Set up the Google Cloud CLI for Cloud de Confiance

This guide provides instructions for setting up the Google Cloud CLI ( gcloud CLI) for use with Cloud de Confiance. The gcloud CLI helps you create and work with Cloud de Confiance resources from the command line.

For more general information about configuring and using the gcloud CLI, see the Google Cloud CLI documentation.

Differences from setup in Google Cloud

If you're already familiar with setting up and using the CLI with Google Cloud, note the following:

• There is some additional initial setup required to use the gcloud CLI with Cloud de Confiance, as described in this guide.
• Cloud Shell is not available in Cloud de Confiance. The gcloud CLI must be installed on your local machine.
• Initializing the gcloud CLI in one step with gcloud init is not available.
• If a feature or product is unavailable in Cloud de Confiance, the corresponding gcloud CLI commands and parameters are also unavailable.

Before you begin

In addition to your own sign in details for Cloud de Confiance, you need the following to set up the gcloud CLI for the first time. If you are not an administrator for your organization, your administrator should provide you with this information.

• Your organization's workload identity pool name.
• Your organization's identity provider (IdP).

Install the gcloud CLI

Install the gcloud CLI, following the instructions for your OS.

Create your login configuration file

To set up access to your universe, you need to create a JSON configuration file for the gcloud CLI, including domains used by Cloud de Confiance and the IdP set up for your organization.

To create your login configuration file:

• Run the following commands:

  gcloud config set universe_domain s3nsapis.fr
  
  AUDIENCE=locations/global/workforcePools/POOL_ID/providers/PROVIDER_ID
  UNIVERSE_WEB_DOMAIN="cloud.s3nscloud.fr"
  UNIVERSE_API_DOMAIN="s3nsapis.fr"
  
  gcloud iam workforce-pools create-login-config \
  $AUDIENCE \
  --universe-cloud-web-domain="$UNIVERSE_WEB_DOMAIN" \
  --universe-domain="$UNIVERSE_API_DOMAIN" \
  --output-file="wif-login-config.json"
  

  Replace the following:

  • POOL_ID: the unique identifier for your organization's workload identity pool.
  • PROVIDER_ID: your organization's identity provider (IdP).

The output is similar to the following:

Created login configuration file [wif-login-config.json].

After you have created your configuration file, you don't need to repeat this step as long as you are signing in from the same machine.

Sign in to Cloud de Confiance with the gcloud CLI

Now you can use the configuration file every time you need to sign in to Cloud de Confiance:

• To sign in from the command line, run the following command:

  gcloud auth login -–login-config=wif-login-config.json
  

• If you need to use Application Default Credentials (ADC) (required for running Terraform modules), run the following command:

  gcloud auth application-default login --login-config=wif-login-config.json
  

A web page opens where you can sign in with your login details. After you've logged in you can then go on to configure and use the gcloud CLI as described in the rest of its documentation.

(Optional) Set up default properties

When you set up the gcloud CLI, you are provided with a configuration called default that you can use for properties that provide default flag values or govern the tool's behavior. Although it's optional, we recommend configuring some default properties for gcloud CLI, such as your default project, before using the tool. Default properties are useful if you don't want to have to specify your project or preferred compute location every time you run a command.

The following steps set the same properties that are configured by gcloud init for Google Cloud users:

1. To set your default project, run the following command, specifying your chosen project ID:

   gcloud config set project PROJECT_ID
   

2. If you use Compute Engine or GKE, some commands require you to specify a compute region or zone. To set your default region for commands, run the following command:

   gcloud config set compute/region u-france-east1
   

   To set your default zone, run the following command:

   gcloud config set compute/zone ZONE
   

3. To view your current configuration's properties, including the authenticated user, run the following command:

   gcloud config list
   

You can learn about how gcloud CLI configurations work and how to create and use additional configurations in Manage gcloud CLI configurations. You can learn more about specifying properties in Manage gcloud CLI properties.

(Optional) Run commands

Run core commands to view information about your gcloud CLI installation:

1. List accounts whose credentials are stored on the local system:

   gcloud auth list
   

   The gcloud CLI displays a list of credentialed accounts:

   Credentialed Accounts
   ACTIVE             ACCOUNT
   *                  principal://iam.googleapis.com/locations/global/workforcePools/my-pool/subject/my-user@example.com
   

2. List the properties in your active gcloud CLI configuration:

   gcloud config list
   

   The gcloud CLI displays the list of properties:

   [core]
   account = principal://iam.googleapis.com/locations/global/workforcePools/my-pool/subject/my-user@example.com
   disable_usage_reporting = False
   project = my-project
   

3. View information about gcloud commands and other topics:

   gcloud help
   

   For example, to view the help for gcloud compute instances create:

   gcloud help compute instances create
   

   The gcloud CLI displays a help topic that contains a description of the command, a list of command flags and arguments, and examples of how to use the command.

What's next

• If you're an administrator setting up a Cloud de Confiance organization for the first time, find out how to configure your organization in Set up your organization.
• To find out more about what you can do with the Google Cloud CLI, see the Google Cloud CLI documentation
• For more information about getting started with Cloud de Confiance, see Get started with Cloud de Confiance.