iam

package
v6.64.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2023 License: Apache-2.0 Imports: 7 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessBoundaryPolicy added in v6.49.0 

type AccessBoundaryPolicy struct {
	pulumi.CustomResourceState

	// The display name of the rule.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The hash of the resource. Used internally during updates.
	Etag pulumi.StringOutput `pulumi:"etag"`
	// The name of the policy.
	Name pulumi.StringOutput `pulumi:"name"`
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringOutput `pulumi:"parent"`
	// Rules to be applied.
	// Structure is documented below.
	Rules AccessBoundaryPolicyRuleArrayOutput `pulumi:"rules"`
}

Represents a collection of access boundary policies to apply to a given resource. **NOTE**: This is a private feature and users should contact GCP support if they would like to test it.

## Example Usage

## Import

AccessBoundaryPolicy can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/accessBoundaryPolicy:AccessBoundaryPolicy default {{parent}}/{{name}}

```

func GetAccessBoundaryPolicy added in v6.49.0 

func GetAccessBoundaryPolicy(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *AccessBoundaryPolicyState, opts ...pulumi.ResourceOption) (*AccessBoundaryPolicy, error)

GetAccessBoundaryPolicy gets an existing AccessBoundaryPolicy resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewAccessBoundaryPolicy added in v6.49.0 

func NewAccessBoundaryPolicy(ctx *pulumi.Context,
	name string, args *AccessBoundaryPolicyArgs, opts ...pulumi.ResourceOption) (*AccessBoundaryPolicy, error)

NewAccessBoundaryPolicy registers a new resource with the given unique name, arguments, and options.

func (*AccessBoundaryPolicy) ElementType added in v6.49.0 

func (*AccessBoundaryPolicy) ElementType() reflect.Type

func (*AccessBoundaryPolicy) ToAccessBoundaryPolicyOutput added in v6.49.0 

func (i *AccessBoundaryPolicy) ToAccessBoundaryPolicyOutput() AccessBoundaryPolicyOutput

func (*AccessBoundaryPolicy) ToAccessBoundaryPolicyOutputWithContext added in v6.49.0 

func (i *AccessBoundaryPolicy) ToAccessBoundaryPolicyOutputWithContext(ctx context.Context) AccessBoundaryPolicyOutput

type AccessBoundaryPolicyArgs added in v6.49.0 

type AccessBoundaryPolicyArgs struct {
	// The display name of the rule.
	DisplayName pulumi.StringPtrInput
	// The name of the policy.
	Name pulumi.StringPtrInput
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringInput
	// Rules to be applied.
	// Structure is documented below.
	Rules AccessBoundaryPolicyRuleArrayInput
}

The set of arguments for constructing a AccessBoundaryPolicy resource.

func (AccessBoundaryPolicyArgs) ElementType added in v6.49.0 

func (AccessBoundaryPolicyArgs) ElementType() reflect.Type

type AccessBoundaryPolicyArray added in v6.49.0 

type AccessBoundaryPolicyArray []AccessBoundaryPolicyInput

func (AccessBoundaryPolicyArray) ElementType added in v6.49.0 

func (AccessBoundaryPolicyArray) ElementType() reflect.Type

func (AccessBoundaryPolicyArray) ToAccessBoundaryPolicyArrayOutput added in v6.49.0 

func (i AccessBoundaryPolicyArray) ToAccessBoundaryPolicyArrayOutput() AccessBoundaryPolicyArrayOutput

func (AccessBoundaryPolicyArray) ToAccessBoundaryPolicyArrayOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyArray) ToAccessBoundaryPolicyArrayOutputWithContext(ctx context.Context) AccessBoundaryPolicyArrayOutput

type AccessBoundaryPolicyArrayInput added in v6.49.0 

type AccessBoundaryPolicyArrayInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyArrayOutput() AccessBoundaryPolicyArrayOutput
	ToAccessBoundaryPolicyArrayOutputWithContext(context.Context) AccessBoundaryPolicyArrayOutput
}

AccessBoundaryPolicyArrayInput is an input type that accepts AccessBoundaryPolicyArray and AccessBoundaryPolicyArrayOutput values. You can construct a concrete instance of `AccessBoundaryPolicyArrayInput` via: 

AccessBoundaryPolicyArray{ AccessBoundaryPolicyArgs{...} }

type AccessBoundaryPolicyArrayOutput added in v6.49.0 

type AccessBoundaryPolicyArrayOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyArrayOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyArrayOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyArrayOutput) Index added in v6.49.0 

func (o AccessBoundaryPolicyArrayOutput) Index(i pulumi.IntInput) AccessBoundaryPolicyOutput

func (AccessBoundaryPolicyArrayOutput) ToAccessBoundaryPolicyArrayOutput added in v6.49.0 

func (o AccessBoundaryPolicyArrayOutput) ToAccessBoundaryPolicyArrayOutput() AccessBoundaryPolicyArrayOutput

func (AccessBoundaryPolicyArrayOutput) ToAccessBoundaryPolicyArrayOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyArrayOutput) ToAccessBoundaryPolicyArrayOutputWithContext(ctx context.Context) AccessBoundaryPolicyArrayOutput

type AccessBoundaryPolicyInput added in v6.49.0 

type AccessBoundaryPolicyInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyOutput() AccessBoundaryPolicyOutput
	ToAccessBoundaryPolicyOutputWithContext(ctx context.Context) AccessBoundaryPolicyOutput
}

type AccessBoundaryPolicyMap added in v6.49.0 

type AccessBoundaryPolicyMap map[string]AccessBoundaryPolicyInput

func (AccessBoundaryPolicyMap) ElementType added in v6.49.0 

func (AccessBoundaryPolicyMap) ElementType() reflect.Type

func (AccessBoundaryPolicyMap) ToAccessBoundaryPolicyMapOutput added in v6.49.0 

func (i AccessBoundaryPolicyMap) ToAccessBoundaryPolicyMapOutput() AccessBoundaryPolicyMapOutput

func (AccessBoundaryPolicyMap) ToAccessBoundaryPolicyMapOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyMap) ToAccessBoundaryPolicyMapOutputWithContext(ctx context.Context) AccessBoundaryPolicyMapOutput

type AccessBoundaryPolicyMapInput added in v6.49.0 

type AccessBoundaryPolicyMapInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyMapOutput() AccessBoundaryPolicyMapOutput
	ToAccessBoundaryPolicyMapOutputWithContext(context.Context) AccessBoundaryPolicyMapOutput
}

AccessBoundaryPolicyMapInput is an input type that accepts AccessBoundaryPolicyMap and AccessBoundaryPolicyMapOutput values. You can construct a concrete instance of `AccessBoundaryPolicyMapInput` via: 

AccessBoundaryPolicyMap{ "key": AccessBoundaryPolicyArgs{...} }

type AccessBoundaryPolicyMapOutput added in v6.49.0 

type AccessBoundaryPolicyMapOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyMapOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyMapOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyMapOutput) MapIndex added in v6.49.0 

func (o AccessBoundaryPolicyMapOutput) MapIndex(k pulumi.StringInput) AccessBoundaryPolicyOutput

func (AccessBoundaryPolicyMapOutput) ToAccessBoundaryPolicyMapOutput added in v6.49.0 

func (o AccessBoundaryPolicyMapOutput) ToAccessBoundaryPolicyMapOutput() AccessBoundaryPolicyMapOutput

func (AccessBoundaryPolicyMapOutput) ToAccessBoundaryPolicyMapOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyMapOutput) ToAccessBoundaryPolicyMapOutputWithContext(ctx context.Context) AccessBoundaryPolicyMapOutput

type AccessBoundaryPolicyOutput added in v6.49.0 

type AccessBoundaryPolicyOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyOutput) DisplayName added in v6.49.0 

func (o AccessBoundaryPolicyOutput) DisplayName() pulumi.StringPtrOutput

The display name of the rule.

func (AccessBoundaryPolicyOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyOutput) Etag added in v6.49.0 

func (o AccessBoundaryPolicyOutput) Etag() pulumi.StringOutput

The hash of the resource. Used internally during updates.

func (AccessBoundaryPolicyOutput) Name added in v6.49.0 

func (o AccessBoundaryPolicyOutput) Name() pulumi.StringOutput

The name of the policy.

func (AccessBoundaryPolicyOutput) Parent added in v6.49.0 

func (o AccessBoundaryPolicyOutput) Parent() pulumi.StringOutput

The attachment point is identified by its URL-encoded full resource name.

func (AccessBoundaryPolicyOutput) Rules added in v6.49.0 

func (o AccessBoundaryPolicyOutput) Rules() AccessBoundaryPolicyRuleArrayOutput

Rules to be applied. Structure is documented below.

func (AccessBoundaryPolicyOutput) ToAccessBoundaryPolicyOutput added in v6.49.0 

func (o AccessBoundaryPolicyOutput) ToAccessBoundaryPolicyOutput() AccessBoundaryPolicyOutput

func (AccessBoundaryPolicyOutput) ToAccessBoundaryPolicyOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyOutput) ToAccessBoundaryPolicyOutputWithContext(ctx context.Context) AccessBoundaryPolicyOutput

type AccessBoundaryPolicyRule added in v6.49.0 

type AccessBoundaryPolicyRule struct {
	// An access boundary rule in an IAM policy.
	// Structure is documented below.
	AccessBoundaryRule *AccessBoundaryPolicyRuleAccessBoundaryRule `pulumi:"accessBoundaryRule"`
	// The description of the rule.
	Description *string `pulumi:"description"`
}

type AccessBoundaryPolicyRuleAccessBoundaryRule added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRule struct {
	// The availability condition further constrains the access allowed by the access boundary rule.
	// Structure is documented below.
	AvailabilityCondition *AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityCondition `pulumi:"availabilityCondition"`
	// A list of permissions that may be allowed for use on the specified resource.
	AvailablePermissions []string `pulumi:"availablePermissions"`
	// The full resource name of a Google Cloud resource entity.
	AvailableResource *string `pulumi:"availableResource"`
}

type AccessBoundaryPolicyRuleAccessBoundaryRuleArgs added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleArgs struct {
	// The availability condition further constrains the access allowed by the access boundary rule.
	// Structure is documented below.
	AvailabilityCondition AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput `pulumi:"availabilityCondition"`
	// A list of permissions that may be allowed for use on the specified resource.
	AvailablePermissions pulumi.StringArrayInput `pulumi:"availablePermissions"`
	// The full resource name of a Google Cloud resource entity.
	AvailableResource pulumi.StringPtrInput `pulumi:"availableResource"`
}

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityCondition added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityCondition struct {
	// Description of the expression. This is a longer text which describes the expression,
	// e.g. when hovered over it in a UI.
	Description *string `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression string `pulumi:"expression"`
	// String indicating the location of the expression for error reporting,
	// e.g. a file name and a position in the file.
	//
	// ***
	Location *string `pulumi:"location"`
	// Title for the expression, i.e. a short string describing its purpose.
	// This can be used e.g. in UIs which allow to enter the expression.
	Title *string `pulumi:"title"`
}

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs struct {
	// Description of the expression. This is a longer text which describes the expression,
	// e.g. when hovered over it in a UI.
	Description pulumi.StringPtrInput `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression pulumi.StringInput `pulumi:"expression"`
	// String indicating the location of the expression for error reporting,
	// e.g. a file name and a position in the file.
	//
	// ***
	Location pulumi.StringPtrInput `pulumi:"location"`
	// Title for the expression, i.e. a short string describing its purpose.
	// This can be used e.g. in UIs which allow to enter the expression.
	Title pulumi.StringPtrInput `pulumi:"title"`
}

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionInput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput
	ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutputWithContext(context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput
}

AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionInput is an input type that accepts AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs and AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionInput` via: 

AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs{...}

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Description added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Description() pulumi.StringPtrOutput

Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Expression added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Expression() pulumi.StringOutput

Textual representation of an expression in Common Expression Language syntax.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Location added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Location() pulumi.StringPtrOutput

String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

***

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Title added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) Title() pulumi.StringPtrOutput

Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput
	ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext(context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput
}

AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput is an input type that accepts AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs, AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtr and AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput` via: 

        AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs{...}

or:

        nil

func AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtr added in v6.49.0 

func AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtr(v *AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrInput

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Description added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Description() pulumi.StringPtrOutput

Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Elem added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Elem() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Expression added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Expression() pulumi.StringPtrOutput

Textual representation of an expression in Common Expression Language syntax.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Location added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Location() pulumi.StringPtrOutput

String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

***

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Title added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) Title() pulumi.StringPtrOutput

Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

type AccessBoundaryPolicyRuleAccessBoundaryRuleInput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleOutput
	ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutputWithContext(context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleOutput
}

AccessBoundaryPolicyRuleAccessBoundaryRuleInput is an input type that accepts AccessBoundaryPolicyRuleAccessBoundaryRuleArgs and AccessBoundaryPolicyRuleAccessBoundaryRuleOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleAccessBoundaryRuleInput` via: 

AccessBoundaryPolicyRuleAccessBoundaryRuleArgs{...}

type AccessBoundaryPolicyRuleAccessBoundaryRuleOutput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRuleOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailabilityCondition added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailabilityCondition() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

The availability condition further constrains the access allowed by the access boundary rule. Structure is documented below.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailablePermissions added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailablePermissions() pulumi.StringArrayOutput

A list of permissions that may be allowed for use on the specified resource.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailableResource added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) AvailableResource() pulumi.StringPtrOutput

The full resource name of a Google Cloud resource entity.

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutput() AccessBoundaryPolicyRuleAccessBoundaryRuleOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRuleOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRuleOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRuleOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

type AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput
	ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext(context.Context) AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput
}

AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput is an input type that accepts AccessBoundaryPolicyRuleAccessBoundaryRuleArgs, AccessBoundaryPolicyRuleAccessBoundaryRulePtr and AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput` via: 

        AccessBoundaryPolicyRuleAccessBoundaryRuleArgs{...}

or:

        nil

func AccessBoundaryPolicyRuleAccessBoundaryRulePtr added in v6.49.0 

func AccessBoundaryPolicyRuleAccessBoundaryRulePtr(v *AccessBoundaryPolicyRuleAccessBoundaryRuleArgs) AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput

type AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput added in v6.49.0 

type AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailabilityCondition added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailabilityCondition() AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionPtrOutput

The availability condition further constrains the access allowed by the access boundary rule. Structure is documented below.

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailablePermissions added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailablePermissions() pulumi.StringArrayOutput

A list of permissions that may be allowed for use on the specified resource.

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailableResource added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) AvailableResource() pulumi.StringPtrOutput

The full resource name of a Google Cloud resource entity.

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) Elem added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) Elem() AccessBoundaryPolicyRuleAccessBoundaryRuleOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput() AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

func (AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput) ToAccessBoundaryPolicyRuleAccessBoundaryRulePtrOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

type AccessBoundaryPolicyRuleArgs added in v6.49.0 

type AccessBoundaryPolicyRuleArgs struct {
	// An access boundary rule in an IAM policy.
	// Structure is documented below.
	AccessBoundaryRule AccessBoundaryPolicyRuleAccessBoundaryRulePtrInput `pulumi:"accessBoundaryRule"`
	// The description of the rule.
	Description pulumi.StringPtrInput `pulumi:"description"`
}

func (AccessBoundaryPolicyRuleArgs) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleArgs) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleArgs) ToAccessBoundaryPolicyRuleOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleArgs) ToAccessBoundaryPolicyRuleOutput() AccessBoundaryPolicyRuleOutput

func (AccessBoundaryPolicyRuleArgs) ToAccessBoundaryPolicyRuleOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleArgs) ToAccessBoundaryPolicyRuleOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleOutput

type AccessBoundaryPolicyRuleArray added in v6.49.0 

type AccessBoundaryPolicyRuleArray []AccessBoundaryPolicyRuleInput

func (AccessBoundaryPolicyRuleArray) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleArray) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleArray) ToAccessBoundaryPolicyRuleArrayOutput added in v6.49.0 

func (i AccessBoundaryPolicyRuleArray) ToAccessBoundaryPolicyRuleArrayOutput() AccessBoundaryPolicyRuleArrayOutput

func (AccessBoundaryPolicyRuleArray) ToAccessBoundaryPolicyRuleArrayOutputWithContext added in v6.49.0 

func (i AccessBoundaryPolicyRuleArray) ToAccessBoundaryPolicyRuleArrayOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleArrayOutput

type AccessBoundaryPolicyRuleArrayInput added in v6.49.0 

type AccessBoundaryPolicyRuleArrayInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleArrayOutput() AccessBoundaryPolicyRuleArrayOutput
	ToAccessBoundaryPolicyRuleArrayOutputWithContext(context.Context) AccessBoundaryPolicyRuleArrayOutput
}

AccessBoundaryPolicyRuleArrayInput is an input type that accepts AccessBoundaryPolicyRuleArray and AccessBoundaryPolicyRuleArrayOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleArrayInput` via: 

AccessBoundaryPolicyRuleArray{ AccessBoundaryPolicyRuleArgs{...} }

type AccessBoundaryPolicyRuleArrayOutput added in v6.49.0 

type AccessBoundaryPolicyRuleArrayOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleArrayOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleArrayOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleArrayOutput) Index added in v6.49.0 

func (o AccessBoundaryPolicyRuleArrayOutput) Index(i pulumi.IntInput) AccessBoundaryPolicyRuleOutput

func (AccessBoundaryPolicyRuleArrayOutput) ToAccessBoundaryPolicyRuleArrayOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleArrayOutput) ToAccessBoundaryPolicyRuleArrayOutput() AccessBoundaryPolicyRuleArrayOutput

func (AccessBoundaryPolicyRuleArrayOutput) ToAccessBoundaryPolicyRuleArrayOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleArrayOutput) ToAccessBoundaryPolicyRuleArrayOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleArrayOutput

type AccessBoundaryPolicyRuleInput added in v6.49.0 

type AccessBoundaryPolicyRuleInput interface {
	pulumi.Input

	ToAccessBoundaryPolicyRuleOutput() AccessBoundaryPolicyRuleOutput
	ToAccessBoundaryPolicyRuleOutputWithContext(context.Context) AccessBoundaryPolicyRuleOutput
}

AccessBoundaryPolicyRuleInput is an input type that accepts AccessBoundaryPolicyRuleArgs and AccessBoundaryPolicyRuleOutput values. You can construct a concrete instance of `AccessBoundaryPolicyRuleInput` via: 

AccessBoundaryPolicyRuleArgs{...}

type AccessBoundaryPolicyRuleOutput added in v6.49.0 

type AccessBoundaryPolicyRuleOutput struct{ *pulumi.OutputState }

func (AccessBoundaryPolicyRuleOutput) AccessBoundaryRule added in v6.49.0 

func (o AccessBoundaryPolicyRuleOutput) AccessBoundaryRule() AccessBoundaryPolicyRuleAccessBoundaryRulePtrOutput

An access boundary rule in an IAM policy. Structure is documented below.

func (AccessBoundaryPolicyRuleOutput) Description added in v6.49.0 

func (o AccessBoundaryPolicyRuleOutput) Description() pulumi.StringPtrOutput

The description of the rule.

func (AccessBoundaryPolicyRuleOutput) ElementType added in v6.49.0 

func (AccessBoundaryPolicyRuleOutput) ElementType() reflect.Type

func (AccessBoundaryPolicyRuleOutput) ToAccessBoundaryPolicyRuleOutput added in v6.49.0 

func (o AccessBoundaryPolicyRuleOutput) ToAccessBoundaryPolicyRuleOutput() AccessBoundaryPolicyRuleOutput

func (AccessBoundaryPolicyRuleOutput) ToAccessBoundaryPolicyRuleOutputWithContext added in v6.49.0 

func (o AccessBoundaryPolicyRuleOutput) ToAccessBoundaryPolicyRuleOutputWithContext(ctx context.Context) AccessBoundaryPolicyRuleOutput

type AccessBoundaryPolicyState added in v6.49.0 

type AccessBoundaryPolicyState struct {
	// The display name of the rule.
	DisplayName pulumi.StringPtrInput
	// The hash of the resource. Used internally during updates.
	Etag pulumi.StringPtrInput
	// The name of the policy.
	Name pulumi.StringPtrInput
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringPtrInput
	// Rules to be applied.
	// Structure is documented below.
	Rules AccessBoundaryPolicyRuleArrayInput
}

func (AccessBoundaryPolicyState) ElementType added in v6.49.0 

func (AccessBoundaryPolicyState) ElementType() reflect.Type

type DenyPolicy added in v6.19.0 

type DenyPolicy struct {
	pulumi.CustomResourceState

	// The display name of the rule.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The hash of the resource. Used internally during updates.
	Etag pulumi.StringOutput `pulumi:"etag"`
	// The name of the policy.
	Name pulumi.StringOutput `pulumi:"name"`
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringOutput `pulumi:"parent"`
	// Rules to be applied.
	// Structure is documented below.
	Rules DenyPolicyRuleArrayOutput `pulumi:"rules"`
}

## Example Usage

## Import

DenyPolicy can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/denyPolicy:DenyPolicy default {{parent}}/{{name}}

