure: App Service, AKS, Container Apps, Functions, Static Web Apps.

Code

GCP Cloud Run deploy·yaml

  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/gha/providers/gha
          service_account: deploy@my-project.iam.gserviceaccount.com
      - uses: google-github-actions/setup-gcloud@v2
      - run: |
          gcloud run deploy my-service \
            --image gcr.io/my-project/my-service:${{ github.sha }} \
            --region us-central1 --platform managed

Azure Web App deploy·yaml

  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/webapps-deploy@v3
        with:
          app-name: my-app
          package: ./dist

External links

Exercise

Whichever cloud you're on, set up OIDC end-to-end with one minimal deploy job. The first attempt always fails (the trust policy is the hard part) — read the auth-action error message carefully.