@@ -149,9 +149,8 @@ default, this action does not generate any tokens.
149
149
token, in seconds. This must be specified as the number of seconds with a
150
150
trailing "s" (e.g. 30s). The default value is 1 hour (3600s). The maximum
151
151
value is 1 hour, unless the
152
- [`constraints/iam.allowServiceAccountCredentialLifetimeExtension`
153
- organization policy][orgpolicy-creds-lifetime] is enabled, in which case the
154
- maximum value is 12 hours.
152
+ `constraints/iam.allowServiceAccountCredentialLifetimeExtension`
153
+ organization policy is enabled, in which case the maximum value is 12 hours.
155
154
156
155
- `access_token_scopes`: (Optional) List of OAuth 2.0 access scopes to be
157
156
included in the generated token. This is only valid when "token_format" is
@@ -164,8 +163,8 @@ default, this action does not generate any tokens.
164
163
- `access_token_subject`: (Optional) Email address of a user to impersonate
165
164
for [Domain-Wide Delegation][dwd]. Access tokens created for Domain-Wide
166
165
Delegation cannot have a lifetime beyond 1 hour, even if the
167
- [ `constraints/iam.allowServiceAccountCredentialLifetimeExtension`
168
- organization policy][orgpolicy-creds-lifetime] is enabled.
166
+ `constraints/iam.allowServiceAccountCredentialLifetimeExtension`
167
+ organization policy is enabled.
169
168
170
169
In order to support Domain-Wide Delegation via Workload Identity Federation,
171
170
you must grant the external identity ("principalSet")
0 commit comments