```

func GetDenyPolicy added in v6.19.0 

func GetDenyPolicy(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *DenyPolicyState, opts ...pulumi.ResourceOption) (*DenyPolicy, error)

GetDenyPolicy gets an existing DenyPolicy resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewDenyPolicy added in v6.19.0 

func NewDenyPolicy(ctx *pulumi.Context,
	name string, args *DenyPolicyArgs, opts ...pulumi.ResourceOption) (*DenyPolicy, error)

NewDenyPolicy registers a new resource with the given unique name, arguments, and options.

func (*DenyPolicy) ElementType added in v6.19.0 

func (*DenyPolicy) ElementType() reflect.Type

func (*DenyPolicy) ToDenyPolicyOutput added in v6.19.0 

func (i *DenyPolicy) ToDenyPolicyOutput() DenyPolicyOutput

func (*DenyPolicy) ToDenyPolicyOutputWithContext added in v6.19.0 

func (i *DenyPolicy) ToDenyPolicyOutputWithContext(ctx context.Context) DenyPolicyOutput

type DenyPolicyArgs added in v6.19.0 

type DenyPolicyArgs struct {
	// The display name of the rule.
	DisplayName pulumi.StringPtrInput
	// The name of the policy.
	Name pulumi.StringPtrInput
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringInput
	// Rules to be applied.
	// Structure is documented below.
	Rules DenyPolicyRuleArrayInput
}

The set of arguments for constructing a DenyPolicy resource.

func (DenyPolicyArgs) ElementType added in v6.19.0 

func (DenyPolicyArgs) ElementType() reflect.Type

type DenyPolicyArray added in v6.19.0 

type DenyPolicyArray []DenyPolicyInput

func (DenyPolicyArray) ElementType added in v6.19.0 

func (DenyPolicyArray) ElementType() reflect.Type

func (DenyPolicyArray) ToDenyPolicyArrayOutput added in v6.19.0 

func (i DenyPolicyArray) ToDenyPolicyArrayOutput() DenyPolicyArrayOutput

func (DenyPolicyArray) ToDenyPolicyArrayOutputWithContext added in v6.19.0 

func (i DenyPolicyArray) ToDenyPolicyArrayOutputWithContext(ctx context.Context) DenyPolicyArrayOutput

type DenyPolicyArrayInput added in v6.19.0 

type DenyPolicyArrayInput interface {
	pulumi.Input

	ToDenyPolicyArrayOutput() DenyPolicyArrayOutput
	ToDenyPolicyArrayOutputWithContext(context.Context) DenyPolicyArrayOutput
}

DenyPolicyArrayInput is an input type that accepts DenyPolicyArray and DenyPolicyArrayOutput values. You can construct a concrete instance of `DenyPolicyArrayInput` via: 

DenyPolicyArray{ DenyPolicyArgs{...} }

type DenyPolicyArrayOutput added in v6.19.0 

type DenyPolicyArrayOutput struct{ *pulumi.OutputState }

func (DenyPolicyArrayOutput) ElementType added in v6.19.0 

func (DenyPolicyArrayOutput) ElementType() reflect.Type

func (DenyPolicyArrayOutput) Index added in v6.19.0 

func (o DenyPolicyArrayOutput) Index(i pulumi.IntInput) DenyPolicyOutput

func (DenyPolicyArrayOutput) ToDenyPolicyArrayOutput added in v6.19.0 

func (o DenyPolicyArrayOutput) ToDenyPolicyArrayOutput() DenyPolicyArrayOutput

func (DenyPolicyArrayOutput) ToDenyPolicyArrayOutputWithContext added in v6.19.0 

func (o DenyPolicyArrayOutput) ToDenyPolicyArrayOutputWithContext(ctx context.Context) DenyPolicyArrayOutput

type DenyPolicyInput added in v6.19.0 

type DenyPolicyInput interface {
	pulumi.Input

	ToDenyPolicyOutput() DenyPolicyOutput
	ToDenyPolicyOutputWithContext(ctx context.Context) DenyPolicyOutput
}

type DenyPolicyMap added in v6.19.0 

type DenyPolicyMap map[string]DenyPolicyInput

func (DenyPolicyMap) ElementType added in v6.19.0 

func (DenyPolicyMap) ElementType() reflect.Type

func (DenyPolicyMap) ToDenyPolicyMapOutput added in v6.19.0 

func (i DenyPolicyMap) ToDenyPolicyMapOutput() DenyPolicyMapOutput

func (DenyPolicyMap) ToDenyPolicyMapOutputWithContext added in v6.19.0 

func (i DenyPolicyMap) ToDenyPolicyMapOutputWithContext(ctx context.Context) DenyPolicyMapOutput

type DenyPolicyMapInput added in v6.19.0 

type DenyPolicyMapInput interface {
	pulumi.Input

	ToDenyPolicyMapOutput() DenyPolicyMapOutput
	ToDenyPolicyMapOutputWithContext(context.Context) DenyPolicyMapOutput
}

DenyPolicyMapInput is an input type that accepts DenyPolicyMap and DenyPolicyMapOutput values. You can construct a concrete instance of `DenyPolicyMapInput` via: 

DenyPolicyMap{ "key": DenyPolicyArgs{...} }

type DenyPolicyMapOutput added in v6.19.0 

type DenyPolicyMapOutput struct{ *pulumi.OutputState }

func (DenyPolicyMapOutput) ElementType added in v6.19.0 

func (DenyPolicyMapOutput) ElementType() reflect.Type

func (DenyPolicyMapOutput) MapIndex added in v6.19.0 

func (o DenyPolicyMapOutput) MapIndex(k pulumi.StringInput) DenyPolicyOutput

func (DenyPolicyMapOutput) ToDenyPolicyMapOutput added in v6.19.0 

func (o DenyPolicyMapOutput) ToDenyPolicyMapOutput() DenyPolicyMapOutput

func (DenyPolicyMapOutput) ToDenyPolicyMapOutputWithContext added in v6.19.0 

func (o DenyPolicyMapOutput) ToDenyPolicyMapOutputWithContext(ctx context.Context) DenyPolicyMapOutput

type DenyPolicyOutput added in v6.19.0 

type DenyPolicyOutput struct{ *pulumi.OutputState }

func (DenyPolicyOutput) DisplayName added in v6.23.0 

func (o DenyPolicyOutput) DisplayName() pulumi.StringPtrOutput

The display name of the rule.

func (DenyPolicyOutput) ElementType added in v6.19.0 

func (DenyPolicyOutput) ElementType() reflect.Type

func (DenyPolicyOutput) Etag added in v6.23.0 

func (o DenyPolicyOutput) Etag() pulumi.StringOutput

The hash of the resource. Used internally during updates.

func (DenyPolicyOutput) Name added in v6.23.0 

func (o DenyPolicyOutput) Name() pulumi.StringOutput

The name of the policy.

func (DenyPolicyOutput) Parent added in v6.23.0 

func (o DenyPolicyOutput) Parent() pulumi.StringOutput

The attachment point is identified by its URL-encoded full resource name.

func (DenyPolicyOutput) Rules added in v6.23.0 

func (o DenyPolicyOutput) Rules() DenyPolicyRuleArrayOutput

Rules to be applied. Structure is documented below.

func (DenyPolicyOutput) ToDenyPolicyOutput added in v6.19.0 

func (o DenyPolicyOutput) ToDenyPolicyOutput() DenyPolicyOutput

func (DenyPolicyOutput) ToDenyPolicyOutputWithContext added in v6.19.0 

func (o DenyPolicyOutput) ToDenyPolicyOutputWithContext(ctx context.Context) DenyPolicyOutput

type DenyPolicyRule added in v6.19.0 

type DenyPolicyRule struct {
	// A deny rule in an IAM deny policy.
	// Structure is documented below.
	DenyRule *DenyPolicyRuleDenyRule `pulumi:"denyRule"`
	// The description of the rule.
	Description *string `pulumi:"description"`
}

type DenyPolicyRuleArgs added in v6.19.0 

type DenyPolicyRuleArgs struct {
	// A deny rule in an IAM deny policy.
	// Structure is documented below.
	DenyRule DenyPolicyRuleDenyRulePtrInput `pulumi:"denyRule"`
	// The description of the rule.
	Description pulumi.StringPtrInput `pulumi:"description"`
}

func (DenyPolicyRuleArgs) ElementType added in v6.19.0 

func (DenyPolicyRuleArgs) ElementType() reflect.Type

func (DenyPolicyRuleArgs) ToDenyPolicyRuleOutput added in v6.19.0 

func (i DenyPolicyRuleArgs) ToDenyPolicyRuleOutput() DenyPolicyRuleOutput

func (DenyPolicyRuleArgs) ToDenyPolicyRuleOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleArgs) ToDenyPolicyRuleOutputWithContext(ctx context.Context) DenyPolicyRuleOutput

type DenyPolicyRuleArray added in v6.19.0 

type DenyPolicyRuleArray []DenyPolicyRuleInput

func (DenyPolicyRuleArray) ElementType added in v6.19.0 

func (DenyPolicyRuleArray) ElementType() reflect.Type

func (DenyPolicyRuleArray) ToDenyPolicyRuleArrayOutput added in v6.19.0 

func (i DenyPolicyRuleArray) ToDenyPolicyRuleArrayOutput() DenyPolicyRuleArrayOutput

func (DenyPolicyRuleArray) ToDenyPolicyRuleArrayOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleArray) ToDenyPolicyRuleArrayOutputWithContext(ctx context.Context) DenyPolicyRuleArrayOutput

type DenyPolicyRuleArrayInput added in v6.19.0 

type DenyPolicyRuleArrayInput interface {
	pulumi.Input

	ToDenyPolicyRuleArrayOutput() DenyPolicyRuleArrayOutput
	ToDenyPolicyRuleArrayOutputWithContext(context.Context) DenyPolicyRuleArrayOutput
}

DenyPolicyRuleArrayInput is an input type that accepts DenyPolicyRuleArray and DenyPolicyRuleArrayOutput values. You can construct a concrete instance of `DenyPolicyRuleArrayInput` via: 

DenyPolicyRuleArray{ DenyPolicyRuleArgs{...} }

type DenyPolicyRuleArrayOutput added in v6.19.0 

type DenyPolicyRuleArrayOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleArrayOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleArrayOutput) ElementType() reflect.Type

func (DenyPolicyRuleArrayOutput) Index added in v6.19.0 

func (o DenyPolicyRuleArrayOutput) Index(i pulumi.IntInput) DenyPolicyRuleOutput

func (DenyPolicyRuleArrayOutput) ToDenyPolicyRuleArrayOutput added in v6.19.0 

func (o DenyPolicyRuleArrayOutput) ToDenyPolicyRuleArrayOutput() DenyPolicyRuleArrayOutput

func (DenyPolicyRuleArrayOutput) ToDenyPolicyRuleArrayOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleArrayOutput) ToDenyPolicyRuleArrayOutputWithContext(ctx context.Context) DenyPolicyRuleArrayOutput

type DenyPolicyRuleDenyRule added in v6.19.0 

type DenyPolicyRuleDenyRule struct {
	// User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
	// Structure is documented below.
	DenialCondition *DenyPolicyRuleDenyRuleDenialCondition `pulumi:"denialCondition"`
	// The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
	// where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
	DeniedPermissions []string `pulumi:"deniedPermissions"`
	// The identities that are prevented from using one or more permissions on Google Cloud resources.
	DeniedPrincipals []string `pulumi:"deniedPrincipals"`
	// Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
	// If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
	// The excluded permissions can be specified using the same syntax as deniedPermissions.
	ExceptionPermissions []string `pulumi:"exceptionPermissions"`
	// The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
	// For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
	ExceptionPrincipals []string `pulumi:"exceptionPrincipals"`
}

type DenyPolicyRuleDenyRuleArgs added in v6.19.0 

type DenyPolicyRuleDenyRuleArgs struct {
	// User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
	// Structure is documented below.
	DenialCondition DenyPolicyRuleDenyRuleDenialConditionPtrInput `pulumi:"denialCondition"`
	// The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
	// where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
	DeniedPermissions pulumi.StringArrayInput `pulumi:"deniedPermissions"`
	// The identities that are prevented from using one or more permissions on Google Cloud resources.
	DeniedPrincipals pulumi.StringArrayInput `pulumi:"deniedPrincipals"`
	// Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
	// If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
	// The excluded permissions can be specified using the same syntax as deniedPermissions.
	ExceptionPermissions pulumi.StringArrayInput `pulumi:"exceptionPermissions"`
	// The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
	// For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
	ExceptionPrincipals pulumi.StringArrayInput `pulumi:"exceptionPrincipals"`
}

func (DenyPolicyRuleDenyRuleArgs) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRuleArgs) ElementType() reflect.Type

func (DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRuleOutput added in v6.19.0 

func (i DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRuleOutput() DenyPolicyRuleDenyRuleOutput

func (DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRuleOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRuleOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleOutput

func (DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRulePtrOutput added in v6.19.0 

func (i DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRulePtrOutput() DenyPolicyRuleDenyRulePtrOutput

func (DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRulePtrOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleDenyRuleArgs) ToDenyPolicyRuleDenyRulePtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRulePtrOutput

type DenyPolicyRuleDenyRuleDenialCondition added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialCondition struct {
	// Description of the expression. This is a longer text which describes the expression,
	// e.g. when hovered over it in a UI.
	Description *string `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression string `pulumi:"expression"`
	// String indicating the location of the expression for error reporting,
	// e.g. a file name and a position in the file.
	//
	// ***
	Location *string `pulumi:"location"`
	// Title for the expression, i.e. a short string describing its purpose.
	// This can be used e.g. in UIs which allow to enter the expression.
	Title *string `pulumi:"title"`
}

type DenyPolicyRuleDenyRuleDenialConditionArgs added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialConditionArgs struct {
	// Description of the expression. This is a longer text which describes the expression,
	// e.g. when hovered over it in a UI.
	Description pulumi.StringPtrInput `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression pulumi.StringInput `pulumi:"expression"`
	// String indicating the location of the expression for error reporting,
	// e.g. a file name and a position in the file.
	//
	// ***
	Location pulumi.StringPtrInput `pulumi:"location"`
	// Title for the expression, i.e. a short string describing its purpose.
	// This can be used e.g. in UIs which allow to enter the expression.
	Title pulumi.StringPtrInput `pulumi:"title"`
}

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ElementType() reflect.Type

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionOutput added in v6.19.0 

func (i DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionOutput() DenyPolicyRuleDenyRuleDenialConditionOutput

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleDenialConditionOutput

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput added in v6.19.0 

func (i DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput() DenyPolicyRuleDenyRuleDenialConditionPtrOutput

func (DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext added in v6.19.0 

func (i DenyPolicyRuleDenyRuleDenialConditionArgs) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleDenialConditionPtrOutput

type DenyPolicyRuleDenyRuleDenialConditionInput added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialConditionInput interface {
	pulumi.Input

	ToDenyPolicyRuleDenyRuleDenialConditionOutput() DenyPolicyRuleDenyRuleDenialConditionOutput
	ToDenyPolicyRuleDenyRuleDenialConditionOutputWithContext(context.Context) DenyPolicyRuleDenyRuleDenialConditionOutput
}

DenyPolicyRuleDenyRuleDenialConditionInput is an input type that accepts DenyPolicyRuleDenyRuleDenialConditionArgs and DenyPolicyRuleDenyRuleDenialConditionOutput values. You can construct a concrete instance of `DenyPolicyRuleDenyRuleDenialConditionInput` via: 

DenyPolicyRuleDenyRuleDenialConditionArgs{...}

type DenyPolicyRuleDenyRuleDenialConditionOutput added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialConditionOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleDenyRuleDenialConditionOutput) Description added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) Description() pulumi.StringPtrOutput

Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ElementType() reflect.Type

func (DenyPolicyRuleDenyRuleDenialConditionOutput) Expression added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) Expression() pulumi.StringOutput

Textual representation of an expression in Common Expression Language syntax.

func (DenyPolicyRuleDenyRuleDenialConditionOutput) Location added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) Location() pulumi.StringPtrOutput

String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

***

func (DenyPolicyRuleDenyRuleDenialConditionOutput) Title added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) Title() pulumi.StringPtrOutput

Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionOutput() DenyPolicyRuleDenyRuleDenialConditionOutput

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleDenialConditionOutput

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput() DenyPolicyRuleDenyRuleDenialConditionPtrOutput

func (DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleDenialConditionPtrOutput

type DenyPolicyRuleDenyRuleDenialConditionPtrInput added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialConditionPtrInput interface {
	pulumi.Input

	ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput() DenyPolicyRuleDenyRuleDenialConditionPtrOutput
	ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext(context.Context) DenyPolicyRuleDenyRuleDenialConditionPtrOutput
}

DenyPolicyRuleDenyRuleDenialConditionPtrInput is an input type that accepts DenyPolicyRuleDenyRuleDenialConditionArgs, DenyPolicyRuleDenyRuleDenialConditionPtr and DenyPolicyRuleDenyRuleDenialConditionPtrOutput values. You can construct a concrete instance of `DenyPolicyRuleDenyRuleDenialConditionPtrInput` via: 

        DenyPolicyRuleDenyRuleDenialConditionArgs{...}

or:

        nil

func DenyPolicyRuleDenyRuleDenialConditionPtr added in v6.19.0 

func DenyPolicyRuleDenyRuleDenialConditionPtr(v *DenyPolicyRuleDenyRuleDenialConditionArgs) DenyPolicyRuleDenyRuleDenialConditionPtrInput

type DenyPolicyRuleDenyRuleDenialConditionPtrOutput added in v6.19.0 

type DenyPolicyRuleDenyRuleDenialConditionPtrOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Description added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Description() pulumi.StringPtrOutput

Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Elem added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Elem() DenyPolicyRuleDenyRuleDenialConditionOutput

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ElementType() reflect.Type

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Expression added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Expression() pulumi.StringPtrOutput

Textual representation of an expression in Common Expression Language syntax.

