GCP Workload Identity — Request Scoping Tip

When you raise a request for a Workload Identity binding, which gives a pod its
own GCP identity, the narrower you make the request the faster it can be
approved.

Ask for the services you actually call

List the specific GCP services and resources the workload uses, rather than
asking for a broad or template-based grant. For example, "Secret Manager
access, plus read and write on one named GCS bucket" is far better than "the
usual GCP permissions" or a copy of another application's access.

A narrow request is quicker to review and approve, and it limits what is
exposed if the workload is ever compromised.

If you are not sure what your application calls

Check before you ask. Requesting broader access than you need is the most
common reason a Workload Identity request takes longer than expected. The GCP
client libraries your application uses are the quickest place to confirm which
APIs it actually touches.

Related articles

• GCP IAM and GCS Access
• Access Requests
• IAM Service Accounts