Set up Google Cloud Storage

An example script is provided below. Ensure all required variables are set:

• GCP project variables:

  • var.gcp_project_name

  • var.gcp_region

• SaaS provided by HumanSignal:

  • var.aws_account_id = 490065312183

  • var.aws_role_name = label-studio-app-production

Then run:

terraform init
terraform plan
terraform apply

Once applied, you will have a functioning Workload Identity Pool that trusts the Label Studio AWS IAM Role.

## Variables
/* AWS variables are so that AWS-hosted Label Studio resources can reach out to request credentials */

variable "gcp_project_name" {
  type        = string
  description = "GCP Project name"
}

variable "gcp_region" {
  type        = string
  description = "GCP Region"
}

variable "label_studio_gcp_sa_name" {
  type        = string
  description = "GCP Label Studio Service Account Name"
}

variable "aws_account_id" {
  type        = string
  description = "AWS Project ID"
}

variable "aws_role_name" {
  type        = string
  description = "AWS Role name"
}

variable "external_ids" {
  type        = list(string)
  default = []
  description = "List of external ids"
}

## Outputs

output "GCP_WORKLOAD_ID" {
  value = google_iam_workload_identity_pool_provider.label-studio-provider-jwt.workload_identity_pool_id
}

output "GCP_WORKLOAD_PROVIDER" {
  value = google_iam_workload_identity_pool_provider.label-studio-provider-jwt.workload_identity_pool_provider_id
}

## Main

provider "google" {
  project = var.gcp_project_name
  region  = var.gcp_region
}

resource "random_id" "random" {
  byte_length = 4
}

locals {
  aws_assumed_role = "arn:aws:sts::${var.aws_account_id}:assumed-role/${var.aws_role_name}"

  external_id_condition = (
    length(var.external_ids) > 0
    ? format("(attribute.aws_role == \"%s\") && (attribute.external_id in [%s])",
      local.aws_assumed_role,
      join(", ", formatlist("\"%s\"", var.external_ids))
    )
    : format("(attribute.aws_role == \"%s\")", local.aws_assumed_role)
  )
}

resource "google_iam_workload_identity_pool" "label-studio-pool" {
  workload_identity_pool_id = "label-studio-pool-${random_id.random.hex}"
  project                   = var.gcp_project_name
}

resource "google_iam_workload_identity_pool_provider" "label-studio-provider-jwt" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.label-studio-pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "label-studio-jwt-${random_id.random.hex}"

  attribute_condition = local.external_id_condition

  attribute_mapping = {
    "google.subject"        = "assertion.arn"
    "attribute.aws_account" = "assertion.account"
    "attribute.aws_role"    = "assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn"
    "attribute.external_id" = "assertion.external_id"
  }

  aws {
    account_id = var.aws_account_id
  }
}

data "google_service_account" "existing_sa" {
  account_id = var.label_studio_gcp_sa_name
}

resource "google_service_account_iam_binding" "label-studio-sa-oidc" {
  service_account_id = data.google_service_account.existing_sa.name
  role               = "roles/iam.workloadIdentityUser"

  members = [
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.label-studio-pool.name}/attribute.aws_role/${local.aws_assumed_role}"
  ]
}

Replace the bracketed variables ([PROJECT_ID], [POOL_ID], [PROVIDER_ID], etc.) with your own values.

Make sure you escape quotes or use single quotes when necessary.

1. Create the Workload Identity pool:

    gcloud iam workload-identity-pools create [POOL_ID] \
   --project=[PROJECT_ID] \
   --location="global" \
   --display-name="[POOL_DISPLAY_NAME]"

   Where:

   • [POOL_ID] is the ID that you want to assign to your WIF pool (for example, label-studio-pool-abc123). Note this because you will need to reuse it later.
   • [PROJECT_ID] is the ID of your Google Cloud project.
   • [POOL_DISPLAY_NAME] is a human-readable name for your pool (optional, but recommended).

