The provider is the object that does the work. It declares where tokens come from, how to validate them, how to map their claims onto attributes GCP understands, and which specific identities are allowed through, with one provider per external identity system [11]. The pool above it is a named container that groups those configurations and on its own does nothing [12]. Three objects, none of them useful alone [13], makes a poor demo and a decent audit surface.
The fourth of the provider's jobs is the one that gets left blank. The InfoQ author calls attribute conditions the critical security gate, and says that without them any identity from a trusted provider can authenticate, which is too broad for production [5]. The failure mode is quiet. Tokens validate and jobs run, so the pipeline goes green. What you have declared is trust in a provider's entire population rather than in one workload, and the field that would have narrowed it was left empty.
Then the rate. Zero to 120 or more projects in six months [7] averages at least twenty a month [21]. For that number to transfer, three things have to hold in your estate: project creation runs through a template you control, your external identity systems are few enough that one provider each is a small fixed cost [11], and most of your key inventory sits in projects that do not exist yet. If it sits instead in projects created three years ago, a creation-time mandate does not shrink the count. It stops the count growing, which is what the author describes when legacy no-expiry keys are treated as a fixed, shrinking problem rather than a risky migration [6].
The comparison that actually justifies the ceremony is the rotation loop, not key-versus-token. Every expiry means generating a new key for the same service account, then finding every system and team using the old one and distributing the new one [14]. The author's observation is that this overhead is heavy enough that many teams skip expiry and leave keys open-ended, which is worse [15]. Meanwhile the key is sitting in secret stores, environment variables, and occasionally version control [16]. Under federation the exchange leaves nothing behind: the job runs and the token expires, so nothing is stored and nothing needs rotating [10].
One divergence is worth flagging before you copy the pattern. The author chose impersonation over the direct access that Google recommends as the default [18], and also flags a scoping mistake in multi-org Harness setups [19]. The reasoning for both sits in the part of the article past where the supplied text ends, which also cuts off before the third object, the service account binding, is described [22]. Read that section before you write your own Terraform module.
