You can configure your Google Cloud Platform account to send data to the InfoSum Platform using the GCS ICC Connector.

This page provides an overview of the identity federation setup for external workloads. Using identity federation, you can grant on-premises or multi-cloud workloads access to Google Cloud resources without using a service account key.

You can use identity federation with Amazon Web Services (AWS), or with any identity provider (IdP) that supports OpenID Connect (OIDC), such as Microsoft Azure, or SAML 2.0.

Note: InfoSum does not support Google Cloud Storage (GCS) parallel composite uploads.

First, you will need a Google Cloud Platform account. To set up an account, or access an existing account, go to the URL: console.cloud.google.com

Once you have created your Google Cloud Platform account, you will need to create the following to work with InfoSum Platform:

Creating a project

Creating a Bucket in the project

Create a service account

Create a WIF identity pool

Completing the GCS ICC connector

Creating a project

Follow the instructions on Google support documentation to create a project https://developers.google.com/workspace/guides/create-project 

Creating a Bucket in the project

Select Browser from the Cloud Storage menu for your newly-created project.

Select Create Bucket.

Enter a name for the bucket from the window that opens

Click Continue to select the location to store your data depending on where you are. 

Select the location type and location, for example, Multi-region and EU. 

The default settings during bucket creation are sufficient but you might choose to vary those. Then, click Create and the bucket and its selected settings appear in the Browser list.

Click on the bucket to open the details window. Make a note of the Bucket name. 

Create a service account

Select Service Accounts from the IAM & Admin menu in the Google Cloud Platform.

Select Create Service Account. 

This opens the window shown below. Give the service account a name - this name is used to auto-complete the randomly generated Service account... field underneath.

Click Create and Continue to create the account and grant service account access to the project. 

Assign Storage Object Viewer. This account is used only for import setup.

IMPORTANT: This account must have permission to your target bucket, folder, and subfolder (if relevant)

Click Done and the account appears in the list of Service Accounts.

Make a note of the name.

Create a WIF identity pool

Create a workload identity federation (WIF) identity pool within the GCP project created in step 1. 

In the GCP console navigate to “IAM And Admin” and select “Workload Identity Federation” from the menu on the left. Then select “Create Pool”

To create the new identity pool first give it a name and description, which can be anything of your choosing, and click “continue”

 In the "Add a provider to pool" section, set the following:

Add a mapping in the Provider to extract the AWS Session leaving the first two providers unchanged.

• Set the key to attribute.aws_session 
• the value to assertion.arn.contains('assumed-role') ? assertion.arn.extract('assumed-role/{role_and_session}').extract('/{session}') : assertion.arn

Then click add condition and place the following value in substituting the values taken from the create ICC screen in the infosum platform.

For the AWS role ARN within the infosum platform you must change iam to sts and role to assumed-role.

E.g.

arn:aws:iam::570414588874:role/InfoSumImporterRole

becomes:

arn:aws:sts::570414588874:assumed-role/InfoSumImporterRole

which is then used as the value for AWS_ARN below with the AWS_SESSION_FROM_UI being the session name shown in the infosum platform

attribute.aws_role == 'AWS_ARN' && attribute.aws_session == 'AWS_SESSION_FROM_UI'

Then click save.

Under “Workload Identity Federation”, you should see the pool you have just created. 

Copy the IAM principal and, at the start of the line replace “principal” with “principalSet” and subject/SUBJECT_ATTRIBUTE_VALUE with attribute.aws_role/arn:aws:sts::570414588874:assumed-role/InfoSumImporterRole

Which is derived by taking the AWS role ARN shown in the create ICC screen and replacing role with assumed-role and iam with sts. This is the same value created in step 4.

This is the IAM principle you need to set in the service account permissions.

Under “IAM and Admin” select “Service Accounts” then the service account you created earlier. Select “Grant Access”

Add the principle for the workload identity pool you copied earlier and select the role “Workload Identity User”, then save.

Finally, navigate back to “Workload Identity Federation” and click on the name of the workload pool. On the right click on “Connected Service Accounts”. You should see your service account listed with a download icon. 

Now the Client Library Configuration can be downloaded. Click “Download” to download the client config json which must be placed into the ICC config. 

Select the InfoSum provider in the dropdown. Ensure you do not use the generic download config button and use the download associated with a specific service account.

Completing the GCS ICC connector

You can complete the ICC connector using the JSON config and the bucket name.