Hi @echoing-match-29901 I am using pulumi cloud deployment feature. I have integrated pulumi with GCP using workload identity pool. I followed this documentation to setup OIDC and I am not using ESC - https://www.pulumi.com/docs/esc/guides/configuring-oidc/gcp/. I am trying to create an oauth token in GCP using pulumi for which pulumi preview runs fine but pulumi up gives below error. Any idea why this happening? Thanks!

Error creating Brand: Post "<https://iap.googleapis.com/v1/projects/prod-gcp-proj-org/brands?alt=json>": oauth2/google: unable to generate access token: Post "<https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/prod-gcp-sa-pulumi-deployer@prod-gcp-proj-org.iam.gserviceaccount.com:generateAccessToken>": oauth2/google: status code 400: {"error":"invalid_request","error_description":"Invalid value for \"audience\". This value should be the full resource name of the Identity Provider. See <https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token> for the list of possible formats."}

👋 What is the audience of your Workload Identity Pool?

pulumi cloud organization name as per the documentation

Thanks! How many subject claims do you have specified for your WIP? Is it possible there is only one for

preview

?

I have specified all 4 mentioned in the doc, along with that I have also added one till stack name. For example - pulumideployorgcontosoprojectcorestack:dev

well hm. can you run

pulumi up

locally without going through Pulumi Cloud Deployments and observe that working?

yes, that is workig

Error creating Brand

- are you actually creating a

gcp.iap.Brand

/

gcp.iap.OAuthBrand

in your Pulumi program? so then the audience issue is more to do with GCP's IAP service than Pulumi's? I'm running short on ideas here; feel free to DM me (I'm a Pulumi employee) the program or more details and I can see what else I can do