Added project IAM binding for the impersonated account.

make_wif.sh

@@ -23,6 +23,11 @@ gcloud iam service-accounts add-iam-policy-binding \
     --role=roles/iam.workloadIdentityUser \
     --member="principal://iam.googleapis.com/projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/subject/test-client"
 
+# Grant the service account read access to the project
+gcloud projects add-iam-policy-binding dom-lab \
+    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+    --role=roles/browser
+
 # Create credentials configuration files
 gcloud iam workload-identity-pools create-cred-config \
     projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/providers/dom-lab-x509 \
@@ -30,3 +35,19 @@ gcloud iam workload-identity-pools create-cred-config \
     --credential-cert-path=client_cert.pem \
     --credential-cert-private-key-path=client_key.pem \
     --output-file=cred.json
+
+# Authenticate gcloud with the credentials configuration file
+gcloud auth login --cred-file=cred.json
+
+# Test the authentication by listing the project details
+gcloud auth list
+gcloud projects describe dom-lab
+gcloud projects get-iam-policy dom-lab \
+    --flatten="bindings[].members" \
+    --format="table(bindings.role, bindings.members)"
+
+# Then, switch back to your original account
+gcloud config set account adminslawek@gcp-lab.koszewscy.waw.pl
+
+# and again switch back to the service account using the credentials configuration file
+gcloud config set account sa-test@dom-lab.iam.gserviceaccount.com