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Location added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Location() pulumi.StringPtrOutput

String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

***

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Title added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) Title() pulumi.StringPtrOutput

Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutput() DenyPolicyRuleDenyRuleDenialConditionPtrOutput

func (DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRuleDenialConditionPtrOutput) ToDenyPolicyRuleDenyRuleDenialConditionPtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleDenialConditionPtrOutput

type DenyPolicyRuleDenyRuleInput added in v6.19.0 

type DenyPolicyRuleDenyRuleInput interface {
	pulumi.Input

	ToDenyPolicyRuleDenyRuleOutput() DenyPolicyRuleDenyRuleOutput
	ToDenyPolicyRuleDenyRuleOutputWithContext(context.Context) DenyPolicyRuleDenyRuleOutput
}

DenyPolicyRuleDenyRuleInput is an input type that accepts DenyPolicyRuleDenyRuleArgs and DenyPolicyRuleDenyRuleOutput values. You can construct a concrete instance of `DenyPolicyRuleDenyRuleInput` via: 

DenyPolicyRuleDenyRuleArgs{...}

type DenyPolicyRuleDenyRuleOutput added in v6.19.0 

type DenyPolicyRuleDenyRuleOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleDenyRuleOutput) DenialCondition added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) DenialCondition() DenyPolicyRuleDenyRuleDenialConditionPtrOutput

User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Structure is documented below.

func (DenyPolicyRuleDenyRuleOutput) DeniedPermissions added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) DeniedPermissions() pulumi.StringArrayOutput

The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`, where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.

func (DenyPolicyRuleDenyRuleOutput) DeniedPrincipals added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) DeniedPrincipals() pulumi.StringArrayOutput

The identities that are prevented from using one or more permissions on Google Cloud resources.

func (DenyPolicyRuleDenyRuleOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRuleOutput) ElementType() reflect.Type

func (DenyPolicyRuleDenyRuleOutput) ExceptionPermissions added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ExceptionPermissions() pulumi.StringArrayOutput

Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions. If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied. The excluded permissions can be specified using the same syntax as deniedPermissions.

func (DenyPolicyRuleDenyRuleOutput) ExceptionPrincipals added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ExceptionPrincipals() pulumi.StringArrayOutput

The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals. For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.

func (DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRuleOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRuleOutput() DenyPolicyRuleDenyRuleOutput

func (DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRuleOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRuleOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRuleOutput

func (DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRulePtrOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRulePtrOutput() DenyPolicyRuleDenyRulePtrOutput

func (DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRulePtrOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRuleOutput) ToDenyPolicyRuleDenyRulePtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRulePtrOutput

type DenyPolicyRuleDenyRulePtrInput added in v6.19.0 

type DenyPolicyRuleDenyRulePtrInput interface {
	pulumi.Input

	ToDenyPolicyRuleDenyRulePtrOutput() DenyPolicyRuleDenyRulePtrOutput
	ToDenyPolicyRuleDenyRulePtrOutputWithContext(context.Context) DenyPolicyRuleDenyRulePtrOutput
}

DenyPolicyRuleDenyRulePtrInput is an input type that accepts DenyPolicyRuleDenyRuleArgs, DenyPolicyRuleDenyRulePtr and DenyPolicyRuleDenyRulePtrOutput values. You can construct a concrete instance of `DenyPolicyRuleDenyRulePtrInput` via: 

        DenyPolicyRuleDenyRuleArgs{...}

or:

        nil

func DenyPolicyRuleDenyRulePtr added in v6.19.0 

func DenyPolicyRuleDenyRulePtr(v *DenyPolicyRuleDenyRuleArgs) DenyPolicyRuleDenyRulePtrInput

type DenyPolicyRuleDenyRulePtrOutput added in v6.19.0 

type DenyPolicyRuleDenyRulePtrOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleDenyRulePtrOutput) DenialCondition added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) DenialCondition() DenyPolicyRuleDenyRuleDenialConditionPtrOutput

User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Structure is documented below.

func (DenyPolicyRuleDenyRulePtrOutput) DeniedPermissions added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) DeniedPermissions() pulumi.StringArrayOutput

The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`, where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.

func (DenyPolicyRuleDenyRulePtrOutput) DeniedPrincipals added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) DeniedPrincipals() pulumi.StringArrayOutput

The identities that are prevented from using one or more permissions on Google Cloud resources.

func (DenyPolicyRuleDenyRulePtrOutput) Elem added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) Elem() DenyPolicyRuleDenyRuleOutput

func (DenyPolicyRuleDenyRulePtrOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleDenyRulePtrOutput) ElementType() reflect.Type

func (DenyPolicyRuleDenyRulePtrOutput) ExceptionPermissions added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) ExceptionPermissions() pulumi.StringArrayOutput

Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions. If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied. The excluded permissions can be specified using the same syntax as deniedPermissions.

func (DenyPolicyRuleDenyRulePtrOutput) ExceptionPrincipals added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) ExceptionPrincipals() pulumi.StringArrayOutput

The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals. For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.

func (DenyPolicyRuleDenyRulePtrOutput) ToDenyPolicyRuleDenyRulePtrOutput added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) ToDenyPolicyRuleDenyRulePtrOutput() DenyPolicyRuleDenyRulePtrOutput

func (DenyPolicyRuleDenyRulePtrOutput) ToDenyPolicyRuleDenyRulePtrOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleDenyRulePtrOutput) ToDenyPolicyRuleDenyRulePtrOutputWithContext(ctx context.Context) DenyPolicyRuleDenyRulePtrOutput

type DenyPolicyRuleInput added in v6.19.0 

type DenyPolicyRuleInput interface {
	pulumi.Input

	ToDenyPolicyRuleOutput() DenyPolicyRuleOutput
	ToDenyPolicyRuleOutputWithContext(context.Context) DenyPolicyRuleOutput
}

DenyPolicyRuleInput is an input type that accepts DenyPolicyRuleArgs and DenyPolicyRuleOutput values. You can construct a concrete instance of `DenyPolicyRuleInput` via: 

DenyPolicyRuleArgs{...}

type DenyPolicyRuleOutput added in v6.19.0 

type DenyPolicyRuleOutput struct{ *pulumi.OutputState }

func (DenyPolicyRuleOutput) DenyRule added in v6.19.0 

func (o DenyPolicyRuleOutput) DenyRule() DenyPolicyRuleDenyRulePtrOutput

A deny rule in an IAM deny policy. Structure is documented below.

func (DenyPolicyRuleOutput) Description added in v6.19.0 

func (o DenyPolicyRuleOutput) Description() pulumi.StringPtrOutput

The description of the rule.

func (DenyPolicyRuleOutput) ElementType added in v6.19.0 

func (DenyPolicyRuleOutput) ElementType() reflect.Type

func (DenyPolicyRuleOutput) ToDenyPolicyRuleOutput added in v6.19.0 

func (o DenyPolicyRuleOutput) ToDenyPolicyRuleOutput() DenyPolicyRuleOutput

func (DenyPolicyRuleOutput) ToDenyPolicyRuleOutputWithContext added in v6.19.0 

func (o DenyPolicyRuleOutput) ToDenyPolicyRuleOutputWithContext(ctx context.Context) DenyPolicyRuleOutput

type DenyPolicyState added in v6.19.0 

type DenyPolicyState struct {
	// The display name of the rule.
	DisplayName pulumi.StringPtrInput
	// The hash of the resource. Used internally during updates.
	Etag pulumi.StringPtrInput
	// The name of the policy.
	Name pulumi.StringPtrInput
	// The attachment point is identified by its URL-encoded full resource name.
	Parent pulumi.StringPtrInput
	// Rules to be applied.
	// Structure is documented below.
	Rules DenyPolicyRuleArrayInput
}

func (DenyPolicyState) ElementType added in v6.19.0 

func (DenyPolicyState) ElementType() reflect.Type

type GetRuleArgs 

type GetRuleArgs struct {
	// The name of the Role to lookup in the form `roles/{ROLE_NAME}`, `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}` or `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name string `pulumi:"name"`
}

A collection of arguments for invoking getRule.

type GetRuleOutputArgs 

type GetRuleOutputArgs struct {
	// The name of the Role to lookup in the form `roles/{ROLE_NAME}`, `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}` or `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name pulumi.StringInput `pulumi:"name"`
}

A collection of arguments for invoking getRule.

func (GetRuleOutputArgs) ElementType 

func (GetRuleOutputArgs) ElementType() reflect.Type

type GetRuleResult 

type GetRuleResult struct {
	// The provider-assigned unique ID for this managed resource.
	Id string `pulumi:"id"`
	// specifies the list of one or more permissions to include in the custom role, such as - `iam.roles.get`
	IncludedPermissions []string `pulumi:"includedPermissions"`
	Name                string   `pulumi:"name"`
	// indicates the stage of a role in the launch lifecycle, such as `GA`, `BETA` or `ALPHA`.
	Stage string `pulumi:"stage"`
	// is a friendly title for the role, such as "Role Viewer"
	Title string `pulumi:"title"`
}

A collection of values returned by getRule.

func GetRule 

func GetRule(ctx *pulumi.Context, args *GetRuleArgs, opts ...pulumi.InvokeOption) (*GetRuleResult, error)

Use this data source to get information about a Google IAM Role.

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		roleinfo, err := iam.GetRule(ctx, &iam.GetRuleArgs{
			Name: "roles/compute.viewer",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("theRolePermissions", roleinfo.IncludedPermissions)
		return nil
	})
}

```

type GetRuleResultOutput 

type GetRuleResultOutput struct{ *pulumi.OutputState }

A collection of values returned by getRule.

func GetRuleOutput 

func GetRuleOutput(ctx *pulumi.Context, args GetRuleOutputArgs, opts ...pulumi.InvokeOption) GetRuleResultOutput

func (GetRuleResultOutput) ElementType 

func (GetRuleResultOutput) ElementType() reflect.Type

func (GetRuleResultOutput) Id 

func (o GetRuleResultOutput) Id() pulumi.StringOutput

The provider-assigned unique ID for this managed resource.

func (GetRuleResultOutput) IncludedPermissions 

func (o GetRuleResultOutput) IncludedPermissions() pulumi.StringArrayOutput

specifies the list of one or more permissions to include in the custom role, such as - `iam.roles.get`

func (GetRuleResultOutput) Name 

func (o GetRuleResultOutput) Name() pulumi.StringOutput

func (GetRuleResultOutput) Stage 

func (o GetRuleResultOutput) Stage() pulumi.StringOutput

indicates the stage of a role in the launch lifecycle, such as `GA`, `BETA` or `ALPHA`.

func (GetRuleResultOutput) Title 

func (o GetRuleResultOutput) Title() pulumi.StringOutput

is a friendly title for the role, such as "Role Viewer"

func (GetRuleResultOutput) ToGetRuleResultOutput 

func (o GetRuleResultOutput) ToGetRuleResultOutput() GetRuleResultOutput

func (GetRuleResultOutput) ToGetRuleResultOutputWithContext 

func (o GetRuleResultOutput) ToGetRuleResultOutputWithContext(ctx context.Context) GetRuleResultOutput

type GetTestablePermissionsArgs 

type GetTestablePermissionsArgs struct {
	// The level of support for custom roles. Can be one of `"NOT_SUPPORTED"`, `"SUPPORTED"`, `"TESTING"`. Default is `"SUPPORTED"`
	CustomSupportLevel *string `pulumi:"customSupportLevel"`
	// See [full resource name documentation](https://cloud.google.com/apis/design/resource_names#full_resource_name) for more detail.
	FullResourceName string `pulumi:"fullResourceName"`
	// The acceptable release stages of the permission in the output. Note that `BETA` does not include permissions in `GA`, but you can specify both with `["GA", "BETA"]` for example. Can be a list of `"ALPHA"`, `"BETA"`, `"GA"`, `"DEPRECATED"`. Default is `["GA"]`.
	Stages []string `pulumi:"stages"`
}

A collection of arguments for invoking getTestablePermissions.

type GetTestablePermissionsOutputArgs 

type GetTestablePermissionsOutputArgs struct {
	// The level of support for custom roles. Can be one of `"NOT_SUPPORTED"`, `"SUPPORTED"`, `"TESTING"`. Default is `"SUPPORTED"`
	CustomSupportLevel pulumi.StringPtrInput `pulumi:"customSupportLevel"`
	// See [full resource name documentation](https://cloud.google.com/apis/design/resource_names#full_resource_name) for more detail.
	FullResourceName pulumi.StringInput `pulumi:"fullResourceName"`
	// The acceptable release stages of the permission in the output. Note that `BETA` does not include permissions in `GA`, but you can specify both with `["GA", "BETA"]` for example. Can be a list of `"ALPHA"`, `"BETA"`, `"GA"`, `"DEPRECATED"`. Default is `["GA"]`.
	Stages pulumi.StringArrayInput `pulumi:"stages"`
}

A collection of arguments for invoking getTestablePermissions.

func (GetTestablePermissionsOutputArgs) ElementType 

func (GetTestablePermissionsOutputArgs) ElementType() reflect.Type

type GetTestablePermissionsPermission 

type GetTestablePermissionsPermission struct {
	// Whether the corresponding API has been enabled for the resource.
	ApiDisabled bool `pulumi:"apiDisabled"`
	// The level of support for custom roles. Can be one of `"NOT_SUPPORTED"`, `"SUPPORTED"`, `"TESTING"`. Default is `"SUPPORTED"`
	CustomSupportLevel string `pulumi:"customSupportLevel"`
	// Name of the permission.
	Name string `pulumi:"name"`
	// Release stage of the permission.
	Stage string `pulumi:"stage"`
	// Human readable title of the permission.
	Title string `pulumi:"title"`
}

type GetTestablePermissionsPermissionArgs 

type GetTestablePermissionsPermissionArgs struct {
	// Whether the corresponding API has been enabled for the resource.
	ApiDisabled pulumi.BoolInput `pulumi:"apiDisabled"`
	// The level of support for custom roles. Can be one of `"NOT_SUPPORTED"`, `"SUPPORTED"`, `"TESTING"`. Default is `"SUPPORTED"`
	CustomSupportLevel pulumi.StringInput `pulumi:"customSupportLevel"`
	// Name of the permission.
	Name pulumi.StringInput `pulumi:"name"`
	// Release stage of the permission.
	Stage pulumi.StringInput `pulumi:"stage"`
	// Human readable title of the permission.
	Title pulumi.StringInput `pulumi:"title"`
}

func (GetTestablePermissionsPermissionArgs) ElementType 

func (GetTestablePermissionsPermissionArgs) ElementType() reflect.Type

func (GetTestablePermissionsPermissionArgs) ToGetTestablePermissionsPermissionOutput 

func (i GetTestablePermissionsPermissionArgs) ToGetTestablePermissionsPermissionOutput() GetTestablePermissionsPermissionOutput

func (GetTestablePermissionsPermissionArgs) ToGetTestablePermissionsPermissionOutputWithContext 

func (i GetTestablePermissionsPermissionArgs) ToGetTestablePermissionsPermissionOutputWithContext(ctx context.Context) GetTestablePermissionsPermissionOutput

type GetTestablePermissionsPermissionArray 

type GetTestablePermissionsPermissionArray []GetTestablePermissionsPermissionInput

func (GetTestablePermissionsPermissionArray) ElementType 

func (GetTestablePermissionsPermissionArray) ElementType() reflect.Type

func (GetTestablePermissionsPermissionArray) ToGetTestablePermissionsPermissionArrayOutput 

func (i GetTestablePermissionsPermissionArray) ToGetTestablePermissionsPermissionArrayOutput() GetTestablePermissionsPermissionArrayOutput

func (GetTestablePermissionsPermissionArray) ToGetTestablePermissionsPermissionArrayOutputWithContext 

func (i GetTestablePermissionsPermissionArray) ToGetTestablePermissionsPermissionArrayOutputWithContext(ctx context.Context) GetTestablePermissionsPermissionArrayOutput

type GetTestablePermissionsPermissionArrayInput 

type GetTestablePermissionsPermissionArrayInput interface {
	pulumi.Input

	ToGetTestablePermissionsPermissionArrayOutput() GetTestablePermissionsPermissionArrayOutput
	ToGetTestablePermissionsPermissionArrayOutputWithContext(context.Context) GetTestablePermissionsPermissionArrayOutput
}

GetTestablePermissionsPermissionArrayInput is an input type that accepts GetTestablePermissionsPermissionArray and GetTestablePermissionsPermissionArrayOutput values. You can construct a concrete instance of `GetTestablePermissionsPermissionArrayInput` via: 

GetTestablePermissionsPermissionArray{ GetTestablePermissionsPermissionArgs{...} }

type GetTestablePermissionsPermissionArrayOutput 

type GetTestablePermissionsPermissionArrayOutput struct{ *pulumi.OutputState }

func (GetTestablePermissionsPermissionArrayOutput) ElementType 

func (GetTestablePermissionsPermissionArrayOutput) ElementType() reflect.Type

func (GetTestablePermissionsPermissionArrayOutput) Index 

func (o GetTestablePermissionsPermissionArrayOutput) Index(i pulumi.IntInput) GetTestablePermissionsPermissionOutput

func (GetTestablePermissionsPermissionArrayOutput) ToGetTestablePermissionsPermissionArrayOutput 

func (o GetTestablePermissionsPermissionArrayOutput) ToGetTestablePermissionsPermissionArrayOutput() GetTestablePermissionsPermissionArrayOutput

func (GetTestablePermissionsPermissionArrayOutput) ToGetTestablePermissionsPermissionArrayOutputWithContext 

func (o GetTestablePermissionsPermissionArrayOutput) ToGetTestablePermissionsPermissionArrayOutputWithContext(ctx context.Context) GetTestablePermissionsPermissionArrayOutput

type GetTestablePermissionsPermissionInput 

type GetTestablePermissionsPermissionInput interface {
	pulumi.Input

	ToGetTestablePermissionsPermissionOutput() GetTestablePermissionsPermissionOutput
	ToGetTestablePermissionsPermissionOutputWithContext(context.Context) GetTestablePermissionsPermissionOutput
}

GetTestablePermissionsPermissionInput is an input type that accepts GetTestablePermissionsPermissionArgs and GetTestablePermissionsPermissionOutput values. You can construct a concrete instance of `GetTestablePermissionsPermissionInput` via: 

GetTestablePermissionsPermissionArgs{...}

type GetTestablePermissionsPermissionOutput 

type GetTestablePermissionsPermissionOutput struct{ *pulumi.OutputState }

func (GetTestablePermissionsPermissionOutput) ApiDisabled 

func (o GetTestablePermissionsPermissionOutput) ApiDisabled() pulumi.BoolOutput

Whether the corresponding API has been enabled for the resource.

func (GetTestablePermissionsPermissionOutput) CustomSupportLevel 

func (o GetTestablePermissionsPermissionOutput) CustomSupportLevel() pulumi.StringOutput

The level of support for custom roles. Can be one of `"NOT_SUPPORTED"`, `"SUPPORTED"`, `"TESTING"`. Default is `"SUPPORTED"`

func (GetTestablePermissionsPermissionOutput) ElementType 

func (GetTestablePermissionsPermissionOutput) ElementType() reflect.Type

func (GetTestablePermissionsPermissionOutput) Name 

func (o GetTestablePermissionsPermissionOutput) Name() pulumi.StringOutput

Name of the permission.

func (GetTestablePermissionsPermissionOutput) Stage 

func (o GetTestablePermissionsPermissionOutput) Stage() pulumi.StringOutput

Release stage of the permission.

func (GetTestablePermissionsPermissionOutput) Title 

func (o GetTestablePermissionsPermissionOutput) Title() pulumi.StringOutput

Human readable title of the permission.

func (GetTestablePermissionsPermissionOutput) ToGetTestablePermissionsPermissionOutput 

func (o GetTestablePermissionsPermissionOutput) ToGetTestablePermissionsPermissionOutput() GetTestablePermissionsPermissionOutput

func (GetTestablePermissionsPermissionOutput) ToGetTestablePermissionsPermissionOutputWithContext 

func (o GetTestablePermissionsPermissionOutput) ToGetTestablePermissionsPermissionOutputWithContext(ctx context.Context) GetTestablePermissionsPermissionOutput

type GetTestablePermissionsResult 

type GetTestablePermissionsResult struct {
	// The the support level of this permission for custom roles.
	CustomSupportLevel *string `pulumi:"customSupportLevel"`
	FullResourceName   string  `pulumi:"fullResourceName"`
	// The provider-assigned unique ID for this managed resource.
	Id string `pulumi:"id"`
	// A list of permissions matching the provided input. Structure is defined below.
	Permissions []GetTestablePermissionsPermission `pulumi:"permissions"`
	Stages      []string                           `pulumi:"stages"`
}

A collection of values returned by getTestablePermissions.

func GetTestablePermissions 

func GetTestablePermissions(ctx *pulumi.Context, args *GetTestablePermissionsArgs, opts ...pulumi.InvokeOption) (*GetTestablePermissionsResult, error)

Retrieve a list of testable permissions for a resource. Testable permissions mean the permissions that user can add or remove in a role at a given resource. The resource can be referenced either via the full resource name or via a URI.

## Example Usage

Retrieve all the supported permissions able to be set on `my-project` that are in either GA or BETA. This is useful for dynamically constructing custom roles.

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.GetTestablePermissions(ctx, &iam.GetTestablePermissionsArgs{
			FullResourceName: "//cloudresourcemanager.googleapis.com/projects/my-project",
			Stages: []string{
				"GA",
				"BETA",
			},
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

