Managing multi-cloud environments has shifted from a luxury to a baseline requirement for high-availability systems, where the ability to orchestrate resources across different providers determines the resilience of a modern tech stack. Infrastructure engineers often discover that the most time-consuming part of enabling cross-cloud CI/CD is re-keying dozens of legacy state objects into a predictable structure. This challenge is compounded when moving from a single-cloud ecosystem to a hybrid model, particularly when the primary goal is to maintain security without adding administrative overhead. The complexity often stems from how different platforms handle identity and access management, leading to a fragmented security posture that requires constant patching. As organizations mature in 2026, the shift toward a unified, keyless strategy has become paramount. This transition requires a deep understanding of how various cloud services interact at the cryptographic level, ensuring that trust is established through verifiable identity rather than through the exchange of static credentials. By focusing on these underlying principles, teams can build a deployment pipeline that is not only robust but also significantly more resistant to the common pitfalls associated with manual key rotation and credential leakage. This approach also simplifies the auditing process, as every action can be traced back to a specific, authenticated identity rather than a shared service account key.
1. Core Constraints for the Keyless Pipeline
Keeping Terraform state in Amazon S3 serves as a foundational constraint that prevents the logistical nightmare of state migration. When a project already manages a significant portion of its infrastructure within the AWS ecosystem, the state files representing those resources become the definitive source of truth for the entire environment. Moving these sensitive files to a different cloud provider or a separate storage solution introduces risks related to data integrity, access control, and latency. By maintaining the state in S3, teams can leverage existing bucket policies, encryption keys, and versioning controls that have already been audited and approved by security departments. This stability ensures that the introduction of Google Cloud resources does not disrupt the existing AWS management layer, allowing the infrastructure-as-code configuration to point to a familiar backend while provisioning resources in a completely different cloud environment. This approach minimizes the surface area for errors during the transition phase, ensuring that the legacy architecture remains intact while new capabilities are added.
The decision to keep CI runners within the existing AWS-hosted Kubernetes clusters stems from a desire to avoid the operational burden of managing a second, redundant platform for automation. Managing a fleet of runners across multiple providers necessitates duplicate monitoring, patching, and scaling strategies, which can quickly drain the resources of an infrastructure team. By utilizing the existing GitHub Actions fleet, the organization can capitalize on the mature networking and compute configurations already established in AWS. Simultaneously, the elimination of long-lived service account keys is a non-negotiable security requirement. Static JSON credentials represent a significant vulnerability, as they can be accidentally committed to code repositories or leaked through logging systems. Moving toward a keyless architecture means that even if a runner is compromised, there are no permanent secrets to steal, as all access is based on temporary, identity-bound tokens that expire shortly after the deployment process is completed. This strategy significantly reduces the potential blast radius of a security incident and aligns with modern zero-trust architecture principles.
2. Why Service Account Impersonation Was Selected
Selecting service account impersonation over direct resource access allows for a more streamlined and centralized management of cloud identities. This method minimizes the overhead associated with linking federated identities, as the team only needs to manage a limited number of AWS role references within the Google Cloud IAM configuration. When updates are required or when a new runner needs to be onboarded, the changes are concentrated in a few specific locations rather than being scattered across dozens of individual resource policies. This centralization is particularly beneficial in complex environments where resources are spread across multiple projects or folders. By acting as a central hub for identity, service account impersonation ensures that the bridge between the two cloud providers remains manageable and transparent. It provides a clear mapping that helps administrators understand exactly which external identities have the authority to perform actions within their Google Cloud environment, thereby reducing the likelihood of configuration drift and unauthorized access.
Universal API compatibility is another critical factor that makes service account impersonation the preferred choice for cross-cloud deployments. Certain Google Cloud services have unique identity requirements or internal mechanisms that do not natively support external federated identities for every possible action. By using an intermediary service account, the deployment pipeline gains access to the full suite of Google Cloud APIs, as the service account is a first-class citizen within the Google ecosystem. This approach ensures that whether the pipeline is creating a Cloud Storage bucket, modifying a firewall rule, or deploying a container to GKE, the authentication mechanism remains consistent and reliable. Furthermore, this method integrates seamlessly with established monitoring and control systems. Standard metrics and alerts can be configured to watch the service account’s activity, providing a familiar set of tools for security teams to detect anomalies. In the event of a security breach, the service account acts as a reliable kill switch, allowing administrators to instantly revoke all permissions without affecting the underlying federated identity or other connected services.
