title: Making POST call outside of the GCP environment to create workload identity
body: <p>I need to access GCP resources outside of the GCP environment from AWS using a AWS lambda. So, I found this document [accessing GCP resources from AWS][1] which provides a way to access the GCP resources and asks to create a workload identity pool.</p>
  <p>I need to create a Workload identity pool in GCP using a REST API call. The REST API call has to run outside of the GCP environment, that is, in this case from the AWS environment. My GCP's IAM user doesn't have privileges to create a workload identity pool (due to org policy reasons). But, I've a service account which has admin privileges to create a workload identity pool and all the required permissions to access the required resources once the pool is created.</p>
  <p>I'm a newbie to GCP and figuring out ways of calling a POST REST API call using my service account credentials. Any help is much appreciated.</p>
  <p><strong>Edited</strong>
  Pasting the sample code I've been trying to make the REST call.</p>
  <pre><code>const {google} = require('googleapis');
  const util = require('util');
  const https = require('https');
  const aws4 = require('aws4');
  
  const auth = new google.auth.GoogleAuth({
      keyFile: 'serviceAccountCreds.json',
      scopes: ['https://www.googleapis.com/auth/cloud-platform'],
    });
  
  async function createSignedRequestParams(jsonBodyParams) {
  
      const getAccessToken = await auth.getAccessToken();
      console.log(`createSignedRequestParams() - this.credentials:${getAccessToken !== null}`);
  
      // Set up the request params object that we'll sign
      const requestParams = {
          path: '/v1beta/projects/serviceAccountdev/locations/global/workloadIdentityPools?workloadIdentityPoolId=12345',
          method: 'POST',
          host: 'iam.googleapis.com',
          headers: { 'Content-Type': 'application/json' },
          body: jsonBodyParams
      };
      console.log(`createSignedRequestParams() - (signed) requestParams:${util.inspect(requestParams)}`);
  
      return requestParams;
  }
  
  const jsonBodyParams = {
      &quot;description&quot;: &quot;createWorkloadIdentityPool&quot;,
      &quot;display-name&quot;: &quot;devAccount&quot;
    };
  
  async function request(requestParams, jsonBodyParams) {
      console.log(`request() requestParams:${util.inspect(requestParams)} jsonBodyParams:${jsonBodyParams}`);
  
      // return new pending promise
      return new Promise((resolve, reject) =&gt; {
          const req = https.request(requestParams);
          if (['POST', 'PATCH', 'PUT'].includes(requestParams.method)) {
              req.write(jsonBodyParams);
          }
          req.end();
  
          // Stream handlers for the request
          req.on('error', (err) =&gt; {
              console.log(`request() req.on('error') err:${util.inspect(err)}`);
              return reject(err);
          });
  
          req.on('response', (res) =&gt; {
  
              let dataJson = '';
  
              res.on('data', chunk =&gt; {
                  dataJson += chunk;
              });
  
              res.on('end', () =&gt; {
                  const statusCode = res.statusCode;
                  const statusMessage = res.statusMessage;
                  const data = JSON.parse(dataJson);
                  console.log(`request() res.on('end')`, { statusCode, statusMessage, data });
                  resolve({ statusMessage, statusCode, data });
              });
          });
      });
  }
  
  async function postTheRequest(reqParams, jsonBodyParams) {
      try {
          const response = await request(reqParams, jsonBodyParams);
  
          return response;
      } catch (error) {
          console.log(error);
      }
  }
  
  reqParams = createSignedRequestParams(jsonBodyParams);
  postTheRequest(reqParams, jsonBodyParams);
  
  </code></pre>
  <p>output of the above code</p>
  <pre><code>
  [Running] node &quot;c:\Users\av250044\.aws\GCP_Code_examples\registerTheWorkloadIdentifier.js&quot;
  request() requestParams:Promise { &lt;pending&gt; } jsonBodyParams:[object Object]
  
  request() req.on('error') err:{ Error: connect ECONNREFUSED 127.0.0.1:443
      at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1106:14)
    errno: 'ECONNREFUSED',
    code: 'ECONNREFUSED',
    syscall: 'connect',
    address: '127.0.0.1',
    port: 443 }
  { Error: connect ECONNREFUSED 127.0.0.1:443
      at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1106:14)
    errno: 'ECONNREFUSED',
    code: 'ECONNREFUSED',
    syscall: 'connect',
    address: '127.0.0.1',
    port: 443 }
  
  </code></pre>
  <p>Wondering if I'm passing the PATH and host are correct. Please let me know your thoughts on my code sample.
  [1]: <a href="https://cloud.google.com/iam/docs/access-resources-aws#iam-workload-pools-add-aws-rest" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/access-resources-aws#iam-workload-pools-add-aws-rest</a></p>