GCP KMS doesn't work with Workload Identity Federation

[a-zen]

Hi,

fnox currently has an issue if you use it with GCP Workload Identity Federation (WIF):

[//terraform:plan] $ fnox exec -- terraform plan -no-color -out tfplan.out -var-file=envs/${ENV:-stg}/variables.tfvars -lock=false
2026-07-23T11:45:16.898929Z ERROR fnox_core::secret_resolver: Error resolving secret 'MY_SECRET': GCP KMS: authentication failed: unsupported account external_account
Error: fnox::provider::auth_failed (https://fnox.jdx.dev/providers/gcp-kms)

  × GCP KMS: authentication failed: unsupported account external_account
  help: Run 'gcloud auth application-default login' or set
        GOOGLE_APPLICATION_CREDENTIALS

[//terraform:plan] ERROR task failed

It seems that the google-cloud-kms library has support for that but it's behind a feature gate.

So is it as simple as this:

google-cloud-kms = { version = "0.6", features = ["external-account"] }

?

[a-zen]

I just tested it locally compiling with that flag and I'm getting the same error.