As organizations continue adopting multi-cloud architectures, one of the biggest challenges is enabling secure communication between workloads running on different cloud providers without introducing unnecessary secrets, long-lived credentials, or manual key management. Traditional approaches often rely on service account keys, shared secrets, or static credentials that increase the attack surface and violate modern security best practices.
A more secure alternative is to use identity federation, where one cloud provider trusts the identity asserted by another. Instead of distributing credentials across environments, workloads authenticate using their native cloud identities. This approach aligns closely with Zero Trust Architecture, where every request is authenticated, authorized, and continuously verified regardless of network location.
One practical implementation of this pattern is exchanging an AWS Signature Version 4 (SigV4) signed request for a Google Cloud Platform (GCP) access token. Rather than storing a Google service account key inside AWS, an AWS workload proves its identity using its IAM credentials. Google validates the AWS identity through Workload Identity Federation and issues a temporary access token that can securely access Google Cloud resources.
MultiCloudJ simplifies this process considerably by abstracting much of the underlying authentication complexity into an easy-to-use Java library. Developers can focus on business logic while maintaining enterprise-grade security.
In this article, you will learn:
- Why exchanging AWS identities for GCP tokens is valuable
- How Workload Identity Federation works
- The authentication flow
- How MultiCloudJ simplifies implementation
- Complete Java coding examples
- Security best practices
- Common troubleshooting techniques
- Production deployment recommendations
Understanding the Problem
Suppose your application runs inside AWS ECS, Lambda, EC2, or EKS.
The application needs to:
- Read files from Google Cloud Storage
- Publish messages to Pub/Sub
- Call Vertex AI
- Access Secret Manager
- Invoke Cloud Run services
A traditional solution would involve storing a Google service account JSON key inside AWS.
This introduces several problems:
- Long-lived credentials
- Secret rotation complexity
- Increased risk if keys leak
- Operational overhead
- Non-compliance with Zero Trust principles
Instead, AWS can authenticate using its own IAM identity.
Google Cloud validates that identity.
A temporary OAuth access token is returned.
No permanent Google credentials are ever stored.
What is AWS Signature Version 4?
AWS Signature Version 4 (SigV4) is AWS’s standard request signing protocol.
Every signed request contains cryptographic proof of:
- AWS Access Key ID
- Request timestamp
- Region
- Service
- Canonical request hash
- Signing key
Because only valid AWS credentials can generate the signature, Google Cloud can trust the identity after verification through AWS Security Token Service (STS).
What is Google Workload Identity Federation?
Workload Identity Federation allows external identities to impersonate Google Cloud service accounts without requiring service account keys.
Supported identity providers include:
- AWS
- Azure
- OIDC providers
- SAML providers
Instead of uploading keys into external environments, Google Cloud validates identities from trusted providers.
Benefits include:
- No long-lived secrets
- Temporary credentials
- Least privilege
- Better auditing
- Reduced credential management
How MultiCloudJ Fits Into the Picture
Without MultiCloudJ, implementing the authentication flow requires developers to manually:
- Generate SigV4 requests
- Construct AWS STS identity documents
- Exchange tokens
- Handle OAuth responses
- Refresh tokens
- Manage expiration
- Parse credential responses
- Handle retries
MultiCloudJ automates these operations through a streamlined API.
Instead of writing hundreds of lines of authentication code, developers typically configure the federation once and request access tokens whenever needed.
Authentication Flow
The complete authentication sequence looks like this:
- Java application starts in AWS.
- AWS IAM credentials are automatically discovered.
- MultiCloudJ generates an AWS SigV4 signed request.
- The signed request is sent to Google Security Token Service.
- Google validates the AWS identity.
- Google issues a temporary federated credential.
- The federated identity impersonates a Google service account.
- Google returns an OAuth access token.
- The application accesses Google Cloud APIs.
No service account keys are exchanged during this process.
Prerequisites
Before implementing the solution, ensure the following components are configured.
AWS:
- IAM Role
- STS permissions
- Compute environment (EC2, ECS, Lambda, or EKS)
Google Cloud:
- Workload Identity Pool
- AWS Identity Provider
- Service Account
- IAM bindings
- Service Account Token Creator role
Java:
- JDK 17+
- Maven or Gradle
- MultiCloudJ dependency
Maven Dependency Example
<dependency>
<groupId>com.multicloudj</groupId>
<artifactId>multicloudj</artifactId>
<version>1.0.0</version>
</dependency>
Initializing MultiCloudJ
The first step is configuring the federation provider.
