I’m asking some theoretic question here:
Let’s assume i have an ai application that’s using Vertex AI (GCP). I want it to work only with the dedicated service account i’ve created for it. Now, i need to trigger this app from another cloud (AWS). The default solution is to create a service account key, store it somewhere in the AWS machine that will trigger the app and point the credentials parameter to look at that key file.
But i understand that there’s another option: i can use the Workload Identity Federation, which will allow me to create a role in AWS, create the trust between the federation and the role, in trigger the app using that role on AWS without using the key.

Did i understand the concept correctly? Am i missing something in the key concepts?