```

type GetTestablePermissionsResultOutput 

type GetTestablePermissionsResultOutput struct{ *pulumi.OutputState }

A collection of values returned by getTestablePermissions.

func GetTestablePermissionsOutput 

func GetTestablePermissionsOutput(ctx *pulumi.Context, args GetTestablePermissionsOutputArgs, opts ...pulumi.InvokeOption) GetTestablePermissionsResultOutput

func (GetTestablePermissionsResultOutput) CustomSupportLevel 

func (o GetTestablePermissionsResultOutput) CustomSupportLevel() pulumi.StringPtrOutput

The the support level of this permission for custom roles.

func (GetTestablePermissionsResultOutput) ElementType 

func (GetTestablePermissionsResultOutput) ElementType() reflect.Type

func (GetTestablePermissionsResultOutput) FullResourceName 

func (o GetTestablePermissionsResultOutput) FullResourceName() pulumi.StringOutput

func (GetTestablePermissionsResultOutput) Id 

func (o GetTestablePermissionsResultOutput) Id() pulumi.StringOutput

The provider-assigned unique ID for this managed resource.

func (GetTestablePermissionsResultOutput) Permissions 

func (o GetTestablePermissionsResultOutput) Permissions() GetTestablePermissionsPermissionArrayOutput

A list of permissions matching the provided input. Structure is defined below.

func (GetTestablePermissionsResultOutput) Stages 

func (o GetTestablePermissionsResultOutput) Stages() pulumi.StringArrayOutput

func (GetTestablePermissionsResultOutput) ToGetTestablePermissionsResultOutput 

func (o GetTestablePermissionsResultOutput) ToGetTestablePermissionsResultOutput() GetTestablePermissionsResultOutput

func (GetTestablePermissionsResultOutput) ToGetTestablePermissionsResultOutputWithContext 

func (o GetTestablePermissionsResultOutput) ToGetTestablePermissionsResultOutputWithContext(ctx context.Context) GetTestablePermissionsResultOutput

type GetWorkloadIdentityPoolProviderAw 

type GetWorkloadIdentityPoolProviderAw struct {
	AccountId string `pulumi:"accountId"`
}

type GetWorkloadIdentityPoolProviderAwArgs 

type GetWorkloadIdentityPoolProviderAwArgs struct {
	AccountId pulumi.StringInput `pulumi:"accountId"`
}

func (GetWorkloadIdentityPoolProviderAwArgs) ElementType 

func (GetWorkloadIdentityPoolProviderAwArgs) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderAwArgs) ToGetWorkloadIdentityPoolProviderAwOutput 

func (i GetWorkloadIdentityPoolProviderAwArgs) ToGetWorkloadIdentityPoolProviderAwOutput() GetWorkloadIdentityPoolProviderAwOutput

func (GetWorkloadIdentityPoolProviderAwArgs) ToGetWorkloadIdentityPoolProviderAwOutputWithContext 

func (i GetWorkloadIdentityPoolProviderAwArgs) ToGetWorkloadIdentityPoolProviderAwOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderAwOutput

type GetWorkloadIdentityPoolProviderAwArray 

type GetWorkloadIdentityPoolProviderAwArray []GetWorkloadIdentityPoolProviderAwInput

func (GetWorkloadIdentityPoolProviderAwArray) ElementType 

func (GetWorkloadIdentityPoolProviderAwArray) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderAwArray) ToGetWorkloadIdentityPoolProviderAwArrayOutput 

func (i GetWorkloadIdentityPoolProviderAwArray) ToGetWorkloadIdentityPoolProviderAwArrayOutput() GetWorkloadIdentityPoolProviderAwArrayOutput

func (GetWorkloadIdentityPoolProviderAwArray) ToGetWorkloadIdentityPoolProviderAwArrayOutputWithContext 

func (i GetWorkloadIdentityPoolProviderAwArray) ToGetWorkloadIdentityPoolProviderAwArrayOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderAwArrayOutput

type GetWorkloadIdentityPoolProviderAwArrayInput 

type GetWorkloadIdentityPoolProviderAwArrayInput interface {
	pulumi.Input

	ToGetWorkloadIdentityPoolProviderAwArrayOutput() GetWorkloadIdentityPoolProviderAwArrayOutput
	ToGetWorkloadIdentityPoolProviderAwArrayOutputWithContext(context.Context) GetWorkloadIdentityPoolProviderAwArrayOutput
}

GetWorkloadIdentityPoolProviderAwArrayInput is an input type that accepts GetWorkloadIdentityPoolProviderAwArray and GetWorkloadIdentityPoolProviderAwArrayOutput values. You can construct a concrete instance of `GetWorkloadIdentityPoolProviderAwArrayInput` via: 

GetWorkloadIdentityPoolProviderAwArray{ GetWorkloadIdentityPoolProviderAwArgs{...} }

type GetWorkloadIdentityPoolProviderAwArrayOutput 

type GetWorkloadIdentityPoolProviderAwArrayOutput struct{ *pulumi.OutputState }

func (GetWorkloadIdentityPoolProviderAwArrayOutput) ElementType 

func (GetWorkloadIdentityPoolProviderAwArrayOutput) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderAwArrayOutput) Index 

func (o GetWorkloadIdentityPoolProviderAwArrayOutput) Index(i pulumi.IntInput) GetWorkloadIdentityPoolProviderAwOutput

func (GetWorkloadIdentityPoolProviderAwArrayOutput) ToGetWorkloadIdentityPoolProviderAwArrayOutput 

func (o GetWorkloadIdentityPoolProviderAwArrayOutput) ToGetWorkloadIdentityPoolProviderAwArrayOutput() GetWorkloadIdentityPoolProviderAwArrayOutput

func (GetWorkloadIdentityPoolProviderAwArrayOutput) ToGetWorkloadIdentityPoolProviderAwArrayOutputWithContext 

func (o GetWorkloadIdentityPoolProviderAwArrayOutput) ToGetWorkloadIdentityPoolProviderAwArrayOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderAwArrayOutput

type GetWorkloadIdentityPoolProviderAwInput 

type GetWorkloadIdentityPoolProviderAwInput interface {
	pulumi.Input

	ToGetWorkloadIdentityPoolProviderAwOutput() GetWorkloadIdentityPoolProviderAwOutput
	ToGetWorkloadIdentityPoolProviderAwOutputWithContext(context.Context) GetWorkloadIdentityPoolProviderAwOutput
}

GetWorkloadIdentityPoolProviderAwInput is an input type that accepts GetWorkloadIdentityPoolProviderAwArgs and GetWorkloadIdentityPoolProviderAwOutput values. You can construct a concrete instance of `GetWorkloadIdentityPoolProviderAwInput` via: 

GetWorkloadIdentityPoolProviderAwArgs{...}

type GetWorkloadIdentityPoolProviderAwOutput 

type GetWorkloadIdentityPoolProviderAwOutput struct{ *pulumi.OutputState }

func (GetWorkloadIdentityPoolProviderAwOutput) AccountId 

func (o GetWorkloadIdentityPoolProviderAwOutput) AccountId() pulumi.StringOutput

func (GetWorkloadIdentityPoolProviderAwOutput) ElementType 

func (GetWorkloadIdentityPoolProviderAwOutput) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderAwOutput) ToGetWorkloadIdentityPoolProviderAwOutput 

func (o GetWorkloadIdentityPoolProviderAwOutput) ToGetWorkloadIdentityPoolProviderAwOutput() GetWorkloadIdentityPoolProviderAwOutput

func (GetWorkloadIdentityPoolProviderAwOutput) ToGetWorkloadIdentityPoolProviderAwOutputWithContext 

func (o GetWorkloadIdentityPoolProviderAwOutput) ToGetWorkloadIdentityPoolProviderAwOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderAwOutput

type GetWorkloadIdentityPoolProviderOidc 

type GetWorkloadIdentityPoolProviderOidc struct {
	AllowedAudiences []string `pulumi:"allowedAudiences"`
	IssuerUri        string   `pulumi:"issuerUri"`
	JwksJson         string   `pulumi:"jwksJson"`
}

type GetWorkloadIdentityPoolProviderOidcArgs 

type GetWorkloadIdentityPoolProviderOidcArgs struct {
	AllowedAudiences pulumi.StringArrayInput `pulumi:"allowedAudiences"`
	IssuerUri        pulumi.StringInput      `pulumi:"issuerUri"`
	JwksJson         pulumi.StringInput      `pulumi:"jwksJson"`
}

func (GetWorkloadIdentityPoolProviderOidcArgs) ElementType 

func (GetWorkloadIdentityPoolProviderOidcArgs) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderOidcArgs) ToGetWorkloadIdentityPoolProviderOidcOutput 

func (i GetWorkloadIdentityPoolProviderOidcArgs) ToGetWorkloadIdentityPoolProviderOidcOutput() GetWorkloadIdentityPoolProviderOidcOutput

func (GetWorkloadIdentityPoolProviderOidcArgs) ToGetWorkloadIdentityPoolProviderOidcOutputWithContext 

func (i GetWorkloadIdentityPoolProviderOidcArgs) ToGetWorkloadIdentityPoolProviderOidcOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderOidcOutput

type GetWorkloadIdentityPoolProviderOidcArray 

type GetWorkloadIdentityPoolProviderOidcArray []GetWorkloadIdentityPoolProviderOidcInput

func (GetWorkloadIdentityPoolProviderOidcArray) ElementType 

func (GetWorkloadIdentityPoolProviderOidcArray) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderOidcArray) ToGetWorkloadIdentityPoolProviderOidcArrayOutput 

func (i GetWorkloadIdentityPoolProviderOidcArray) ToGetWorkloadIdentityPoolProviderOidcArrayOutput() GetWorkloadIdentityPoolProviderOidcArrayOutput

func (GetWorkloadIdentityPoolProviderOidcArray) ToGetWorkloadIdentityPoolProviderOidcArrayOutputWithContext 

func (i GetWorkloadIdentityPoolProviderOidcArray) ToGetWorkloadIdentityPoolProviderOidcArrayOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderOidcArrayOutput

type GetWorkloadIdentityPoolProviderOidcArrayInput 

type GetWorkloadIdentityPoolProviderOidcArrayInput interface {
	pulumi.Input

	ToGetWorkloadIdentityPoolProviderOidcArrayOutput() GetWorkloadIdentityPoolProviderOidcArrayOutput
	ToGetWorkloadIdentityPoolProviderOidcArrayOutputWithContext(context.Context) GetWorkloadIdentityPoolProviderOidcArrayOutput
}

GetWorkloadIdentityPoolProviderOidcArrayInput is an input type that accepts GetWorkloadIdentityPoolProviderOidcArray and GetWorkloadIdentityPoolProviderOidcArrayOutput values. You can construct a concrete instance of `GetWorkloadIdentityPoolProviderOidcArrayInput` via: 

GetWorkloadIdentityPoolProviderOidcArray{ GetWorkloadIdentityPoolProviderOidcArgs{...} }

type GetWorkloadIdentityPoolProviderOidcArrayOutput 

type GetWorkloadIdentityPoolProviderOidcArrayOutput struct{ *pulumi.OutputState }

func (GetWorkloadIdentityPoolProviderOidcArrayOutput) ElementType 

func (GetWorkloadIdentityPoolProviderOidcArrayOutput) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderOidcArrayOutput) Index 

func (o GetWorkloadIdentityPoolProviderOidcArrayOutput) Index(i pulumi.IntInput) GetWorkloadIdentityPoolProviderOidcOutput

func (GetWorkloadIdentityPoolProviderOidcArrayOutput) ToGetWorkloadIdentityPoolProviderOidcArrayOutput 

func (o GetWorkloadIdentityPoolProviderOidcArrayOutput) ToGetWorkloadIdentityPoolProviderOidcArrayOutput() GetWorkloadIdentityPoolProviderOidcArrayOutput

func (GetWorkloadIdentityPoolProviderOidcArrayOutput) ToGetWorkloadIdentityPoolProviderOidcArrayOutputWithContext 

func (o GetWorkloadIdentityPoolProviderOidcArrayOutput) ToGetWorkloadIdentityPoolProviderOidcArrayOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderOidcArrayOutput

type GetWorkloadIdentityPoolProviderOidcInput 

type GetWorkloadIdentityPoolProviderOidcInput interface {
	pulumi.Input

	ToGetWorkloadIdentityPoolProviderOidcOutput() GetWorkloadIdentityPoolProviderOidcOutput
	ToGetWorkloadIdentityPoolProviderOidcOutputWithContext(context.Context) GetWorkloadIdentityPoolProviderOidcOutput
}

GetWorkloadIdentityPoolProviderOidcInput is an input type that accepts GetWorkloadIdentityPoolProviderOidcArgs and GetWorkloadIdentityPoolProviderOidcOutput values. You can construct a concrete instance of `GetWorkloadIdentityPoolProviderOidcInput` via: 

GetWorkloadIdentityPoolProviderOidcArgs{...}

type GetWorkloadIdentityPoolProviderOidcOutput 

type GetWorkloadIdentityPoolProviderOidcOutput struct{ *pulumi.OutputState }

func (GetWorkloadIdentityPoolProviderOidcOutput) AllowedAudiences 

func (o GetWorkloadIdentityPoolProviderOidcOutput) AllowedAudiences() pulumi.StringArrayOutput

func (GetWorkloadIdentityPoolProviderOidcOutput) ElementType 

func (GetWorkloadIdentityPoolProviderOidcOutput) ElementType() reflect.Type

func (GetWorkloadIdentityPoolProviderOidcOutput) IssuerUri 

func (o GetWorkloadIdentityPoolProviderOidcOutput) IssuerUri() pulumi.StringOutput

func (GetWorkloadIdentityPoolProviderOidcOutput) JwksJson added in v6.60.0 

func (o GetWorkloadIdentityPoolProviderOidcOutput) JwksJson() pulumi.StringOutput

func (GetWorkloadIdentityPoolProviderOidcOutput) ToGetWorkloadIdentityPoolProviderOidcOutput 

func (o GetWorkloadIdentityPoolProviderOidcOutput) ToGetWorkloadIdentityPoolProviderOidcOutput() GetWorkloadIdentityPoolProviderOidcOutput

func (GetWorkloadIdentityPoolProviderOidcOutput) ToGetWorkloadIdentityPoolProviderOidcOutputWithContext 

func (o GetWorkloadIdentityPoolProviderOidcOutput) ToGetWorkloadIdentityPoolProviderOidcOutputWithContext(ctx context.Context) GetWorkloadIdentityPoolProviderOidcOutput

type LookupWorkloadIdentityPoolArgs 

type LookupWorkloadIdentityPoolArgs struct {
	// The project in which the resource belongs. If it
	// is not provided, the provider project is used.
	Project *string `pulumi:"project"`
	// The id of the pool which is the
	// final component of the resource name.
	//
	// ***
	WorkloadIdentityPoolId string `pulumi:"workloadIdentityPoolId"`
}

