GCP Workload Identity Atlas
Parent: Global AI Hub Research Corpus · Published reference · snapshot 2026-10-30
↓ Facts as markdownall context files
Source-anchored research for GCP Workload Identity Atlas. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- The Atlas federated-user identifier is the service account numeric Unique ID, not its email. Assign database privileges to that identity. (medium confidence) [source]
How it works
- Atlas offers built-in token acquisition for supported environments and callback authentication when built-in acquisition is unsuitable. The specification defines an application-supplied machine callback that returns OIDC credentials. (medium confidence) [source]
Comparisons and alternatives
- Google documents https://accounts.google.com as the VM identity-token issuer and the attached service account's unique ID as sub. Atlas maps a GCP federated database user to that Unique Id, rather than the service-account email. (medium confidence) [source]
- The driver specification requires TOKEN_RESOURCE for ENVIRONMENT:gcp and rejects combining a built-in environment with an OIDC callback. A resource containing a comma must be supplied through client configuration rather than the connection string. (low confidence) (verified as of 2026-07-23) [source]
- The community Cloud Run test bench checks token claims, authenticated ping, and CRUD permissions separately. This provides a practical diagnostic sequence, but the repository is a demonstration rather than independent production validation. (medium confidence) [source]
Facts and statements
- Atlas workload federation supports application database access through Google service accounts; the external identity still needs an Atlas federated database user and assigned database privileges. (medium confidence) [source]
- The GCP driver integration uses ENVIRONMENT:gcp and TOKEN_RESOURCE. It requests the metadata identity endpoint with TOKEN_RESOURCE as the URL-encoded audience and the Metadata-Flavor: Google header. (medium confidence) [source]
- The MONGODB-OIDC specification requires authentication source $external, prohibits a password and rejects ENVIRONMENT:gcp without TOKEN_RESOURCE. It also rejects configuring an environment integration and an OIDC callback together. (low confidence) [source]
- The intended token audience must match the relying service's expected audience. In the Atlas Cloud Run test bench, MONGODB_AUDIENCE must exactly match the Atlas Workload Identity Provider Audience field. (medium confidence) [source]
- MongoDB's dated October 18, 2025 administrator response scopes Google-service-account federation to dedicated Atlas clusters M10 and above with MongoDB 7.0.11; the Atlas setup documentation states the same minimums. This does not establish support for Free or Flex clusters. (medium confidence) (verified as of 2025-10-18) [source]
- The EZFRICA Cloud Run test bench separates token inspection, an authenticated ping and CRUD checks. Its README checks aud, iss and numeric sub before testing database connectivity and permissions. (low confidence) [source]
- DRIVERS-3390 describes intermittent GCP OIDC test failures affecting driver developers. It explicitly identifies the issue as test-only and calls for appName-scoped failpoints; it is not evidence of a production Atlas GCP authentication outage. (low confidence) [source]
- The MongoDB Rust driver README lists gcp-oidc as the feature that enables GCP OIDC environment authentication; applications using that driver should check the selected build features. (low confidence) [source]
- Google's documented VM identity payload describes service-account subject and email claims without documenting a groups claim. Atlas's GCP database-user mapping uses the service-account Unique Id; do not assume Google Group membership automatically supplies database roles. (medium confidence) [source]
- For GCP federation, configure the Atlas issuer as https://accounts.google.com, choose an audience, and keep User Claim set to sub. The token audience must match that configuration. (medium confidence) [source]
- The built-in driver configuration uses authMechanism=MONGODB-OIDC and authMechanismProperties=ENVIRONMENT:gcp,TOKEN_RESOURCE:<audience>. TOKEN_RESOURCE supplies the audience for the metadata token request. (medium confidence) [source]
- The GCP driver integration requests /computeMetadata/v1/instance/service-accounts/default/identity?audience=<resource> from the metadata server with Metadata-Flavor: Google. The resource must be URL-encoded. Google documents this as an identity JWT, although MongoDB specifications call the returned value an access token. (medium confidence) [source]
- Atlas documents support only on dedicated M10+ clusters running MongoDB 7.0.11+, with selected drivers; its workload-authentication page excludes mongosh and Compass. (low confidence) (verified as of 2026-10-30) [source]
- Google identity JWTs include issuer, audience, subject, issued-at, and expiry claims. A receiver must verify the signature and intended audience; decoding the token alone is insufficient. (medium confidence) [source]
- A valid workload identity does not establish Atlas network reachability. The Cloud Run demonstration separately configures network egress and an Atlas IP access list. (medium confidence) [source]
- GODRIVER-4187 reports missing reauthentication for getMore and killCursor after ReauthenticationRequired (391), lists affected versions 1.17.6 and 2.9.2, and remains unresolved with fix version 2.9.3 targeted in its October 29 update. A target version is not proof that a fix shipped. (low confidence) (verified as of 2026-10-29) [source]
Children
- Atlas OIDC audience and subject mapping (frontier)
- GKE service-account identity tokens (frontier)
- MongoDB driver OIDC callbacks and token caching (frontier)
- Cloud Run service-account metadata identity tokens (frontier)
- MongoDB OIDC token caching and cursor reauthentication (frontier)
- GKE Google service-account versus Kubernetes token authentication (frontier)
Frontier under this node: Atlas OIDC audience and subject mapping, Cloud Run service-account metadata identity tokens, GKE Google service-account versus Kubernetes token authentication, GKE service-account identity tokens, MongoDB OIDC token caching and cursor reauthentication, MongoDB driver OIDC callbacks and token caching