2.1.4. Cloud Asset Inventory, Gemini Cloud Assist, and Workforce Identity Federation
💡 First Principle: As an environment grows past a handful of projects, "what resources do we actually have, and are they configured safely" stops being answerable by memory or spreadsheets — it requires tooling built specifically to inventory and reason about resource state at scale.
Cloud Asset Inventory maintains a searchable, historical record of every resource across your organization — what exists now, what existed at any point in the past five weeks, and how a resource's configuration or IAM policy has changed over time, which makes it the tool of choice for both security audits and incident forensics. Gemini Cloud Assist builds on top of that inventory data, using AI to analyze resource configurations and proactively surface recommendations — flagging overly permissive IAM bindings, cost-saving opportunities, or misconfigurations a human reviewer might take hours to find manually.
Workforce Identity Federation solves a different problem: letting an external identity provider (an existing corporate SSO system, for a workforce that isn't itself managed by Cloud Identity or Google Workspace) authenticate directly to Google Cloud, without requiring every employee to also hold a separate Google-managed identity. It's the workforce-facing counterpart to Workload Identity Federation (covered later in Phase 5), which solves the equivalent problem for applications rather than people.
⚠️ Exam Trap: Don't confuse Workforce Identity Federation (external human users authenticating to Google Cloud via an existing corporate identity provider) with Workload Identity Federation (external applications or workloads authenticating without a downloaded service account key) — the exam uses the near-identical names deliberately to test whether you're distinguishing "who" from "what."
Reflection Question: A company already runs a mature Okta-based SSO system for all employees and doesn't want to duplicate that identity management inside Cloud Identity. Which feature lets employees authenticate to Google Cloud using their existing Okta credentials directly?