3. How the Keyless Authentication Flow Works
The authentication process begins with the AWS-hosted runner acquiring short-term credentials for its authorized IAM role, which serves as the local identity for the execution environment. Once these credentials are in place, the runner utilizes the Google authentication library to generate a signed AWS request. This request is not sent to an AWS endpoint but is instead packaged as a piece of cryptographic evidence that proves the runner’s identity to an external observer. This evidence is then transmitted to the Google Cloud Security Token Service (STS), which acts as the primary gatekeeper for the exchange. The STS is configured to verify the account ID, the specific role name, and any additional conditions defined in the workload identity pool. This rigorous verification ensures that only requests originating from the specific, authorized Kubernetes pod in AWS are accepted. This stage of the process is entirely automated and relies on the pre-established trust relationship between the two cloud providers, removing the need for any human intervention or manual secret handling during the handshake.
Once the Security Token Service successfully verifies the identity, it grants the federated identity the right to act as a designated Google Cloud service account. This step is the crux of the impersonation process, as it transforms the external AWS identity into a temporary internal Google identity. The STS issues a short-lived access token that the Terraform Google provider uses to authenticate all subsequent API calls. While this token is active, the runner can perform any action allowed by the service account’s IAM permissions, effectively bridging the gap between the two clouds. Despite this cross-cloud activity, the runner maintains its connection to Amazon S3 for state management by using its original AWS permissions. This dual-identity state allows the pipeline to read the current infrastructure status from AWS while simultaneously applying changes to Google Cloud. The entire flow is ephemeral, meaning the access token and the underlying session vanish once the deployment finishes, leaving no persistent credentials behind that could be exploited later.
4. Managing the Deployment and Rollout
Successfully deploying a cross-cloud pipeline requires a structured rollout that begins with a pilot phase. During this initial stage, the team focuses on building a policy framework and running synthetic tests to establish baseline performance and security metrics. These tests are designed to fine-tune risk thresholds and scoring, ensuring that the identity federation settings are neither too restrictive to break the pipeline nor too permissive to pose a security risk. By simulating various deployment scenarios in a controlled environment, the team can identify potential bottlenecks or configuration errors before they affect production workloads. This proactive approach allows for the adjustment of token lifetimes, IAM permissions, and networking rules based on real-world data rather than theoretical assumptions. The goal of the pilot is to create a blueprint that can be reliably replicated across different projects, providing a standardized way to handle authentication and resource management across the cloud boundary.
After the pilot phase, the team moves into a rigorous validation stage that covers every aspect of the infrastructure-as-code lifecycle. This includes testing the planning phase to ensure that Terraform can accurately calculate differences, the apply phase to verify resource creation, and the destroy phase to confirm that resources can be cleanly removed. Each of these operations is performed in a safe, isolated environment to prevent any unintended side effects. A crucial part of this validation is a dedicated check to ensure that the existing AWS-specific pipeline remains completely unaffected by the new Google Cloud integration. Since both providers share the same runners and state storage, it is vital to confirm that adding the Google provider and authentication logic does not introduce conflicts or performance degradation for the legacy AWS tasks. This ensures that the organization can expand its cloud footprint without compromising the stability of its existing infrastructure, maintaining a high level of confidence in the automated deployment systems as they become more complex.
5. Essential Takeaways for Multi-Cloud CI/CD
A critical insight gained from this project was the importance of identifying hidden requirements through an early audit of existing infrastructure and state files. Teams often assume that the transition will be purely technical, but legacy naming conventions, hardcoded dependencies, and complex state structures can create significant hurdles during the integration process. By performing a thorough review before the implementation began, the engineers were able to address these issues proactively, preventing costly delays later in the cycle. Additionally, presenting the security department with a functional prototype supported by audit evidence proved far more effective than high-level conceptual presentations. Demonstrating the actual flow of identities and the lack of permanent keys allowed the security team to evaluate the risks based on technical reality rather than theoretical vulnerabilities. This collaborative approach facilitated a smoother approval process and ensured that the security requirements were baked into the architecture from the very beginning.
In the final assessment, the project demonstrated that choosing temporary federated identities over static service account keys was the single most effective way to reduce credential-related risks. The team prioritized the validation of revocation procedures and token expiration as core product behaviors, treating them with the same importance as the resource provisioning itself. This focus ensured that the system could respond quickly to potential threats by invalidating sessions in real time. Once the proof of concept reached its conclusion, every experimental setup and temporary access path was fully decommissioned. This step was essential to prevent the accumulation of “shadow” access that could be forgotten and later exploited. By strictly adhering to these decommissioning practices, the organization maintained a clean and auditable security perimeter. The transition ultimately provided a scalable and secure framework that allowed the infrastructure team to move forward with confidence, knowing that their multi-cloud operations were built on a foundation of temporary, verifiable trust rather than fragile and dangerous secrets.
