Zero Keys, Two Clouds: How Our AWS-hosted Terraform CI/CD Deploys to Google Cloud
We extended inDrive’s Terraform CI/CD from AWS to Google Cloud without creating a single service-account key, using Workload Identity Federation from runners that never left AWS. Here is what the documentation does not tell you — including why authentication was not the hardest part.
The confession: Google Cloud was outside our Terraform CI/CD
For years, our infrastructure CI was single-cloud — not by decision, but by construction.
The pipeline that plans and applies every Terraform change in our monorepo filtered changed files through an allowlist of directory prefixes. That allowlist simply never learned that gcp/ existed. The apply-on-merge workflow went further and explicitly excluded Google Cloud paths. There was no Google Cloud authentication in CI either: the generated provider block was bare, with no project and no credentials.
CI workflow overview
The result was predictable but easy to overlook: around 97 Terragrunt units across approximately 25 Google Cloud projects were...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