MultiCloudClient client =
MultiCloudClient.builder()
.projectId("my-gcp-project")
.workloadIdentityPool("aws-pool")
.provider("aws-provider")
.serviceAccount(
"application@my-project.iam.gserviceaccount.com")
.build();
This configuration tells MultiCloudJ which Google Cloud identity resources should participate in the federation process.
Obtaining a GCP Access Token
Requesting a token is straightforward.
AccessToken token = client.getAccessToken();
System.out.println(token.getToken());
System.out.println(token.getExpirationTime());
Internally, MultiCloudJ performs:
- AWS credential discovery
- SigV4 signing
- Token exchange
- Service account impersonation
- OAuth token generation
Using the Token with Google Cloud Storage
Once the OAuth token has been obtained, it can authorize Google Cloud API requests.
String tokenValue = token.getToken();
HttpRequest request =
HttpRequest.newBuilder()
.uri(
URI.create(
"https://storage.googleapis.com/storage/v1/b"))
.header("Authorization",
"Bearer " + tokenValue)
.GET()
.build();
The request is authenticated without requiring a Google service account key.
Automatic Token Refresh
OAuth tokens are temporary.
MultiCloudJ automatically refreshes tokens before expiration.
AccessToken token =
client.getAccessToken();
while (true) {
token = client.refreshIfNeeded(token);
Thread.sleep(30000);
}
Applications remain authenticated without manual credential renewal.
Accessing Google Secret Manager
SecretManagerClient secrets =
client.secretManager();
String value =
secrets
.accessSecret(
"database-password");
System.out.println(value);
The library transparently handles authentication.
Uploading Files to Cloud Storage
StorageClient storage =
client.storage();
storage.upload(
"reports",
"sales.csv",
Paths.get("sales.csv"));
Authentication occurs automatically using the federated identity.
Calling Vertex AI
VertexAIClient vertex =
client.vertexAI();
String response =
vertex.generateText(
"Explain Zero Trust authentication.");
System.out.println(response);
No API keys are required.
Working with Pub/Sub
PubSubClient pubsub =
client.pubSub();
pubsub.publish(
"notifications",
"Deployment completed.");
Again, authentication relies solely on temporary federated credentials.
Error Handling Example
Authentication failures should be handled gracefully.
try {
AccessToken token =
client.getAccessToken();
}
catch(AuthenticationException ex){
System.out.println(
"Authentication failed: "
+ ex.getMessage());
}
Production applications should also implement retry policies for transient network failures.
Token Caching
Repeated authentication requests can increase latency.
MultiCloudJ maintains an in-memory cache.
AccessToken token =
client.cachedToken();
If the token is still valid, no additional federation occurs.
IAM Permission Considerations
The AWS IAM role should receive only the permissions required to establish federation.
Likewise, the Google service account should receive the minimum IAM roles necessary for the target services.
For example:
- Storage Object Viewer
- Pub/Sub Publisher
- Secret Manager Secret Accessor
- Vertex AI User
Avoid granting Owner or Editor roles whenever possible.
Security Advantages
This authentication model provides numerous security improvements.
No Static Secrets
Nothing is stored inside AWS except the native IAM identity.
Temporary Credentials
Google issues short-lived OAuth tokens that expire automatically.
Automatic Rotation
Credential rotation becomes automatic because tokens are regenerated as needed.
Identity-Based Authentication
Authentication depends entirely on verified identities rather than shared secrets.
Zero Trust Alignment
Every request is authenticated independently using trusted identity providers.
Common Troubleshooting
Several issues commonly arise during initial deployment.
Permission Denied
Verify that the Google service account has the correct IAM roles.
Federation Failure
Ensure the Workload Identity Provider trusts the correct AWS account.
Expired Token
Confirm that token refresh is functioning properly.
Clock Skew
AWS SigV4 requires accurate timestamps. Synchronize server clocks using NTP.
Incorrect Audience
Double-check the audience value configured for Workload Identity Federation.