2. Create the provider for AWS.

   This allows AWS principals that have the correct external ID and AWS role configured to impersonate the Google Cloud service account. This is necessary because the Label Studio resources making the request are hosted in AWS.

   gcloud iam workload-identity-pools providers create-aws [PROVIDER_ID] \
   --workload-identity-pool="[POOL_ID]" \
   --account-id="490065312183" \
   --attribute-condition="attribute.aws_role==\"arn:aws:sts::490065312183:assumed-role/label-studio-app-production\"" \
   --attribute-mapping="google.subject=assertion.arn,attribute.aws_account=assertion.account,attribute.aws_role=assertion.arn,attribute.external_id=assertion.external_id"
   

   Where:

   • [PROVIDER_ID] is a provider ID (for example, label-studio-app-production).
   • [POOL_ID]: The pool ID you provided in step 1.

3. Grant the service account that you created earlier the iam.workloadIdentityUser role.

   gcloud iam service-accounts add-iam-policy-binding [SERVICE_ACCOUNT_EMAIL] \
   --role="roles/iam.workloadIdentityUser" \
   --member="principalSet://iam.googleapis.com/projects/[PROJECT_NUMBER]/locations/global/workloadIdentityPools/[POOL_ID]/attribute.aws_role/arn:aws:sts::490065312183:assumed-role/label-studio-app-production"

   Where:

   • [SERVICE_ACCOUNT_EMAIL] is the email associated with you GCS service account (for example, my-service-account@[PROJECT_ID].iam.gserviceaccount.com).

   • [PROJECT_NUMBER]: Your Google project number. This is different than the project ID. You can find the project number with the following command:

     gcloud projects describe $PROJECT_ID --format="value(projectNumber)"

   • [POOL_ID]: The pool ID you provided in step 1.

Before setting up your connection in Label Studio, note what you provided for the following variables (you will be asked to provide them):

• [POOL_ID]
• [PROVIDER_ID]
• [SERVICE_ACCOUNT_EMAIL]
• [PROJECT_NUMBER]
• [PROJECT_ID]

Before you begin, ensure you are in the correct project:

1. From the Google Cloud Console, navigate to IAM & Admin > Workload Identity Pools.

2. Click Get Started to enable the APIs.

3. Under Create an identity pool, complete the following fields:

   • Name: This is the pool ID (for example, label-studio-pool-abc123). Note this ID because you will need it again later.
   • Description: This is the display name for the pool (for example, “Label Studio Pool”).

4. Under Add a provider pool, complete the following fields:

   • Select a provider: Select AWS. This is the location where the Label Studio components responsible for issuing requests are stored.
   • Provider name: Enter Label Studio App Production (you can use a different display name, but you need to ensure that the corresponding provider ID is still label-studio-app-production)
   • Provider ID: Enter label-studio-app-production.
   • AWS Account ID: Enter 490065312183.

5. Under Configure provider attributes, enter the following:

   • Click Add condition and then enter the following:

     attribute.aws_role=="arn:aws:sts::490065312183:assumed-role/label-studio-app-production"

   • Click Edit mapping and then add the following:

     • google.subject = assertion.arn
     • attribute.aws_role = assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn (this might be filled in by default)
     • attribute.aws_account = assertion.account
     • attribute.external_id = assertion.external_id

6. Click Save.

7. Go to IAM & Admin > Service Accounts and find the service account you want to allow AWS (Label Studio) to impersonate. See Service account permissions above.

8. From the Principals with access tab, click Grant Access.

   

9. In the New principals field, add the following:

   principalSet://iam.googleapis.com/projects/[PROJECT_NUMBER]/locations/global/workloadIdentityPools/[POOL_ID]/attribute.aws_role/arn:aws:sts::490065312183:assumed-role/label-studio-app-production

   Where:

   • [PROJECT_NUMBER] - Replace this with your Google project number. This is different than the project ID. To find the project number, go to IAM & Admin > Settings.
   • [POOL_ID] - Replace this with the pool ID (the Name you entered in step 3 above, e.g. label-studio-pool-abc123).

10. Under Assign Roles, use the search field in the Role drop-down menu to find the Workload Identity User role.

    

11. Click Save

Before setting up your connection in Label Studio, note the following (you will be asked to provide them)

• Your pool ID - available from IAM & Admin > Workload Identity Pools
• Your provider ID - available from IAM & Admin > Workload Identity Pools (this should be label-studio-app-production)
• Your service account email - available from IAM & Admin > Service Accounts. Select the service account and the email is listed under Details.
• Your Google project number - available from IAM & Admin > Settings
• Your Google project ID - available from IAM & Admin > Settings