Connect GCP to SubImage

What this does

Creates a Google Workload Identity Pool and AWS provider that trust the SubImage tenant AWS role, grants Google Cloud IAM roles directly to that WIF principal, and gives the user the three values to enter in the SubImage GCP module. Service account JSON keys are covered only as a fallback for environments that cannot use WIF.

When to use

✅ User wants to onboard a Google Cloud organization, folder, or project into SubImage. ✅ User asks for GCP WIF setup, IAM bindings, Terraform, or gcloud commands for SubImage scanning. ✅ User is in their IaC repo and wants to commit the GCP setup as code.

❌ User wants to scan GKE pods at the Kubernetes layer: this skill stops at the GCP resource/IAM layer; combine with subimage-setup:connect-kubernetes-outpost if the cluster API is private. ❌ User only wants service account key setup and already knows WIF is impossible: skip to Fallback: service account key.

Required inputs

Before generating commands or HCL, collect these values. If any are missing, ask the user explicitly. Do not invent values or paste literal placeholders into customer commands.