Deploying a static website to Google Cloud Storage (GCS) is straightforward. However, manually uploading files after every change quickly becomes inefficient and error-prone.

A better solution is to automate deployments using GitHub Actions while following Google's recommended authentication approach: Workload Identity Federation (WIF).

Unlike the traditional method of storing a service account JSON key in GitHub Secrets, WIF uses short-lived credentials issued through OpenID Connect (OIDC). This improves security by eliminating long-lived secrets.

ARCHITECTURE

Prerequisites

Before starting, ensure you have:

• A Google Cloud Project

• A GitHub repository

• A static website (HTML/CSS/JS)

• A Google Cloud Storage bucket

• Billing enabled

• GitHub Actions enabled

Step 1 – Create the Storage Bucket

Create a bucket that will host your website. Enable "Uniform Bucket-Level Access (UBLA)" . This simplifies permission management using IAM instead of ACLs.

Step 2 – Create a Service Account

Create a dedicated service account for GitHub deployments.

Example: github-gcs-sync

Grant the required permissions. For this deployment I assigned:
Storage Admin Depending on your requirements, a more restrictive role such as Storage Object Admin may also be appropriate.

Step 3 – Configure Workload Identity Federation

Create Workload Identity Pool & Workload Identity Provider

Configure GitHub as the OIDC provider. Grant the GitHub repository permission to impersonate the service account using: roles/iam.workloadIdentityUser.

Step 4 – GitHub Actions Workflow

Once this workflow is committed to the repository, every push to the main branch automatically deploys the latest website to Google Cloud Storage.

Challenges I Encountered

No cloud deployment is complete without troubleshooting! During implementation, I ran into several issues that helped deepen my understanding of Google Cloud IAM and GitHub Actions

Missing IAM Permissions

The deployment initially failed with:

Permission 'storage.buckets.get' denied

The issue was resolved by assigning the appropriate Storage IAM role to the service account.

Security Best Practices

• Avoided service account JSON keys

• Used Workload Identity Federation

• Granted least-privilege IAM roles

• Enabled Uniform Bucket-Level Access

• Automated deployments through GitHub Actions

• Kept credentials temporary using OIDC

Results

With the pipeline in place, every push to the main branch automatically:

• Authenticates securely using OIDC

• Exchanges the token through Workload Identity Federation

• Impersonates the Google Cloud service account

• Uploads the latest website files to Google Cloud Storage

No manual uploads are required.

Conclusion

Building a CI/CD pipeline using GitHub Actions and Workload Identity Federation not only simplified website deployment but also aligned with Google's security best practices.

For anyone deploying applications or static websites on Google Cloud, adopting keyless authentication through Workload Identity Federation is a worthwhile investment. It reduces operational overhead, strengthens security, and provides a scalable foundation for future cloud projects.

Tags

Google Cloud • GitHub Actions • Workload Identity Federation • Google Cloud Storage • CI/CD • Cloud Security • DevOps • IAM