Transfer files from AEM to Google Cloud Storage using Workflow Identity Federation Authentication

Hi ​@akhilraj,

Worked through this pattern, here’s the full architecture.

The core challenge: AEMaaCS doesn’t natively issue an OIDC token that GCS Workload Identity Federation can consume directly. The correct flow is:

1. AEMaaCS OSGi scheduler obtains an Adobe IMS OAuth Server-to-Server access token (via Adobe Developer Console technical account credentials stored in AEM Cloud Service Secret config)
2. That IMS token is exchanged at GCS Security Token Service for a short-lived Google federated token
3. The federated token is used to call the GCS JSON API to upload files, no long-lived service account key needed

GCS side setup (one-time):

Create Workload Identity Pool

gcloud iam workload-identity-pools create aem-pool \

  --location="global" \

  --display-name="AEM Cloud Pool"

Add OIDC provider pointing to Adobe IMS

gcloud iam workload-identity-pools providers create-oidc aem-provider \

  --location="global" \

  --workload-identity-pool="aem-pool" \

  --issuer-uri="https://ims-na1.adobelogin.com" \

  --attribute-mapping="google.subject=assertion.sub"

Grant GCS access to federated identity

gcloud storage buckets add-iam-policy-binding gs://your-bucket \

  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUM/locations/global/workloadIdentityPools/aem-pool/*" \

  --role="roles/storage.objectCreator"

AEMaaCS OSGi scheduler:

@Component(service = Runnable.class, immediate = true)

@Designate(ocd = GcsTransferConfig.class)

public class GcsTransferScheduler implements Runnable {

    @Reference

    private GcsAuthService gcsAuthService; // your OSGi service

    public void run() {

        // 1. Get IMS token from AEM Cloud Secret config

        String imsToken = gcsAuthService.getImsAccessToken();

        // 2. Exchange at GCS STS for federated token

        String federatedToken = gcsAuthService.exchangeForGcsToken(imsToken);

        // 3. Upload via GCS JSON API using Bearer token

        gcsAuthService.uploadToGcs(federatedToken, filePath, bucketName);

    }

}

Store credentials securely in AEM Cloud Manager → Environments → Secret environment variables (client ID, client secret, IMS org ID), never hardcode or commit them.

Adobe IMS tokens have a 24hr TTL, implement token caching in your OSGi service and refresh before expiry. The GCS federated token from STS is short-lived (1hr default), so exchange per upload run, not per file.

Alternative if WIF complexity is a blocker: GCS also supports a service account JSON key stored as an AEM Cloud Secret, less ideal for security posture but simpler to implement initially, then migrate to WIF.

Our instance is AEM 6.5 LTS and using OIDC custom authentication.

The scheduler is in Author instance whihc wont use OIDC token. What approach we can use in this case