A collection of arguments for invoking getWorkloadIdentityPool.

type LookupWorkloadIdentityPoolOutputArgs 

type LookupWorkloadIdentityPoolOutputArgs struct {
	// The project in which the resource belongs. If it
	// is not provided, the provider project is used.
	Project pulumi.StringPtrInput `pulumi:"project"`
	// The id of the pool which is the
	// final component of the resource name.
	//
	// ***
	WorkloadIdentityPoolId pulumi.StringInput `pulumi:"workloadIdentityPoolId"`
}

A collection of arguments for invoking getWorkloadIdentityPool.

func (LookupWorkloadIdentityPoolOutputArgs) ElementType 

func (LookupWorkloadIdentityPoolOutputArgs) ElementType() reflect.Type

type LookupWorkloadIdentityPoolProviderArgs 

type LookupWorkloadIdentityPoolProviderArgs struct {
	// The project in which the resource belongs. If it
	// is not provided, the provider project is used.
	Project *string `pulumi:"project"`
	// The id of the pool which is the
	// final component of the pool resource name.
	WorkloadIdentityPoolId string `pulumi:"workloadIdentityPoolId"`
	// The id of the provider which is the
	// final component of the resource name.
	//
	// ***
	WorkloadIdentityPoolProviderId string `pulumi:"workloadIdentityPoolProviderId"`
}

A collection of arguments for invoking getWorkloadIdentityPoolProvider.

type LookupWorkloadIdentityPoolProviderOutputArgs 

type LookupWorkloadIdentityPoolProviderOutputArgs struct {
	// The project in which the resource belongs. If it
	// is not provided, the provider project is used.
	Project pulumi.StringPtrInput `pulumi:"project"`
	// The id of the pool which is the
	// final component of the pool resource name.
	WorkloadIdentityPoolId pulumi.StringInput `pulumi:"workloadIdentityPoolId"`
	// The id of the provider which is the
	// final component of the resource name.
	//
	// ***
	WorkloadIdentityPoolProviderId pulumi.StringInput `pulumi:"workloadIdentityPoolProviderId"`
}

A collection of arguments for invoking getWorkloadIdentityPoolProvider.

func (LookupWorkloadIdentityPoolProviderOutputArgs) ElementType 

func (LookupWorkloadIdentityPoolProviderOutputArgs) ElementType() reflect.Type

type LookupWorkloadIdentityPoolProviderResult 

type LookupWorkloadIdentityPoolProviderResult struct {
	AttributeCondition string                              `pulumi:"attributeCondition"`
	AttributeMapping   map[string]string                   `pulumi:"attributeMapping"`
	Aws                []GetWorkloadIdentityPoolProviderAw `pulumi:"aws"`
	Description        string                              `pulumi:"description"`
	Disabled           bool                                `pulumi:"disabled"`
	DisplayName        string                              `pulumi:"displayName"`
	// The provider-assigned unique ID for this managed resource.
	Id                             string                                `pulumi:"id"`
	Name                           string                                `pulumi:"name"`
	Oidcs                          []GetWorkloadIdentityPoolProviderOidc `pulumi:"oidcs"`
	Project                        *string                               `pulumi:"project"`
	State                          string                                `pulumi:"state"`
	WorkloadIdentityPoolId         string                                `pulumi:"workloadIdentityPoolId"`
	WorkloadIdentityPoolProviderId string                                `pulumi:"workloadIdentityPoolProviderId"`
}

A collection of values returned by getWorkloadIdentityPoolProvider.

func LookupWorkloadIdentityPoolProvider 

func LookupWorkloadIdentityPoolProvider(ctx *pulumi.Context, args *LookupWorkloadIdentityPoolProviderArgs, opts ...pulumi.InvokeOption) (*LookupWorkloadIdentityPoolProviderResult, error)

Get a IAM workload identity provider from Google Cloud by its id.

## Example Usage

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.LookupWorkloadIdentityPoolProvider(ctx, &iam.LookupWorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         "foo-pool",
			WorkloadIdentityPoolProviderId: "bar-provider",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

```

type LookupWorkloadIdentityPoolProviderResultOutput 

type LookupWorkloadIdentityPoolProviderResultOutput struct{ *pulumi.OutputState }

A collection of values returned by getWorkloadIdentityPoolProvider.

func LookupWorkloadIdentityPoolProviderOutput 

func LookupWorkloadIdentityPoolProviderOutput(ctx *pulumi.Context, args LookupWorkloadIdentityPoolProviderOutputArgs, opts ...pulumi.InvokeOption) LookupWorkloadIdentityPoolProviderResultOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) AttributeCondition 

func (o LookupWorkloadIdentityPoolProviderResultOutput) AttributeCondition() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) AttributeMapping 

func (o LookupWorkloadIdentityPoolProviderResultOutput) AttributeMapping() pulumi.StringMapOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) Aws 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Aws() GetWorkloadIdentityPoolProviderAwArrayOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) Description 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Description() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) Disabled 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Disabled() pulumi.BoolOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) DisplayName 

func (o LookupWorkloadIdentityPoolProviderResultOutput) DisplayName() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) ElementType 

func (LookupWorkloadIdentityPoolProviderResultOutput) ElementType() reflect.Type

func (LookupWorkloadIdentityPoolProviderResultOutput) Id 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Id() pulumi.StringOutput

The provider-assigned unique ID for this managed resource.

func (LookupWorkloadIdentityPoolProviderResultOutput) Name 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Name() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) Oidcs 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Oidcs() GetWorkloadIdentityPoolProviderOidcArrayOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) Project 

func (o LookupWorkloadIdentityPoolProviderResultOutput) Project() pulumi.StringPtrOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) State 

func (o LookupWorkloadIdentityPoolProviderResultOutput) State() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) ToLookupWorkloadIdentityPoolProviderResultOutput 

func (o LookupWorkloadIdentityPoolProviderResultOutput) ToLookupWorkloadIdentityPoolProviderResultOutput() LookupWorkloadIdentityPoolProviderResultOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) ToLookupWorkloadIdentityPoolProviderResultOutputWithContext 

func (o LookupWorkloadIdentityPoolProviderResultOutput) ToLookupWorkloadIdentityPoolProviderResultOutputWithContext(ctx context.Context) LookupWorkloadIdentityPoolProviderResultOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) WorkloadIdentityPoolId 

func (o LookupWorkloadIdentityPoolProviderResultOutput) WorkloadIdentityPoolId() pulumi.StringOutput

func (LookupWorkloadIdentityPoolProviderResultOutput) WorkloadIdentityPoolProviderId 

func (o LookupWorkloadIdentityPoolProviderResultOutput) WorkloadIdentityPoolProviderId() pulumi.StringOutput

type LookupWorkloadIdentityPoolResult 

type LookupWorkloadIdentityPoolResult struct {
	Description string `pulumi:"description"`
	Disabled    bool   `pulumi:"disabled"`
	DisplayName string `pulumi:"displayName"`
	// The provider-assigned unique ID for this managed resource.
	Id                     string  `pulumi:"id"`
	Name                   string  `pulumi:"name"`
	Project                *string `pulumi:"project"`
	State                  string  `pulumi:"state"`
	WorkloadIdentityPoolId string  `pulumi:"workloadIdentityPoolId"`
}

A collection of values returned by getWorkloadIdentityPool.

func LookupWorkloadIdentityPool 

func LookupWorkloadIdentityPool(ctx *pulumi.Context, args *LookupWorkloadIdentityPoolArgs, opts ...pulumi.InvokeOption) (*LookupWorkloadIdentityPoolResult, error)

Get a IAM workload identity pool from Google Cloud by its id. > **Note:** The following resource requires the Beta IAM role `roles/iam.workloadIdentityPoolAdmin` in order to succeed. `OWNER` and `EDITOR` roles do not include the necessary permissions. ## Example Usage

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.LookupWorkloadIdentityPool(ctx, &iam.LookupWorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: "foo-pool",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

```

type LookupWorkloadIdentityPoolResultOutput 

type LookupWorkloadIdentityPoolResultOutput struct{ *pulumi.OutputState }

A collection of values returned by getWorkloadIdentityPool.

func LookupWorkloadIdentityPoolOutput 

func LookupWorkloadIdentityPoolOutput(ctx *pulumi.Context, args LookupWorkloadIdentityPoolOutputArgs, opts ...pulumi.InvokeOption) LookupWorkloadIdentityPoolResultOutput

func (LookupWorkloadIdentityPoolResultOutput) Description 

func (o LookupWorkloadIdentityPoolResultOutput) Description() pulumi.StringOutput

func (LookupWorkloadIdentityPoolResultOutput) Disabled 

func (o LookupWorkloadIdentityPoolResultOutput) Disabled() pulumi.BoolOutput

func (LookupWorkloadIdentityPoolResultOutput) DisplayName 

func (o LookupWorkloadIdentityPoolResultOutput) DisplayName() pulumi.StringOutput

func (LookupWorkloadIdentityPoolResultOutput) ElementType 

func (LookupWorkloadIdentityPoolResultOutput) ElementType() reflect.Type

func (LookupWorkloadIdentityPoolResultOutput) Id 

func (o LookupWorkloadIdentityPoolResultOutput) Id() pulumi.StringOutput

The provider-assigned unique ID for this managed resource.

func (LookupWorkloadIdentityPoolResultOutput) Name 

func (o LookupWorkloadIdentityPoolResultOutput) Name() pulumi.StringOutput

func (LookupWorkloadIdentityPoolResultOutput) Project 

func (o LookupWorkloadIdentityPoolResultOutput) Project() pulumi.StringPtrOutput

func (LookupWorkloadIdentityPoolResultOutput) State 

func (o LookupWorkloadIdentityPoolResultOutput) State() pulumi.StringOutput

func (LookupWorkloadIdentityPoolResultOutput) ToLookupWorkloadIdentityPoolResultOutput 

func (o LookupWorkloadIdentityPoolResultOutput) ToLookupWorkloadIdentityPoolResultOutput() LookupWorkloadIdentityPoolResultOutput

func (LookupWorkloadIdentityPoolResultOutput) ToLookupWorkloadIdentityPoolResultOutputWithContext 

func (o LookupWorkloadIdentityPoolResultOutput) ToLookupWorkloadIdentityPoolResultOutputWithContext(ctx context.Context) LookupWorkloadIdentityPoolResultOutput

func (LookupWorkloadIdentityPoolResultOutput) WorkloadIdentityPoolId 

func (o LookupWorkloadIdentityPoolResultOutput) WorkloadIdentityPoolId() pulumi.StringOutput

type WorkforcePool added in v6.42.0 

type WorkforcePool struct {
	pulumi.CustomResourceState

	// A user-specified description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,
	// or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
	Disabled pulumi.BoolPtrOutput `pulumi:"disabled"`
	// A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The location for the resource.
	Location pulumi.StringOutput `pulumi:"location"`
	// Output only. The resource name of the pool.
	// Format: `locations/{location}/workforcePools/{workforcePoolId}`
	Name pulumi.StringOutput `pulumi:"name"`
	// Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
	//
	// ***
	Parent pulumi.StringOutput `pulumi:"parent"`
	// Duration that the Google Cloud access tokens, console sign-in sessions,
	// and `gcloud` sign-in sessions from this pool are valid.
	// Must be greater than 15 minutes (900s) and less than 12 hours (43200s).
	// If `sessionDuration` is not configured, minted credentials have a default duration of one hour (3600s).
	// A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: "`3.5s`".
	SessionDuration pulumi.StringPtrOutput `pulumi:"sessionDuration"`
	// Output only. The state of the pool.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The pool is active, and may be used in Google Cloud policies.
	// * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted
	//   after approximately 30 days. You can restore a soft-deleted pool using
	//   [workforcePools.undelete](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools/undelete#google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePool).
	//   You cannot reuse the ID of a soft-deleted pool until it is permanently deleted.
	//   While a pool is deleted, you cannot use it to exchange tokens, or use
	//   existing tokens to access resources. If the pool is undeleted, existing
	//   tokens grant access again.
	State pulumi.StringOutput `pulumi:"state"`
	// The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,
	// digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringOutput `pulumi:"workforcePoolId"`
}

Represents a collection of external workforces. Provides namespaces for federated users that can be referenced in IAM policies.

To get more information about WorkforcePool, see:

* [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools) * How-to Guides

> **Note:** Ask your Google Cloud account team to request access to workforce identity federation for your billing/quota project. The account team notifies you when the project is granted access.

## Example Usage ### Iam Workforce Pool Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkforcePool(ctx, "example", &iam.WorkforcePoolArgs{
			Location:        pulumi.String("global"),
			Parent:          pulumi.String("organizations/123456789"),
			WorkforcePoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workforce Pool Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkforcePool(ctx, "example", &iam.WorkforcePoolArgs{
			Description:     pulumi.String("A sample workforce pool."),
			Disabled:        pulumi.Bool(false),
			DisplayName:     pulumi.String("Display name"),
			Location:        pulumi.String("global"),
			Parent:          pulumi.String("organizations/123456789"),
			SessionDuration: pulumi.String("7200s"),
			WorkforcePoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

```

## Import

WorkforcePool can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/workforcePool:WorkforcePool default locations/{{location}}/workforcePools/{{workforce_pool_id}}

```

```sh 

$ pulumi import gcp:iam/workforcePool:WorkforcePool default {{location}}/{{workforce_pool_id}}

```

func GetWorkforcePool added in v6.42.0 

func GetWorkforcePool(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *WorkforcePoolState, opts ...pulumi.ResourceOption) (*WorkforcePool, error)

GetWorkforcePool gets an existing WorkforcePool resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewWorkforcePool added in v6.42.0 

func NewWorkforcePool(ctx *pulumi.Context,
	name string, args *WorkforcePoolArgs, opts ...pulumi.ResourceOption) (*WorkforcePool, error)

NewWorkforcePool registers a new resource with the given unique name, arguments, and options.

func (*WorkforcePool) ElementType added in v6.42.0 

func (*WorkforcePool) ElementType() reflect.Type

func (*WorkforcePool) ToWorkforcePoolOutput added in v6.42.0 

func (i *WorkforcePool) ToWorkforcePoolOutput() WorkforcePoolOutput

func (*WorkforcePool) ToWorkforcePoolOutputWithContext added in v6.42.0 

func (i *WorkforcePool) ToWorkforcePoolOutputWithContext(ctx context.Context) WorkforcePoolOutput

type WorkforcePoolArgs added in v6.42.0 

type WorkforcePoolArgs struct {
	// A user-specified description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,
	// or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
	Disabled pulumi.BoolPtrInput
	// A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The location for the resource.
	Location pulumi.StringInput
	// Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
	//
	// ***
	Parent pulumi.StringInput
	// Duration that the Google Cloud access tokens, console sign-in sessions,
	// and `gcloud` sign-in sessions from this pool are valid.
	// Must be greater than 15 minutes (900s) and less than 12 hours (43200s).
	// If `sessionDuration` is not configured, minted credentials have a default duration of one hour (3600s).
	// A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: "`3.5s`".
	SessionDuration pulumi.StringPtrInput
	// The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,
	// digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringInput
}

The set of arguments for constructing a WorkforcePool resource.

func (WorkforcePoolArgs) ElementType added in v6.42.0 

func (WorkforcePoolArgs) ElementType() reflect.Type

type WorkforcePoolArray added in v6.42.0 

type WorkforcePoolArray []WorkforcePoolInput

func (WorkforcePoolArray) ElementType added in v6.42.0 

func (WorkforcePoolArray) ElementType() reflect.Type

func (WorkforcePoolArray) ToWorkforcePoolArrayOutput added in v6.42.0 

func (i WorkforcePoolArray) ToWorkforcePoolArrayOutput() WorkforcePoolArrayOutput

func (WorkforcePoolArray) ToWorkforcePoolArrayOutputWithContext added in v6.42.0 

func (i WorkforcePoolArray) ToWorkforcePoolArrayOutputWithContext(ctx context.Context) WorkforcePoolArrayOutput

type WorkforcePoolArrayInput added in v6.42.0 

type WorkforcePoolArrayInput interface {
	pulumi.Input

	ToWorkforcePoolArrayOutput() WorkforcePoolArrayOutput
	ToWorkforcePoolArrayOutputWithContext(context.Context) WorkforcePoolArrayOutput
}

WorkforcePoolArrayInput is an input type that accepts WorkforcePoolArray and WorkforcePoolArrayOutput values. You can construct a concrete instance of `WorkforcePoolArrayInput` via: 

WorkforcePoolArray{ WorkforcePoolArgs{...} }

type WorkforcePoolArrayOutput added in v6.42.0 

type WorkforcePoolArrayOutput struct{ *pulumi.OutputState }

func (WorkforcePoolArrayOutput) ElementType added in v6.42.0 

func (WorkforcePoolArrayOutput) ElementType() reflect.Type

func (WorkforcePoolArrayOutput) Index added in v6.42.0 

func (o WorkforcePoolArrayOutput) Index(i pulumi.IntInput) WorkforcePoolOutput

func (WorkforcePoolArrayOutput) ToWorkforcePoolArrayOutput added in v6.42.0 

func (o WorkforcePoolArrayOutput) ToWorkforcePoolArrayOutput() WorkforcePoolArrayOutput

func (WorkforcePoolArrayOutput) ToWorkforcePoolArrayOutputWithContext added in v6.42.0 

func (o WorkforcePoolArrayOutput) ToWorkforcePoolArrayOutputWithContext(ctx context.Context) WorkforcePoolArrayOutput

type WorkforcePoolInput added in v6.42.0 

type WorkforcePoolInput interface {
	pulumi.Input

	ToWorkforcePoolOutput() WorkforcePoolOutput
	ToWorkforcePoolOutputWithContext(ctx context.Context) WorkforcePoolOutput
}

type WorkforcePoolMap added in v6.42.0 

type WorkforcePoolMap map[string]WorkforcePoolInput

func (WorkforcePoolMap) ElementType added in v6.42.0 

func (WorkforcePoolMap) ElementType() reflect.Type

func (WorkforcePoolMap) ToWorkforcePoolMapOutput added in v6.42.0 

func (i WorkforcePoolMap) ToWorkforcePoolMapOutput() WorkforcePoolMapOutput

func (WorkforcePoolMap) ToWorkforcePoolMapOutputWithContext added in v6.42.0 

func (i WorkforcePoolMap) ToWorkforcePoolMapOutputWithContext(ctx context.Context) WorkforcePoolMapOutput

type WorkforcePoolMapInput added in v6.42.0 

type WorkforcePoolMapInput interface {
	pulumi.Input

	ToWorkforcePoolMapOutput() WorkforcePoolMapOutput
	ToWorkforcePoolMapOutputWithContext(context.Context) WorkforcePoolMapOutput
}

