GitHub Actions对接GCP OIDC遇403错误：无法获取模拟凭证

已查阅相关仓库已关闭issue及Stack Overflow问题，耗时一周仍未解决GitHub仓库通过subject claim获取GCP访问令牌的问题，排查OIDC相关错误后未找到匹配案例。

尝试的映射结构 #

我使用的映射结构为：

${MYREPO}:environment:my-env

该结构已通过GitHub官方文档确认，官方示例格式为：

"sub": "repo:octo-org/octo-repo:environment:prod"

GitHub Actions Workflow配置 #

我的Workflow配置如下：

name: 'Terraform_gcp_vpc'

on:
  push:
    branches: [ "git_actions" ]
    paths:
...
jobs:
  
  terraform_setup:
    name: 'Terraform Init-Validate'
    runs-on: ubuntu-latest
    environment: gcp-labs
 runner 
    defaults:
     run:
       shell: bash
       working-directory: ${{ env.STACK_DIR }}

    steps:
# Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3
    
 #  Authenticate with GCP  using OIDC Workload Federated Identiry 
    - name: 'Authenticate to Google Cloud'
      id: auth
      uses: 'google-github-actions/auth@v1'
      with:
        workload_identity_provider: ${{ secrets.WORKLOAD_ID_PROVIDER }} 
        service_account: ${{ secrets.SERVICE_ACCOUNT }}
        
  # Install gcloud, `setup-gcloud` automatically picks up authentication from `auth`.
    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v1'   
    - id: 'gcloud'
      name: 'gcloud'
      run: gcloud services list

执行错误信息 #

执行gcloud services list时出现以下错误：

Error: (gcloud.services.list) There was a problem refreshing your current auth tokens: 'Unable to acquire impersonated credentials'
 {
  "error": {
    "code": 403,
    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
    "status": "PERMISSION_DENIED"
    "details":
   [
      {
      "reason": "IAM_PERMISSION_DENIED",        
      "domain": "iam.googleapis.com",
      "metadata": {
      "permission": "iam.serviceAccounts.getAccessToken"
      }
    }
   ]
  }
 }

GCP端配置细节 #

• Attribute-Mapping配置：
  
• PrincipalSet配置：

principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}:environment:gcp-labs"

现寻求解决方案。

内容的提问来源于stack exchange，提问作者koss