Workload Identity Federation

Also written: WIF, workload identity pool

A way to swap an outside token, such as GitHub's, for short-lived Google Cloud access, so no service account key is stored anywhere.