Workload Identity Federation is a combination of secure steps allowing GitHub Actions to impersonate the service account and perform all the actions against the Google Cloud Platform. The best part is that it's simpler to use than service account keys (after implementing the Workload Identity Federation part). Workload Identity Federation requires a bit of more upfront configuration, but it's worth the effort. Essentially, you configure the resources on the Google Cloud Platform side and the actions on GitHub. The rest of the process is transparent to a user since the exchange of keys happens in the background.