WorkforcePoolMapInput is an input type that accepts WorkforcePoolMap and WorkforcePoolMapOutput values. You can construct a concrete instance of `WorkforcePoolMapInput` via: 

WorkforcePoolMap{ "key": WorkforcePoolArgs{...} }

type WorkforcePoolMapOutput added in v6.42.0 

type WorkforcePoolMapOutput struct{ *pulumi.OutputState }

func (WorkforcePoolMapOutput) ElementType added in v6.42.0 

func (WorkforcePoolMapOutput) ElementType() reflect.Type

func (WorkforcePoolMapOutput) MapIndex added in v6.42.0 

func (o WorkforcePoolMapOutput) MapIndex(k pulumi.StringInput) WorkforcePoolOutput

func (WorkforcePoolMapOutput) ToWorkforcePoolMapOutput added in v6.42.0 

func (o WorkforcePoolMapOutput) ToWorkforcePoolMapOutput() WorkforcePoolMapOutput

func (WorkforcePoolMapOutput) ToWorkforcePoolMapOutputWithContext added in v6.42.0 

func (o WorkforcePoolMapOutput) ToWorkforcePoolMapOutputWithContext(ctx context.Context) WorkforcePoolMapOutput

type WorkforcePoolOutput added in v6.42.0 

type WorkforcePoolOutput struct{ *pulumi.OutputState }

func (WorkforcePoolOutput) Description added in v6.42.0 

func (o WorkforcePoolOutput) Description() pulumi.StringPtrOutput

A user-specified description of the pool. Cannot exceed 256 characters.

func (WorkforcePoolOutput) Disabled added in v6.42.0 

func (o WorkforcePoolOutput) Disabled() pulumi.BoolPtrOutput

Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.

func (WorkforcePoolOutput) DisplayName added in v6.42.0 

func (o WorkforcePoolOutput) DisplayName() pulumi.StringPtrOutput

A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.

func (WorkforcePoolOutput) ElementType added in v6.42.0 

func (WorkforcePoolOutput) ElementType() reflect.Type

func (WorkforcePoolOutput) Location added in v6.42.0 

func (o WorkforcePoolOutput) Location() pulumi.StringOutput

The location for the resource.

func (WorkforcePoolOutput) Name added in v6.42.0 

func (o WorkforcePoolOutput) Name() pulumi.StringOutput

Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforcePoolId}`

func (WorkforcePoolOutput) Parent added in v6.42.0 

func (o WorkforcePoolOutput) Parent() pulumi.StringOutput

Immutable. The resource name of the parent. Format: `organizations/{org-id}`.

***

func (WorkforcePoolOutput) SessionDuration added in v6.42.0 

func (o WorkforcePoolOutput) SessionDuration() pulumi.StringPtrOutput

Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `sessionDuration` is not configured, minted credentials have a default duration of one hour (3600s). A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: "`3.5s`".

func (WorkforcePoolOutput) State added in v6.42.0 

func (o WorkforcePoolOutput) State() pulumi.StringOutput

Output only. The state of the pool.

func (WorkforcePoolOutput) ToWorkforcePoolOutput added in v6.42.0 

func (o WorkforcePoolOutput) ToWorkforcePoolOutput() WorkforcePoolOutput

func (WorkforcePoolOutput) ToWorkforcePoolOutputWithContext added in v6.42.0 

func (o WorkforcePoolOutput) ToWorkforcePoolOutputWithContext(ctx context.Context) WorkforcePoolOutput

func (WorkforcePoolOutput) WorkforcePoolId added in v6.42.0 

func (o WorkforcePoolOutput) WorkforcePoolId() pulumi.StringOutput

The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix `gcp-` is reserved for use by Google, and may not be specified.

type WorkforcePoolProvider added in v6.45.0 

type WorkforcePoolProvider struct {
	pulumi.CustomResourceState

	// A [Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrOutput `pulumi:"attributeCondition"`
	// Maps attributes from the authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings.
	//   This is also the subject that appears in Cloud Logging logs. This is a required field and
	//   the mapped subject cannot exceed 127 bytes.
	// * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to
	//   resources using an IAM `principalSet` binding; access applies to all members of the group.
	// * `google.display_name`: The name of the authenticated user. This is an optional field and
	//   the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	// * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo.
	//   This is an optional field. When set, the image will be visible as the user's profile picture.
	//   If not set, a generic user icon will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute}
	//   is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes.
	//   The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a workforce pool
	//   to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/locations/{location}/workforcePools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
	//   For example, the following maps the sub claim of the incoming credential to the `subject` attribute
	//   on a Google token:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// An object containing a list of `"key": value` pairs.
	// Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
	AttributeMapping pulumi.StringMapOutput `pulumi:"attributeMapping"`
	// A user-specified description of the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrOutput `pulumi:"disabled"`
	// A user-specified display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The location for the resource.
	Location pulumi.StringOutput `pulumi:"location"`
	// Output only. The resource name of the provider.
	// Format: `locations/{location}/workforcePools/{workforcePoolId}/providers/{providerId}`
	Name pulumi.StringOutput `pulumi:"name"`
	// Represents an OpenId Connect 1.0 identity provider.
	// Structure is documented below.
	Oidc WorkforcePoolProviderOidcPtrOutput `pulumi:"oidc"`
	// The ID for the provider, which becomes the final component of the resource name.
	// This value must be 4-32 characters, and may contain the characters [a-z0-9-].
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	ProviderId pulumi.StringOutput `pulumi:"providerId"`
	// Represents a SAML identity provider.
	// Structure is documented below.
	Saml WorkforcePoolProviderSamlPtrOutput `pulumi:"saml"`
	// The current state of the provider.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The provider is active and may be used to validate authentication credentials.
	// * DELETED: The provider is soft-deleted. Soft-deleted providers are permanently
	//   deleted after approximately 30 days. You can restore a soft-deleted provider using
	//   [providers.undelete](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers/undelete#google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePoolProvider).
	State pulumi.StringOutput `pulumi:"state"`
	// The ID to use for the pool, which becomes the final component of the resource name.
	// The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens.
	// It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringOutput `pulumi:"workforcePoolId"`
}

A configuration for an external identity provider.

To get more information about WorkforcePoolProvider, see:

* [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers) * How-to Guides

> **Note:** Ask your Google Cloud account team to request access to workforce identity federation for your billing/quota project. The account team notifies you when the project is granted access.

> **Warning:** All arguments including the following potentially sensitive values will be stored in the raw state as plain text: `oidc.client_secret.value.plain_text`. Read more about sensitive data in state.

## Example Usage ### Iam Workforce Pool Provider Saml Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProvider(ctx, "example", &iam.WorkforcePoolProviderArgs{
			WorkforcePoolId: pool.WorkforcePoolId,
			Location:        pool.Location,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Saml: &iam.WorkforcePoolProviderSamlArgs{
				IdpMetadataXml: pulumi.String("<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://test.com\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workforce Pool Provider Saml Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProvider(ctx, "example", &iam.WorkforcePoolProviderArgs{
			WorkforcePoolId: pool.WorkforcePoolId,
			Location:        pool.Location,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Saml: &iam.WorkforcePoolProviderSamlArgs{
				IdpMetadataXml: pulumi.String("<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://test.com\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"),
			},
			DisplayName:        pulumi.String("Display name"),
			Description:        pulumi.String("A sample SAML workforce pool provider."),
			Disabled:           pulumi.Bool(false),
			AttributeCondition: pulumi.String("true"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workforce Pool Provider Oidc Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProvider(ctx, "example", &iam.WorkforcePoolProviderArgs{
			WorkforcePoolId: pool.WorkforcePoolId,
			Location:        pool.Location,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Oidc: &iam.WorkforcePoolProviderOidcArgs{
				IssuerUri: pulumi.String("https://accounts.thirdparty.com"),
				ClientId:  pulumi.String("client-id"),
				ClientSecret: &iam.WorkforcePoolProviderOidcClientSecretArgs{
					Value: &iam.WorkforcePoolProviderOidcClientSecretValueArgs{
						PlainText: pulumi.String("client-secret"),
					},
				},
				WebSsoConfig: &iam.WorkforcePoolProviderOidcWebSsoConfigArgs{
					ResponseType:            pulumi.String("CODE"),
					AssertionClaimsBehavior: pulumi.String("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workforce Pool Provider Oidc Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProvider(ctx, "example", &iam.WorkforcePoolProviderArgs{
			WorkforcePoolId: pool.WorkforcePoolId,
			Location:        pool.Location,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Oidc: &iam.WorkforcePoolProviderOidcArgs{
				IssuerUri: pulumi.String("https://accounts.thirdparty.com"),
				ClientId:  pulumi.String("client-id"),
				ClientSecret: &iam.WorkforcePoolProviderOidcClientSecretArgs{
					Value: &iam.WorkforcePoolProviderOidcClientSecretValueArgs{
						PlainText: pulumi.String("client-secret"),
					},
				},
				WebSsoConfig: &iam.WorkforcePoolProviderOidcWebSsoConfigArgs{
					ResponseType:            pulumi.String("CODE"),
					AssertionClaimsBehavior: pulumi.String("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"),
				},
			},
			DisplayName:        pulumi.String("Display name"),
			Description:        pulumi.String("A sample OIDC workforce pool provider."),
			Disabled:           pulumi.Bool(false),
			AttributeCondition: pulumi.String("true"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

```

## Import

WorkforcePoolProvider can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/workforcePoolProvider:WorkforcePoolProvider default locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}

```

```sh 

$ pulumi import gcp:iam/workforcePoolProvider:WorkforcePoolProvider default {{location}}/{{workforce_pool_id}}/{{provider_id}}

```

func GetWorkforcePoolProvider added in v6.45.0 

func GetWorkforcePoolProvider(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *WorkforcePoolProviderState, opts ...pulumi.ResourceOption) (*WorkforcePoolProvider, error)

GetWorkforcePoolProvider gets an existing WorkforcePoolProvider resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewWorkforcePoolProvider added in v6.45.0 

func NewWorkforcePoolProvider(ctx *pulumi.Context,
	name string, args *WorkforcePoolProviderArgs, opts ...pulumi.ResourceOption) (*WorkforcePoolProvider, error)

NewWorkforcePoolProvider registers a new resource with the given unique name, arguments, and options.

func (*WorkforcePoolProvider) ElementType added in v6.45.0 

func (*WorkforcePoolProvider) ElementType() reflect.Type

func (*WorkforcePoolProvider) ToWorkforcePoolProviderOutput added in v6.45.0 

func (i *WorkforcePoolProvider) ToWorkforcePoolProviderOutput() WorkforcePoolProviderOutput

func (*WorkforcePoolProvider) ToWorkforcePoolProviderOutputWithContext added in v6.45.0 

func (i *WorkforcePoolProvider) ToWorkforcePoolProviderOutputWithContext(ctx context.Context) WorkforcePoolProviderOutput

type WorkforcePoolProviderArgs added in v6.45.0 

type WorkforcePoolProviderArgs struct {
	// A [Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrInput
	// Maps attributes from the authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings.
	//   This is also the subject that appears in Cloud Logging logs. This is a required field and
	//   the mapped subject cannot exceed 127 bytes.
	// * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to
	//   resources using an IAM `principalSet` binding; access applies to all members of the group.
	// * `google.display_name`: The name of the authenticated user. This is an optional field and
	//   the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	// * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo.
	//   This is an optional field. When set, the image will be visible as the user's profile picture.
	//   If not set, a generic user icon will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute}
	//   is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes.
	//   The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a workforce pool
	//   to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/locations/{location}/workforcePools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
	//   For example, the following maps the sub claim of the incoming credential to the `subject` attribute
	//   on a Google token:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// An object containing a list of `"key": value` pairs.
	// Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
	AttributeMapping pulumi.StringMapInput
	// A user-specified description of the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrInput
	// A user-specified display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The location for the resource.
	Location pulumi.StringInput
	// Represents an OpenId Connect 1.0 identity provider.
	// Structure is documented below.
	Oidc WorkforcePoolProviderOidcPtrInput
	// The ID for the provider, which becomes the final component of the resource name.
	// This value must be 4-32 characters, and may contain the characters [a-z0-9-].
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	ProviderId pulumi.StringInput
	// Represents a SAML identity provider.
	// Structure is documented below.
	Saml WorkforcePoolProviderSamlPtrInput
	// The ID to use for the pool, which becomes the final component of the resource name.
	// The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens.
	// It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringInput
}

The set of arguments for constructing a WorkforcePoolProvider resource.

func (WorkforcePoolProviderArgs) ElementType added in v6.45.0 

func (WorkforcePoolProviderArgs) ElementType() reflect.Type

type WorkforcePoolProviderArray added in v6.45.0 

type WorkforcePoolProviderArray []WorkforcePoolProviderInput

func (WorkforcePoolProviderArray) ElementType added in v6.45.0 

func (WorkforcePoolProviderArray) ElementType() reflect.Type

func (WorkforcePoolProviderArray) ToWorkforcePoolProviderArrayOutput added in v6.45.0 

func (i WorkforcePoolProviderArray) ToWorkforcePoolProviderArrayOutput() WorkforcePoolProviderArrayOutput

func (WorkforcePoolProviderArray) ToWorkforcePoolProviderArrayOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderArray) ToWorkforcePoolProviderArrayOutputWithContext(ctx context.Context) WorkforcePoolProviderArrayOutput

type WorkforcePoolProviderArrayInput added in v6.45.0 

type WorkforcePoolProviderArrayInput interface {
	pulumi.Input

	ToWorkforcePoolProviderArrayOutput() WorkforcePoolProviderArrayOutput
	ToWorkforcePoolProviderArrayOutputWithContext(context.Context) WorkforcePoolProviderArrayOutput
}

WorkforcePoolProviderArrayInput is an input type that accepts WorkforcePoolProviderArray and WorkforcePoolProviderArrayOutput values. You can construct a concrete instance of `WorkforcePoolProviderArrayInput` via: 

WorkforcePoolProviderArray{ WorkforcePoolProviderArgs{...} }

type WorkforcePoolProviderArrayOutput added in v6.45.0 

type WorkforcePoolProviderArrayOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderArrayOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderArrayOutput) ElementType() reflect.Type

func (WorkforcePoolProviderArrayOutput) Index added in v6.45.0 

func (o WorkforcePoolProviderArrayOutput) Index(i pulumi.IntInput) WorkforcePoolProviderOutput

func (WorkforcePoolProviderArrayOutput) ToWorkforcePoolProviderArrayOutput added in v6.45.0 

func (o WorkforcePoolProviderArrayOutput) ToWorkforcePoolProviderArrayOutput() WorkforcePoolProviderArrayOutput

func (WorkforcePoolProviderArrayOutput) ToWorkforcePoolProviderArrayOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderArrayOutput) ToWorkforcePoolProviderArrayOutputWithContext(ctx context.Context) WorkforcePoolProviderArrayOutput

type WorkforcePoolProviderInput added in v6.45.0 

type WorkforcePoolProviderInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOutput() WorkforcePoolProviderOutput
	ToWorkforcePoolProviderOutputWithContext(ctx context.Context) WorkforcePoolProviderOutput
}

type WorkforcePoolProviderMap added in v6.45.0 

type WorkforcePoolProviderMap map[string]WorkforcePoolProviderInput

func (WorkforcePoolProviderMap) ElementType added in v6.45.0 

func (WorkforcePoolProviderMap) ElementType() reflect.Type

func (WorkforcePoolProviderMap) ToWorkforcePoolProviderMapOutput added in v6.45.0 

func (i WorkforcePoolProviderMap) ToWorkforcePoolProviderMapOutput() WorkforcePoolProviderMapOutput

func (WorkforcePoolProviderMap) ToWorkforcePoolProviderMapOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderMap) ToWorkforcePoolProviderMapOutputWithContext(ctx context.Context) WorkforcePoolProviderMapOutput

type WorkforcePoolProviderMapInput added in v6.45.0 

type WorkforcePoolProviderMapInput interface {
	pulumi.Input

	ToWorkforcePoolProviderMapOutput() WorkforcePoolProviderMapOutput
	ToWorkforcePoolProviderMapOutputWithContext(context.Context) WorkforcePoolProviderMapOutput
}

WorkforcePoolProviderMapInput is an input type that accepts WorkforcePoolProviderMap and WorkforcePoolProviderMapOutput values. You can construct a concrete instance of `WorkforcePoolProviderMapInput` via: 

