> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/gcp-identities/workload-providers.md).

# Workload Providers

The **Workload Providers** page provides a list of enumerated Workload Identity Pool Providers in GCP. Workload Providers define how external (non-human, e.g., OIDC or AWS) workload identities federate into a Workload Identity Pool.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-d09f1bee87803963168faf8830cd219f63a53cd5%2FGCPWorkloadProviderListPage.png?alt=media" alt=""><figcaption><p>Workload Providers</p></figcaption></figure>

### Workload Providers Details

The Details page includes the **`Details`**, **`Attribute Condition`**, and **`Attribute Mapping`** tabs, and a **`Graph »`** button for enhanced navigation and analysis. A badge (e.g., **OIDC**) indicates the provider type.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the **`Graph »`** button on the upper right side.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-974ac08267c8a8f8c7b0d16f0590fbf31b944daf%2FGCPWorkloadProviderDetailPage.png?alt=media" alt=""><figcaption><p>GCP Workload Provider Details</p></figcaption></figure>

The Details tab contains attributes about the GCP Workload Provider. The page also includes an **Issues** panel that lists any security findings related to the provider, along with a Risk score and Exposure Point.

### Information

| Attribute         | Description                                                                                                                                                     |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Display Name      | The human-readable name of the provider (e.g., `custom-issuer-provider`).                                                                                       |
| Name              | The full resource path of the provider (e.g., `projects/627426666292/locations/global/workloadIdentityPools/vulnerable-pool/providers/custom-issuer-provider`). |
| OIDC Provider     | Indicates the provider uses OIDC federation.                                                                                                                    |
| State             | The lifecycle state of the provider (e.g., `ACTIVE`).                                                                                                           |
| Description       | A free-text description of the provider.                                                                                                                        |
| Disabled          | Indicates whether the provider is currently disabled.                                                                                                           |
| Issuer URI        | The URI of the external OIDC issuer (e.g., `https://my-internal-idp.company.com`).                                                                              |
| Allowed Audiences | The list of audiences accepted from the external issuer, if restricted.                                                                                         |

### **Attribute Condition**

Displays the CEL condition used to restrict which external identities may federate through the provider.

### **Attribute Mapping**

Displays the mapping between external identity attributes and Google Cloud attributes.

### **Issues**

Lists security findings associated with the provider (e.g., *Workload Identity Pool Provider Has No Attribute Condition*), each tagged with relevant categories such as Least Privilege or Credential Security, and a severity rating (e.g., High).