Token lifetime for longer running jobs when using Direct Workload Identity Federation

Hello,

I am trying to setup some CI jobs that will run Terraform commands with Terraform configured to use a Google Cloud Storage bucket (docs) to store its state and do its locking.

Due to the nature of Terraform operations, a 10 (or 5[^1]) minutes TTL for the authentication token feels short. I don't see how this TTL can be raised. What's my next best option?

Documents I have been through:

• README.md;
• SECURITY_CONSIDERATIONS.md;
• EXAMPLES.md:
  • In particular "Generating an OAuth 2.0 Access Token" which mentions a lifetime of up to 12 hours, but my understanding from #432 (see below) is that this gets cut back to 5 minutes on GitHub.
• https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers;
• https://cloud.google.com/storage/docs/access-control/iam-reference;
• Previous issues:
  • #474;
  • #432[^2];

[^1]: This is still unclear to me tbh: if I understand correctly it's 5 minutes when using Workload Identity Federation through a Service Account and 10 minutes when using Direct Workload Identity Federation.
[^2]: This comment in particular.

Start by reviewing README.md, docs/SECURITY_CONSIDERATIONS.md, docs/EXAMPLES.md, and the linked discussions in issues #474 and #432. The issue currently asks for guidance on token lifetimes and alternatives for long-running Terraform jobs rather than naming a scoped code or documentation change; a maintainer decision would be needed before defining what done means.