Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-08-07
Set Up Zero-Copy Data In with Google Cloud

Set Up Zero-Copy Data In with Google Cloud

Prerequisites

Task 1: Configure Google Cloud Workload Identity Federation

Before creating the zero-copy connection in Workday, you need to configure Google Cloud Workload Identity Federation so that the external identity can impersonate the Google Cloud service account used to access BigLake.
  1. In the Google Cloud console, create a Workload Identity Pool. Use a descriptive name, such as Prism BigLake pool.
  2. Add a provider to the pool.
  3. Select OIDC as the provider type.
    Don't select SAML or AWS.
  4. Enter the issuer URL for the identity provider.
  5. Configure the audience for the provider.
  6. Create or identify the Google Cloud service account that will access the BigLake catalog.
  7. Take note of the service account email address. You'll enter it as the
    Principal
     when you create the connection in Task 2.
  8. Grant the service account the required read access to the catalog and underlying data.
  9. Link the service account to the Workload Identity Pool provider by selecting
    Grant Access
     and configuring the required principal and attribute conditions.
  10. Download the client library config file associated with the service account with access to the Workload Identity Pool to obtain the connection values.
    1. Select the Workload Identity Pool and go to the
      Connection Service Accounts
       tab.
    2. Download the
      Client library config
       associated with the service account.
    3. Select the identity provider.
    4. Enter an OIDC ID token path. Example: /tmp/oidc-token.
    5. Select JSON as the format type.
    6. Download the configuration file.
  11. Record the
    audience
     and
    token_url
     values exactly as they appear in the downloaded configuration file. You’ll need these values when you create the connection in Workday.

Task 2: Create a Zero-Copy Connection to Google Cloud

You can access Google Cloud table metadata without copying data by creating a zero-copy connection from Workday to your Google Cloud Iceberg catalog.
  1. In Workday, access the Prism Data Catalog report.
  2. Select
    + Create
     >
    Connection
    .
  3. In the
    Create Connection
     wizard, under
    Zero Copy Connectors
    , select the
    Google Cloud
     tile.
  4. Enter the connection details:
    Field
    Description
    Name
    The connection name must be unique in the Data Catalog.
    Example:
    GoogleCloud_ZeroCopy_<first name><last initial>
    .
    Description
    (Optional) A brief description of the connection's purpose.
    Catalog URL
    The Google Cloud BigLake Iceberg REST catalog URL.
    In the Lakehouse Runtime Catalog, select the catalog that you created and copy the REST catalog URL property value exactly from the Catalog Detail page.
    Example:
    https://biglake.googleapis.com/iceberg/v1/restcatalog
    Catalog Name
    The GCS Warehouse Name configured for the BigLake catalog.
    In the Lakehouse Runtime Catalog, select the catalog that you created and copy the GCS warehouse property value exactly from the Catalog Detail page.
    Example:
    gs://some-warehouse
    Use Sandbox
    Select this option only when connecting to the applicable sandbox environment.
    Project ID
    The Google Cloud project ID that hosts the catalog.
    In the Lakehouse Runtime Catalog, select the catalog that you created and copy the project property value exactly from the Catalog Detail page.
    Authentication Type
    Select
    OAuth 2.0 with Token Exchange
    .
    Issuer
    The issuer URL configured on the OIDC Workload Identity Pool provider. The value must match the provider configuration exactly.
    Principal
    The Google Cloud service account principal used by the connection.
    Example: biglake-client@gcp-eng.iam.gserviceaccount.com
    Token Endpoint
    The
    token_url
     value from the downloaded client library config file downloaded for the above service account in task 1.
    Scopes
    Enter
    https://www.googleapis.com/auth/cloud-platform
    .
    This is the standard cloud-platform scope used for service account impersonation.
    Audience
    The
    audience
     value from the downloaded client library config file downloaded for the above service account in task 1.
  5. Save the connection but do not test it yet. Before you test the connection, complete the following steps.
  6. On the
    View Connection Details
     page that displays, select
    Certificate
     >
    Download
     >
    JWK
    .
  7. Update the Google Cloud workload identity provider with the JWK Certificate.
    1. In the Google Cloud console, edit the Workload Identity Pool provider you created in task 1.
      View JWK File
       shows all the existing JWK keys associated with the identity provider.
    2. Upload a new file containing all the existing keys you want to preserve and the new JWK key downloaded from the configured connection in Workday.
    3. Save your changes.
      In Workday, you can now test your connection and validate that it is successful.
  8. In Workday, on the
    View Connection Details
     page, select
    Test Connection
    .
    If the test fails, verify:
    • Catalog URL format.
    • Token endpoint URL.
    • Google Cloud project ID and service account principal values.
    • Workload Identity Pool provider audience value.
    • JWK certificate and Workload Identity configuration in Google Cloud.
    • Service account permissions for the catalog and underlying data.

Task 3: Create an External Catalog

An external catalog acts as a virtual window into your external data, allowing you to browse tables in real-time.
  1. Access the
    Data Catalog
     report.
  2. Select
    + Create
     >
    External Catalog
    .
  3. Enter the external catalog details:
    Field
    Description
    External Catalog Name
    Enter a name for your external catalog.
    Connection
    Select the connection you just created.
    Namespace
    The exact namespace where the Iceberg connector tables reside. This information is provided by Google Cloud.
    Example:
    enterprise.finance.procurement
    .
    Description
    (Optional) The description of the external catalog.
  4. Click
    Save
    .
  5. Wait for the
    Success
     notification that the External Catalog was created.
  6. Select
    Back to Data Catalog
    .
  7. Select
    External Catalog
    , and validate that schema sync is successful on your External Catalog.
After you save the External Catalog, Workday automatically runs a
Schema Sync
 to:
  • Read the metadata of Iceberg tables in the specified Google Cloud namespace.
  • Register those tables as
    External Tables
     in Workday.
  • Make table structures visible in the Data Catalog
    without moving or copying data
    .
The duration of this sync depends on the number and complexity of tables in the namespace.

Task 4: Explore and Validate External Tables

Explore the external tables registered from Google Cloud and perform basic schema validation inside Workday.
  1. Locate the Google Cloud external tables.
    1. Access the
      Data Catalog
       report.
    2. In the left-hand menu, select
      External Tables
      .
    3. Click on the
      Refresh
       button.
    4. In the
      External Tables
       view, confirm that all Iceberg tables from Google Cloud are listed under the schema/namespace you selected during external catalog creation.
  2. Inspect an external table.
    1. Right-click or double-click the table name to open
      View External Table Details
      .
    2. On the details page, review:
      • Column names
      • Data types
      • Any available column statistics
      • Sample data preview (if present)
  3. Verify that:
    • Data types (Example: Numeric vs. string) align with the definitions in the external system.
    • Values appear as expected.