Performance Considerations
Authentication latency is typically minimal because:
- SigV4 signing is computationally inexpensive.
- Tokens are cached.
- Token refresh happens only when necessary.
- Temporary credentials reduce repeated authentication work.
Applications serving thousands of requests generally reuse cached access tokens until expiration.
Best Practices
When deploying this architecture in production, consider the following recommendations:
- Use short-lived tokens only.
- Never store Google service account keys in AWS.
- Restrict IAM permissions to the minimum required.
- Enable audit logging on both AWS and Google Cloud.
- Rotate AWS IAM credentials according to organizational policies.
- Monitor authentication failures.
- Cache access tokens responsibly.
- Use HTTPS for all communication.
- Regularly review trust relationships between AWS and GCP.
- Test federation during disaster recovery exercises.
Example End-to-End Workflow
Imagine a reporting application running on Amazon ECS.
The application performs the following sequence:
- Starts using an AWS IAM role.
- MultiCloudJ discovers AWS credentials.
- A SigV4 request is generated.
- Google validates the AWS identity.
- A federated identity is established.
- A temporary GCP OAuth token is issued.
- The application uploads reports to Cloud Storage.
- Metadata is published to Pub/Sub.
- Secrets are retrieved from Secret Manager.
- Tokens refresh automatically when nearing expiration.
Throughout the workflow, no Google service account keys are stored, copied, or distributed.
Why This Architecture Supports Zero Trust
Zero Trust assumes that no workload should automatically trust another based solely on network location. Every interaction should be verified using strong identity, contextual authorization, and least-privilege access.
Exchanging an AWS SigV4 request for a GCP access token embodies these principles. AWS workloads authenticate using their existing IAM identities, Google Cloud independently validates those identities through Workload Identity Federation, and only then are short-lived access tokens issued. Because the tokens are temporary and scoped to a specific service account with limited permissions, the impact of credential compromise is significantly reduced compared to static keys.
MultiCloudJ further reinforces this model by automating secure token acquisition, refresh, and caching, reducing the likelihood of implementation errors that could weaken the overall security posture. Developers no longer need to manage sensitive credential files or build custom federation logic, allowing them to focus on application functionality while maintaining strong security controls.
Conclusion
As multi-cloud adoption continues to accelerate, organizations increasingly require secure, seamless communication between workloads running on different cloud platforms. Traditional approaches that depend on long-lived service account keys, shared secrets, or manually distributed credentials are becoming increasingly difficult to justify from both a security and operational perspective. They introduce unnecessary risk, complicate credential lifecycle management, and conflict with modern Zero Trust principles that emphasize continuous identity verification over implicit trust.
Exchanging an AWS SigV4 request for a Google Cloud access token through Workload Identity Federation offers a fundamentally different and more secure approach. Rather than transporting credentials across environments, each platform relies on its own trusted identity system. AWS workloads authenticate with their native IAM roles, Google Cloud validates those identities, and temporary OAuth access tokens are issued only after successful verification. This eliminates the need for permanent Google credentials within AWS environments while significantly reducing the attack surface.
MultiCloudJ streamlines this entire workflow by encapsulating the complexities of federation, request signing, token exchange, impersonation, caching, and refresh into a developer-friendly Java API. Instead of writing and maintaining intricate authentication logic, teams can integrate secure cross-cloud authentication with only a small amount of code. This not only accelerates development but also minimizes the risk of security vulnerabilities caused by incorrect implementations.
Beyond simplifying development, this architecture delivers tangible operational benefits. Automatic token refresh reduces administrative overhead, short-lived credentials improve resilience against credential theft, centralized IAM policies strengthen governance, and comprehensive audit trails across both AWS and Google Cloud enhance visibility for security and compliance teams. The result is a system that is easier to maintain, more resistant to compromise, and better aligned with enterprise security frameworks.
As cloud-native applications continue to span multiple providers, identity federation will increasingly become the preferred authentication strategy. Organizations adopting solutions like MultiCloudJ can confidently build secure, scalable, and maintainable multi-cloud applications without relying on static secrets. By embracing temporary credentials, least-privilege access, and identity-driven authentication, development teams position themselves to meet both current security requirements and the evolving demands of modern distributed systems, creating a robust foundation for secure, zero-trust communication across cloud boundaries.