title: Impersonate Azure Service Principal from a Google Service Account
body: <p>I'd like to obtain temporary credentials for an Azure Service Principal (SP) using a Google Service Account JWT token. This is needed for calling Azure APIs from a GKE workload, without having to store long-term SP credentials in GKE.</p>
  <p>Is such federation possible for GCP -&gt; Azure (I know it is for Azure -&gt; GCP, based on [1], as well as GCP -&gt; AWS [2]), and how to achieve it?</p>
  <p>[1] <a href="https://cloud.google.com/iam/docs/workload-identity-federation" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/workload-identity-federation</a></p>
  <p>[2] <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html</a></p>