Overview of Azure App Service to Vertex AI Keyless Authentication
Workload Identity Federation (WIF) allows Azure workloads (App Service, VM, Container App) to authenticate with Google Cloud Platform (GCP) without long-lived service account keys. The authentication flow is:
- Azure App Service Managed Identity issues a short-lived Azure AD JWT.
- The JWT is exchanged at the GCP Security Token Service (STS) for a federated token.
- The federated token is used to impersonate a GCP Service Account.
- The service account token is used to call Vertex AI model endpoints.