WorkforcePoolProviderMap{ "key": WorkforcePoolProviderArgs{...} }

type WorkforcePoolProviderMapOutput added in v6.45.0 

type WorkforcePoolProviderMapOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderMapOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderMapOutput) ElementType() reflect.Type

func (WorkforcePoolProviderMapOutput) MapIndex added in v6.45.0 

func (o WorkforcePoolProviderMapOutput) MapIndex(k pulumi.StringInput) WorkforcePoolProviderOutput

func (WorkforcePoolProviderMapOutput) ToWorkforcePoolProviderMapOutput added in v6.45.0 

func (o WorkforcePoolProviderMapOutput) ToWorkforcePoolProviderMapOutput() WorkforcePoolProviderMapOutput

func (WorkforcePoolProviderMapOutput) ToWorkforcePoolProviderMapOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderMapOutput) ToWorkforcePoolProviderMapOutputWithContext(ctx context.Context) WorkforcePoolProviderMapOutput

type WorkforcePoolProviderOidc added in v6.45.0 

type WorkforcePoolProviderOidc struct {
	// The client ID. Must match the audience claim of the JWT issued by the identity provider.
	ClientId string `pulumi:"clientId"`
	// The optional client secret. Required to enable Authorization Code flow for web sign-in.
	// Structure is documented below.
	ClientSecret *WorkforcePoolProviderOidcClientSecret `pulumi:"clientSecret"`
	// The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
	IssuerUri string `pulumi:"issuerUri"`
	// Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.
	// Structure is documented below.
	WebSsoConfig *WorkforcePoolProviderOidcWebSsoConfig `pulumi:"webSsoConfig"`
}

type WorkforcePoolProviderOidcArgs added in v6.45.0 

type WorkforcePoolProviderOidcArgs struct {
	// The client ID. Must match the audience claim of the JWT issued by the identity provider.
	ClientId pulumi.StringInput `pulumi:"clientId"`
	// The optional client secret. Required to enable Authorization Code flow for web sign-in.
	// Structure is documented below.
	ClientSecret WorkforcePoolProviderOidcClientSecretPtrInput `pulumi:"clientSecret"`
	// The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
	IssuerUri pulumi.StringInput `pulumi:"issuerUri"`
	// Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.
	// Structure is documented below.
	WebSsoConfig WorkforcePoolProviderOidcWebSsoConfigPtrInput `pulumi:"webSsoConfig"`
}

func (WorkforcePoolProviderOidcArgs) ElementType added in v6.45.0 

func (WorkforcePoolProviderOidcArgs) ElementType() reflect.Type

func (WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcOutput added in v6.45.0 

func (i WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcOutput() WorkforcePoolProviderOidcOutput

func (WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcOutput

func (WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcPtrOutput added in v6.45.0 

func (i WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcPtrOutput() WorkforcePoolProviderOidcPtrOutput

func (WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcPtrOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderOidcArgs) ToWorkforcePoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcPtrOutput

type WorkforcePoolProviderOidcClientSecret added in v6.60.0 

type WorkforcePoolProviderOidcClientSecret struct {
	// The value of the client secret.
	// Structure is documented below.
	Value *WorkforcePoolProviderOidcClientSecretValue `pulumi:"value"`
}

type WorkforcePoolProviderOidcClientSecretArgs added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretArgs struct {
	// The value of the client secret.
	// Structure is documented below.
	Value WorkforcePoolProviderOidcClientSecretValuePtrInput `pulumi:"value"`
}

func (WorkforcePoolProviderOidcClientSecretArgs) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretArgs) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretOutput added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretOutput() WorkforcePoolProviderOidcClientSecretOutput

func (WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretOutputWithContext added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretOutput

func (WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretPtrOutput added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretPtrOutput() WorkforcePoolProviderOidcClientSecretPtrOutput

func (WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretArgs) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretPtrOutput

type WorkforcePoolProviderOidcClientSecretInput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcClientSecretOutput() WorkforcePoolProviderOidcClientSecretOutput
	ToWorkforcePoolProviderOidcClientSecretOutputWithContext(context.Context) WorkforcePoolProviderOidcClientSecretOutput
}

WorkforcePoolProviderOidcClientSecretInput is an input type that accepts WorkforcePoolProviderOidcClientSecretArgs and WorkforcePoolProviderOidcClientSecretOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcClientSecretInput` via: 

WorkforcePoolProviderOidcClientSecretArgs{...}

type WorkforcePoolProviderOidcClientSecretOutput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcClientSecretOutput) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretOutput() WorkforcePoolProviderOidcClientSecretOutput

func (WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretOutput

func (WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutput() WorkforcePoolProviderOidcClientSecretPtrOutput

func (WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretPtrOutput

func (WorkforcePoolProviderOidcClientSecretOutput) Value added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretOutput) Value() WorkforcePoolProviderOidcClientSecretValuePtrOutput

The value of the client secret. Structure is documented below.

type WorkforcePoolProviderOidcClientSecretPtrInput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretPtrInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcClientSecretPtrOutput() WorkforcePoolProviderOidcClientSecretPtrOutput
	ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext(context.Context) WorkforcePoolProviderOidcClientSecretPtrOutput
}

WorkforcePoolProviderOidcClientSecretPtrInput is an input type that accepts WorkforcePoolProviderOidcClientSecretArgs, WorkforcePoolProviderOidcClientSecretPtr and WorkforcePoolProviderOidcClientSecretPtrOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcClientSecretPtrInput` via: 

        WorkforcePoolProviderOidcClientSecretArgs{...}

or:

        nil

func WorkforcePoolProviderOidcClientSecretPtr added in v6.60.0 

func WorkforcePoolProviderOidcClientSecretPtr(v *WorkforcePoolProviderOidcClientSecretArgs) WorkforcePoolProviderOidcClientSecretPtrInput

type WorkforcePoolProviderOidcClientSecretPtrOutput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretPtrOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcClientSecretPtrOutput) Elem added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretPtrOutput) Elem() WorkforcePoolProviderOidcClientSecretOutput

func (WorkforcePoolProviderOidcClientSecretPtrOutput) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretPtrOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretPtrOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretPtrOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutput() WorkforcePoolProviderOidcClientSecretPtrOutput

func (WorkforcePoolProviderOidcClientSecretPtrOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretPtrOutput) ToWorkforcePoolProviderOidcClientSecretPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretPtrOutput

func (WorkforcePoolProviderOidcClientSecretPtrOutput) Value added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretPtrOutput) Value() WorkforcePoolProviderOidcClientSecretValuePtrOutput

The value of the client secret. Structure is documented below.

type WorkforcePoolProviderOidcClientSecretValue added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValue struct {
	// The plain text of the client secret value.
	// **Note**: This property is sensitive and will not be displayed in the plan.
	PlainText string `pulumi:"plainText"`
	// (Output)
	// A thumbprint to represent the current client secret value.
	Thumbprint *string `pulumi:"thumbprint"`
}

type WorkforcePoolProviderOidcClientSecretValueArgs added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValueArgs struct {
	// The plain text of the client secret value.
	// **Note**: This property is sensitive and will not be displayed in the plan.
	PlainText pulumi.StringInput `pulumi:"plainText"`
	// (Output)
	// A thumbprint to represent the current client secret value.
	Thumbprint pulumi.StringPtrInput `pulumi:"thumbprint"`
}

func (WorkforcePoolProviderOidcClientSecretValueArgs) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretValueArgs) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValueOutput added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValueOutput() WorkforcePoolProviderOidcClientSecretValueOutput

func (WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValueOutputWithContext added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValueOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretValueOutput

func (WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput() WorkforcePoolProviderOidcClientSecretValuePtrOutput

func (WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext added in v6.60.0 

func (i WorkforcePoolProviderOidcClientSecretValueArgs) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretValuePtrOutput

type WorkforcePoolProviderOidcClientSecretValueInput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValueInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcClientSecretValueOutput() WorkforcePoolProviderOidcClientSecretValueOutput
	ToWorkforcePoolProviderOidcClientSecretValueOutputWithContext(context.Context) WorkforcePoolProviderOidcClientSecretValueOutput
}

WorkforcePoolProviderOidcClientSecretValueInput is an input type that accepts WorkforcePoolProviderOidcClientSecretValueArgs and WorkforcePoolProviderOidcClientSecretValueOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcClientSecretValueInput` via: 

WorkforcePoolProviderOidcClientSecretValueArgs{...}

type WorkforcePoolProviderOidcClientSecretValueOutput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValueOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcClientSecretValueOutput) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretValueOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretValueOutput) PlainText added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) PlainText() pulumi.StringOutput

The plain text of the client secret value. **Note**: This property is sensitive and will not be displayed in the plan.

func (WorkforcePoolProviderOidcClientSecretValueOutput) Thumbprint added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) Thumbprint() pulumi.StringPtrOutput

(Output) A thumbprint to represent the current client secret value.

func (WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValueOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValueOutput() WorkforcePoolProviderOidcClientSecretValueOutput

func (WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValueOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValueOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretValueOutput

func (WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput() WorkforcePoolProviderOidcClientSecretValuePtrOutput

func (WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValueOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretValuePtrOutput

type WorkforcePoolProviderOidcClientSecretValuePtrInput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValuePtrInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcClientSecretValuePtrOutput() WorkforcePoolProviderOidcClientSecretValuePtrOutput
	ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext(context.Context) WorkforcePoolProviderOidcClientSecretValuePtrOutput
}

WorkforcePoolProviderOidcClientSecretValuePtrInput is an input type that accepts WorkforcePoolProviderOidcClientSecretValueArgs, WorkforcePoolProviderOidcClientSecretValuePtr and WorkforcePoolProviderOidcClientSecretValuePtrOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcClientSecretValuePtrInput` via: 

        WorkforcePoolProviderOidcClientSecretValueArgs{...}

or:

        nil

func WorkforcePoolProviderOidcClientSecretValuePtr added in v6.60.0 

func WorkforcePoolProviderOidcClientSecretValuePtr(v *WorkforcePoolProviderOidcClientSecretValueArgs) WorkforcePoolProviderOidcClientSecretValuePtrInput

type WorkforcePoolProviderOidcClientSecretValuePtrOutput added in v6.60.0 

type WorkforcePoolProviderOidcClientSecretValuePtrOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) Elem added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValuePtrOutput) Elem() WorkforcePoolProviderOidcClientSecretValueOutput

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) ElementType added in v6.60.0 

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) PlainText added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValuePtrOutput) PlainText() pulumi.StringPtrOutput

The plain text of the client secret value. **Note**: This property is sensitive and will not be displayed in the plan.

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) Thumbprint added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValuePtrOutput) Thumbprint() pulumi.StringPtrOutput

(Output) A thumbprint to represent the current client secret value.

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValuePtrOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutput() WorkforcePoolProviderOidcClientSecretValuePtrOutput

func (WorkforcePoolProviderOidcClientSecretValuePtrOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext added in v6.60.0 

func (o WorkforcePoolProviderOidcClientSecretValuePtrOutput) ToWorkforcePoolProviderOidcClientSecretValuePtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcClientSecretValuePtrOutput

type WorkforcePoolProviderOidcInput added in v6.45.0 

type WorkforcePoolProviderOidcInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcOutput() WorkforcePoolProviderOidcOutput
	ToWorkforcePoolProviderOidcOutputWithContext(context.Context) WorkforcePoolProviderOidcOutput
}

WorkforcePoolProviderOidcInput is an input type that accepts WorkforcePoolProviderOidcArgs and WorkforcePoolProviderOidcOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcInput` via: 

WorkforcePoolProviderOidcArgs{...}

type WorkforcePoolProviderOidcOutput added in v6.45.0 

type WorkforcePoolProviderOidcOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcOutput) ClientId added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) ClientId() pulumi.StringOutput

The client ID. Must match the audience claim of the JWT issued by the identity provider.

func (WorkforcePoolProviderOidcOutput) ClientSecret added in v6.60.0 

func (o WorkforcePoolProviderOidcOutput) ClientSecret() WorkforcePoolProviderOidcClientSecretPtrOutput

The optional client secret. Required to enable Authorization Code flow for web sign-in. Structure is documented below.

func (WorkforcePoolProviderOidcOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderOidcOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcOutput) IssuerUri added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) IssuerUri() pulumi.StringOutput

The OIDC issuer URI. Must be a valid URI using the 'https' scheme.

func (WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcOutput added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcOutput() WorkforcePoolProviderOidcOutput

func (WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcOutput

func (WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcPtrOutput added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcPtrOutput() WorkforcePoolProviderOidcPtrOutput

func (WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcPtrOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderOidcOutput) ToWorkforcePoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcPtrOutput

func (WorkforcePoolProviderOidcOutput) WebSsoConfig added in v6.55.0 

func (o WorkforcePoolProviderOidcOutput) WebSsoConfig() WorkforcePoolProviderOidcWebSsoConfigPtrOutput

Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. Structure is documented below.

type WorkforcePoolProviderOidcPtrInput added in v6.45.0 

type WorkforcePoolProviderOidcPtrInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcPtrOutput() WorkforcePoolProviderOidcPtrOutput
	ToWorkforcePoolProviderOidcPtrOutputWithContext(context.Context) WorkforcePoolProviderOidcPtrOutput
}

WorkforcePoolProviderOidcPtrInput is an input type that accepts WorkforcePoolProviderOidcArgs, WorkforcePoolProviderOidcPtr and WorkforcePoolProviderOidcPtrOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcPtrInput` via: 

        WorkforcePoolProviderOidcArgs{...}

or:

        nil

func WorkforcePoolProviderOidcPtr added in v6.45.0 

func WorkforcePoolProviderOidcPtr(v *WorkforcePoolProviderOidcArgs) WorkforcePoolProviderOidcPtrInput

type WorkforcePoolProviderOidcPtrOutput added in v6.45.0 

type WorkforcePoolProviderOidcPtrOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcPtrOutput) ClientId added in v6.45.0 

func (o WorkforcePoolProviderOidcPtrOutput) ClientId() pulumi.StringPtrOutput

The client ID. Must match the audience claim of the JWT issued by the identity provider.

func (WorkforcePoolProviderOidcPtrOutput) ClientSecret added in v6.60.0 

func (o WorkforcePoolProviderOidcPtrOutput) ClientSecret() WorkforcePoolProviderOidcClientSecretPtrOutput

The optional client secret. Required to enable Authorization Code flow for web sign-in. Structure is documented below.

func (WorkforcePoolProviderOidcPtrOutput) Elem added in v6.45.0 

func (o WorkforcePoolProviderOidcPtrOutput) Elem() WorkforcePoolProviderOidcOutput

func (WorkforcePoolProviderOidcPtrOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderOidcPtrOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcPtrOutput) IssuerUri added in v6.45.0 

func (o WorkforcePoolProviderOidcPtrOutput) IssuerUri() pulumi.StringPtrOutput

The OIDC issuer URI. Must be a valid URI using the 'https' scheme.

func (WorkforcePoolProviderOidcPtrOutput) ToWorkforcePoolProviderOidcPtrOutput added in v6.45.0 

func (o WorkforcePoolProviderOidcPtrOutput) ToWorkforcePoolProviderOidcPtrOutput() WorkforcePoolProviderOidcPtrOutput

func (WorkforcePoolProviderOidcPtrOutput) ToWorkforcePoolProviderOidcPtrOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderOidcPtrOutput) ToWorkforcePoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcPtrOutput

func (WorkforcePoolProviderOidcPtrOutput) WebSsoConfig added in v6.55.0 

func (o WorkforcePoolProviderOidcPtrOutput) WebSsoConfig() WorkforcePoolProviderOidcWebSsoConfigPtrOutput

Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. Structure is documented below.

type WorkforcePoolProviderOidcWebSsoConfig added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfig struct {
	// The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
	// * MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
	// * ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims.
	//   Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.
	AssertionClaimsBehavior string `pulumi:"assertionClaimsBehavior"`
	// The Response Type to request for in the OIDC Authorization Request for web sign-in.
	// The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
	// * CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
	// * ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in.
	//   Possible values are: `CODE`, `ID_TOKEN`.
	ResponseType string `pulumi:"responseType"`
}

type WorkforcePoolProviderOidcWebSsoConfigArgs added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfigArgs struct {
	// The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
	// * MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
	// * ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims.
	//   Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.
	AssertionClaimsBehavior pulumi.StringInput `pulumi:"assertionClaimsBehavior"`
	// The Response Type to request for in the OIDC Authorization Request for web sign-in.
	// The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
	// * CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
	// * ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in.
	//   Possible values are: `CODE`, `ID_TOKEN`.
	ResponseType pulumi.StringInput `pulumi:"responseType"`
}

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ElementType added in v6.55.0 

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ElementType() reflect.Type

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigOutput added in v6.55.0 

func (i WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigOutput() WorkforcePoolProviderOidcWebSsoConfigOutput

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigOutputWithContext added in v6.55.0 

func (i WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcWebSsoConfigOutput

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput added in v6.55.0 

func (i WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput() WorkforcePoolProviderOidcWebSsoConfigPtrOutput

func (WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext added in v6.55.0 

func (i WorkforcePoolProviderOidcWebSsoConfigArgs) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcWebSsoConfigPtrOutput

type WorkforcePoolProviderOidcWebSsoConfigInput added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfigInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcWebSsoConfigOutput() WorkforcePoolProviderOidcWebSsoConfigOutput
	ToWorkforcePoolProviderOidcWebSsoConfigOutputWithContext(context.Context) WorkforcePoolProviderOidcWebSsoConfigOutput
}

WorkforcePoolProviderOidcWebSsoConfigInput is an input type that accepts WorkforcePoolProviderOidcWebSsoConfigArgs and WorkforcePoolProviderOidcWebSsoConfigOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcWebSsoConfigInput` via: 

WorkforcePoolProviderOidcWebSsoConfigArgs{...}

type WorkforcePoolProviderOidcWebSsoConfigOutput added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfigOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcWebSsoConfigOutput) AssertionClaimsBehavior added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) AssertionClaimsBehavior() pulumi.StringOutput

The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.

  • MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
  • ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims. Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ElementType added in v6.55.0 

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ResponseType added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) ResponseType() pulumi.StringOutput

The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.

  • CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
  • ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in. Possible values are: `CODE`, `ID_TOKEN`.

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigOutput added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigOutput() WorkforcePoolProviderOidcWebSsoConfigOutput

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigOutputWithContext added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcWebSsoConfigOutput

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput() WorkforcePoolProviderOidcWebSsoConfigPtrOutput

func (WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcWebSsoConfigPtrOutput

type WorkforcePoolProviderOidcWebSsoConfigPtrInput added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfigPtrInput interface {
	pulumi.Input

	ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput() WorkforcePoolProviderOidcWebSsoConfigPtrOutput
	ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext(context.Context) WorkforcePoolProviderOidcWebSsoConfigPtrOutput
}

WorkforcePoolProviderOidcWebSsoConfigPtrInput is an input type that accepts WorkforcePoolProviderOidcWebSsoConfigArgs, WorkforcePoolProviderOidcWebSsoConfigPtr and WorkforcePoolProviderOidcWebSsoConfigPtrOutput values. You can construct a concrete instance of `WorkforcePoolProviderOidcWebSsoConfigPtrInput` via: 

        WorkforcePoolProviderOidcWebSsoConfigArgs{...}

or:

        nil

func WorkforcePoolProviderOidcWebSsoConfigPtr added in v6.55.0 

func WorkforcePoolProviderOidcWebSsoConfigPtr(v *WorkforcePoolProviderOidcWebSsoConfigArgs) WorkforcePoolProviderOidcWebSsoConfigPtrInput

type WorkforcePoolProviderOidcWebSsoConfigPtrOutput added in v6.55.0 

type WorkforcePoolProviderOidcWebSsoConfigPtrOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) AssertionClaimsBehavior added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigPtrOutput) AssertionClaimsBehavior() pulumi.StringPtrOutput

The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.

  • MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
  • ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims. Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) Elem added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigPtrOutput) Elem() WorkforcePoolProviderOidcWebSsoConfigOutput

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ElementType added in v6.55.0 

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ResponseType added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ResponseType() pulumi.StringPtrOutput

The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.

  • CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
  • ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in. Possible values are: `CODE`, `ID_TOKEN`.

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutput() WorkforcePoolProviderOidcWebSsoConfigPtrOutput

func (WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext added in v6.55.0 

func (o WorkforcePoolProviderOidcWebSsoConfigPtrOutput) ToWorkforcePoolProviderOidcWebSsoConfigPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderOidcWebSsoConfigPtrOutput

type WorkforcePoolProviderOutput added in v6.45.0 

type WorkforcePoolProviderOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderOutput) AttributeCondition added in v6.45.0 

func (o WorkforcePoolProviderOutput) AttributeCondition() pulumi.StringPtrOutput

A [Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions:

func (WorkforcePoolProviderOutput) AttributeMapping added in v6.45.0 

func (o WorkforcePoolProviderOutput) AttributeMapping() pulumi.StringMapOutput

Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported:

  • `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes.
  • `google.groups`: Groups the authenticating user belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group.
  • `google.display_name`: The name of the authenticated user. This is an optional field and the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead. This attribute cannot be referenced in IAM bindings.
  • `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo. This is an optional field. When set, the image will be visible as the user's profile picture. If not set, a generic user icon will be displayed instead. This attribute cannot be referenced in IAM bindings. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute} is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workforce pool to Google Cloud resources. For example:
  • `google.subject`: `principal://iam.googleapis.com/locations/{location}/workforcePools/{pool}/subject/{value}`
  • `google.groups`: `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/group/{value}`
  • `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language](https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute. For example, the following maps the sub claim of the incoming credential to the `subject` attribute on a Google token:

```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

``` An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.

func (WorkforcePoolProviderOutput) Description added in v6.45.0 

func (o WorkforcePoolProviderOutput) Description() pulumi.StringPtrOutput

A user-specified description of the provider. Cannot exceed 256 characters.

func (WorkforcePoolProviderOutput) Disabled added in v6.45.0 

func (o WorkforcePoolProviderOutput) Disabled() pulumi.BoolPtrOutput

Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

func (WorkforcePoolProviderOutput) DisplayName added in v6.45.0 

func (o WorkforcePoolProviderOutput) DisplayName() pulumi.StringPtrOutput

A user-specified display name for the provider. Cannot exceed 32 characters.

func (WorkforcePoolProviderOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderOutput) ElementType() reflect.Type

func (WorkforcePoolProviderOutput) Location added in v6.45.0 

func (o WorkforcePoolProviderOutput) Location() pulumi.StringOutput

The location for the resource.

func (WorkforcePoolProviderOutput) Name added in v6.45.0 

func (o WorkforcePoolProviderOutput) Name() pulumi.StringOutput

Output only. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforcePoolId}/providers/{providerId}`

func (WorkforcePoolProviderOutput) Oidc added in v6.45.0 

func (o WorkforcePoolProviderOutput) Oidc() WorkforcePoolProviderOidcPtrOutput

Represents an OpenId Connect 1.0 identity provider. Structure is documented below.

func (WorkforcePoolProviderOutput) ProviderId added in v6.45.0 

func (o WorkforcePoolProviderOutput) ProviderId() pulumi.StringOutput

The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.

***

func (WorkforcePoolProviderOutput) Saml added in v6.45.0 

func (o WorkforcePoolProviderOutput) Saml() WorkforcePoolProviderSamlPtrOutput

Represents a SAML identity provider. Structure is documented below.

func (WorkforcePoolProviderOutput) State added in v6.45.0 

func (o WorkforcePoolProviderOutput) State() pulumi.StringOutput

The current state of the provider.

func (WorkforcePoolProviderOutput) ToWorkforcePoolProviderOutput added in v6.45.0 

func (o WorkforcePoolProviderOutput) ToWorkforcePoolProviderOutput() WorkforcePoolProviderOutput

func (WorkforcePoolProviderOutput) ToWorkforcePoolProviderOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderOutput) ToWorkforcePoolProviderOutputWithContext(ctx context.Context) WorkforcePoolProviderOutput

func (WorkforcePoolProviderOutput) WorkforcePoolId added in v6.45.0 

func (o WorkforcePoolProviderOutput) WorkforcePoolId() pulumi.StringOutput

The ID to use for the pool, which becomes the final component of the resource name. The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix `gcp-` is reserved for use by Google, and may not be specified.

type WorkforcePoolProviderSaml added in v6.45.0 

type WorkforcePoolProviderSaml struct {
	// SAML Identity provider configuration metadata xml doc.
	// The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
	// The max size of the acceptable xml document will be bounded to 128k characters.
	// The metadata xml document should satisfy the following constraints:
	// 1) Must contain an Identity Provider Entity ID.
	// 2) Must contain at least one non-expired signing key certificate.
	// 3) For each signing key:
	//    a) Valid from should be no more than 7 days from now.
	//    b) Valid to should be no more than 10 years in the future.
	// 4) Up to 3 IdP signing keys are allowed in the metadata xml.
	//    When updating the provider's metadata xml, at least one non-expired signing key
	//    must overlap with the existing metadata. This requirement is skipped if there are
	//    no non-expired signing keys present in the existing metadata.
	IdpMetadataXml string `pulumi:"idpMetadataXml"`
}

type WorkforcePoolProviderSamlArgs added in v6.45.0 

type WorkforcePoolProviderSamlArgs struct {
	// SAML Identity provider configuration metadata xml doc.
	// The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
	// The max size of the acceptable xml document will be bounded to 128k characters.
	// The metadata xml document should satisfy the following constraints:
	// 1) Must contain an Identity Provider Entity ID.
	// 2) Must contain at least one non-expired signing key certificate.
	// 3) For each signing key:
	//    a) Valid from should be no more than 7 days from now.
	//    b) Valid to should be no more than 10 years in the future.
	// 4) Up to 3 IdP signing keys are allowed in the metadata xml.
	//    When updating the provider's metadata xml, at least one non-expired signing key
	//    must overlap with the existing metadata. This requirement is skipped if there are
	//    no non-expired signing keys present in the existing metadata.
	IdpMetadataXml pulumi.StringInput `pulumi:"idpMetadataXml"`
}

func (WorkforcePoolProviderSamlArgs) ElementType added in v6.45.0 

func (WorkforcePoolProviderSamlArgs) ElementType() reflect.Type

func (WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlOutput added in v6.45.0 

func (i WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlOutput() WorkforcePoolProviderSamlOutput

func (WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlOutputWithContext(ctx context.Context) WorkforcePoolProviderSamlOutput

func (WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlPtrOutput added in v6.45.0 

func (i WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlPtrOutput() WorkforcePoolProviderSamlPtrOutput

func (WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlPtrOutputWithContext added in v6.45.0 

func (i WorkforcePoolProviderSamlArgs) ToWorkforcePoolProviderSamlPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderSamlPtrOutput

type WorkforcePoolProviderSamlInput added in v6.45.0 

type WorkforcePoolProviderSamlInput interface {
	pulumi.Input

	ToWorkforcePoolProviderSamlOutput() WorkforcePoolProviderSamlOutput
	ToWorkforcePoolProviderSamlOutputWithContext(context.Context) WorkforcePoolProviderSamlOutput
}

WorkforcePoolProviderSamlInput is an input type that accepts WorkforcePoolProviderSamlArgs and WorkforcePoolProviderSamlOutput values. You can construct a concrete instance of `WorkforcePoolProviderSamlInput` via: 

WorkforcePoolProviderSamlArgs{...}

type WorkforcePoolProviderSamlOutput added in v6.45.0 

type WorkforcePoolProviderSamlOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderSamlOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderSamlOutput) ElementType() reflect.Type

func (WorkforcePoolProviderSamlOutput) IdpMetadataXml added in v6.45.0 

func (o WorkforcePoolProviderSamlOutput) IdpMetadataXml() pulumi.StringOutput

SAML Identity provider configuration metadata xml doc. The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The max size of the acceptable xml document will be bounded to 128k characters. The metadata xml document should satisfy the following constraints:

  1. Must contain an Identity Provider Entity ID.
  2. Must contain at least one non-expired signing key certificate.
  3. For each signing key: a) Valid from should be no more than 7 days from now. b) Valid to should be no more than 10 years in the future.
  4. Up to 3 IdP signing keys are allowed in the metadata xml. When updating the provider's metadata xml, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.

func (WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlOutput added in v6.45.0 

func (o WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlOutput() WorkforcePoolProviderSamlOutput

func (WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlOutputWithContext(ctx context.Context) WorkforcePoolProviderSamlOutput

func (WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlPtrOutput added in v6.45.0 

func (o WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlPtrOutput() WorkforcePoolProviderSamlPtrOutput

func (WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlPtrOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderSamlOutput) ToWorkforcePoolProviderSamlPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderSamlPtrOutput

type WorkforcePoolProviderSamlPtrInput added in v6.45.0 

type WorkforcePoolProviderSamlPtrInput interface {
	pulumi.Input

	ToWorkforcePoolProviderSamlPtrOutput() WorkforcePoolProviderSamlPtrOutput
	ToWorkforcePoolProviderSamlPtrOutputWithContext(context.Context) WorkforcePoolProviderSamlPtrOutput
}

WorkforcePoolProviderSamlPtrInput is an input type that accepts WorkforcePoolProviderSamlArgs, WorkforcePoolProviderSamlPtr and WorkforcePoolProviderSamlPtrOutput values. You can construct a concrete instance of `WorkforcePoolProviderSamlPtrInput` via: 

        WorkforcePoolProviderSamlArgs{...}

or:

        nil

func WorkforcePoolProviderSamlPtr added in v6.45.0 

func WorkforcePoolProviderSamlPtr(v *WorkforcePoolProviderSamlArgs) WorkforcePoolProviderSamlPtrInput

type WorkforcePoolProviderSamlPtrOutput added in v6.45.0 

type WorkforcePoolProviderSamlPtrOutput struct{ *pulumi.OutputState }

func (WorkforcePoolProviderSamlPtrOutput) Elem added in v6.45.0 

func (o WorkforcePoolProviderSamlPtrOutput) Elem() WorkforcePoolProviderSamlOutput

func (WorkforcePoolProviderSamlPtrOutput) ElementType added in v6.45.0 

func (WorkforcePoolProviderSamlPtrOutput) ElementType() reflect.Type

func (WorkforcePoolProviderSamlPtrOutput) IdpMetadataXml added in v6.45.0 

func (o WorkforcePoolProviderSamlPtrOutput) IdpMetadataXml() pulumi.StringPtrOutput

SAML Identity provider configuration metadata xml doc. The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The max size of the acceptable xml document will be bounded to 128k characters. The metadata xml document should satisfy the following constraints:

  1. Must contain an Identity Provider Entity ID.
  2. Must contain at least one non-expired signing key certificate.
  3. For each signing key: a) Valid from should be no more than 7 days from now. b) Valid to should be no more than 10 years in the future.
  4. Up to 3 IdP signing keys are allowed in the metadata xml. When updating the provider's metadata xml, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.

func (WorkforcePoolProviderSamlPtrOutput) ToWorkforcePoolProviderSamlPtrOutput added in v6.45.0 

func (o WorkforcePoolProviderSamlPtrOutput) ToWorkforcePoolProviderSamlPtrOutput() WorkforcePoolProviderSamlPtrOutput

func (WorkforcePoolProviderSamlPtrOutput) ToWorkforcePoolProviderSamlPtrOutputWithContext added in v6.45.0 

func (o WorkforcePoolProviderSamlPtrOutput) ToWorkforcePoolProviderSamlPtrOutputWithContext(ctx context.Context) WorkforcePoolProviderSamlPtrOutput

type WorkforcePoolProviderState added in v6.45.0 

type WorkforcePoolProviderState struct {
	// A [Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrInput
	// Maps attributes from the authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings.
	//   This is also the subject that appears in Cloud Logging logs. This is a required field and
	//   the mapped subject cannot exceed 127 bytes.
	// * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to
	//   resources using an IAM `principalSet` binding; access applies to all members of the group.
	// * `google.display_name`: The name of the authenticated user. This is an optional field and
	//   the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	// * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo.
	//   This is an optional field. When set, the image will be visible as the user's profile picture.
	//   If not set, a generic user icon will be displayed instead.
	//   This attribute cannot be referenced in IAM bindings.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute}
	//   is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes.
	//   The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a workforce pool
	//   to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/locations/{location}/workforcePools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/locations/{location}/workforcePools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
	//   For example, the following maps the sub claim of the incoming credential to the `subject` attribute
	//   on a Google token:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// An object containing a list of `"key": value` pairs.
	// Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
	AttributeMapping pulumi.StringMapInput
	// A user-specified description of the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrInput
	// A user-specified display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The location for the resource.
	Location pulumi.StringPtrInput
	// Output only. The resource name of the provider.
	// Format: `locations/{location}/workforcePools/{workforcePoolId}/providers/{providerId}`
	Name pulumi.StringPtrInput
	// Represents an OpenId Connect 1.0 identity provider.
	// Structure is documented below.
	Oidc WorkforcePoolProviderOidcPtrInput
	// The ID for the provider, which becomes the final component of the resource name.
	// This value must be 4-32 characters, and may contain the characters [a-z0-9-].
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	ProviderId pulumi.StringPtrInput
	// Represents a SAML identity provider.
	// Structure is documented below.
	Saml WorkforcePoolProviderSamlPtrInput
	// The current state of the provider.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The provider is active and may be used to validate authentication credentials.
	// * DELETED: The provider is soft-deleted. Soft-deleted providers are permanently
	//   deleted after approximately 30 days. You can restore a soft-deleted provider using
	//   [providers.undelete](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers/undelete#google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePoolProvider).
	State pulumi.StringPtrInput
	// The ID to use for the pool, which becomes the final component of the resource name.
	// The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens.
	// It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringPtrInput
}

func (WorkforcePoolProviderState) ElementType added in v6.45.0 

func (WorkforcePoolProviderState) ElementType() reflect.Type

type WorkforcePoolState added in v6.42.0 

type WorkforcePoolState struct {
	// A user-specified description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens,
	// or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
	Disabled pulumi.BoolPtrInput
	// A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The location for the resource.
	Location pulumi.StringPtrInput
	// Output only. The resource name of the pool.
	// Format: `locations/{location}/workforcePools/{workforcePoolId}`
	Name pulumi.StringPtrInput
	// Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
	//
	// ***
	Parent pulumi.StringPtrInput
	// Duration that the Google Cloud access tokens, console sign-in sessions,
	// and `gcloud` sign-in sessions from this pool are valid.
	// Must be greater than 15 minutes (900s) and less than 12 hours (43200s).
	// If `sessionDuration` is not configured, minted credentials have a default duration of one hour (3600s).
	// A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: "`3.5s`".
	SessionDuration pulumi.StringPtrInput
	// Output only. The state of the pool.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The pool is active, and may be used in Google Cloud policies.
	// * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted
	//   after approximately 30 days. You can restore a soft-deleted pool using
	//   [workforcePools.undelete](https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools/undelete#google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePool).
	//   You cannot reuse the ID of a soft-deleted pool until it is permanently deleted.
	//   While a pool is deleted, you cannot use it to exchange tokens, or use
	//   existing tokens to access resources. If the pool is undeleted, existing
	//   tokens grant access again.
	State pulumi.StringPtrInput
	// The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters,
	// digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen.
	// The prefix `gcp-` is reserved for use by Google, and may not be specified.
	WorkforcePoolId pulumi.StringPtrInput
}

func (WorkforcePoolState) ElementType added in v6.42.0 

func (WorkforcePoolState) ElementType() reflect.Type

type WorkloadIdentityPool 

type WorkloadIdentityPool struct {
	pulumi.CustomResourceState

	// A description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use
	// existing tokens to access resources. If the pool is re-enabled, existing tokens grant
	// access again.
	Disabled pulumi.BoolPtrOutput `pulumi:"disabled"`
	// A display name for the pool. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The resource name of the pool as
	// `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}`.
	Name pulumi.StringOutput `pulumi:"name"`
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringOutput `pulumi:"project"`
	// The state of the pool.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The pool is active, and may be used in Google Cloud policies.
	// * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
	//   approximately 30 days. You can restore a soft-deleted pool using
	//   UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
	//   permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
	//   use existing tokens to access resources. If the pool is undeleted, existing tokens grant
	//   access again.
	State pulumi.StringOutput `pulumi:"state"`
	// The ID to use for the pool, which becomes the final component of the resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolId pulumi.StringOutput `pulumi:"workloadIdentityPoolId"`
}

Represents a collection of external workload identities. You can define IAM policies to grant these identities access to Google Cloud resources.

To get more information about WorkloadIdentityPool, see:

* [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools) * How-to Guides

## Example Usage ### Iam Workload Identity Pool Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workload Identity Pool Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
			Description:            pulumi.String("Identity pool for automated test"),
			Disabled:               pulumi.Bool(true),
			DisplayName:            pulumi.String("Name of pool"),
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

```

## Import

WorkloadIdentityPool can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}

```

```sh 

$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default {{project}}/{{workload_identity_pool_id}}

```

```sh 

$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default {{workload_identity_pool_id}}

```

func GetWorkloadIdentityPool 

func GetWorkloadIdentityPool(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *WorkloadIdentityPoolState, opts ...pulumi.ResourceOption) (*WorkloadIdentityPool, error)

GetWorkloadIdentityPool gets an existing WorkloadIdentityPool resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewWorkloadIdentityPool 

func NewWorkloadIdentityPool(ctx *pulumi.Context,
	name string, args *WorkloadIdentityPoolArgs, opts ...pulumi.ResourceOption) (*WorkloadIdentityPool, error)

NewWorkloadIdentityPool registers a new resource with the given unique name, arguments, and options.

func (*WorkloadIdentityPool) ElementType 

func (*WorkloadIdentityPool) ElementType() reflect.Type

func (*WorkloadIdentityPool) ToWorkloadIdentityPoolOutput 

func (i *WorkloadIdentityPool) ToWorkloadIdentityPoolOutput() WorkloadIdentityPoolOutput

func (*WorkloadIdentityPool) ToWorkloadIdentityPoolOutputWithContext 

func (i *WorkloadIdentityPool) ToWorkloadIdentityPoolOutputWithContext(ctx context.Context) WorkloadIdentityPoolOutput

type WorkloadIdentityPoolArgs 

type WorkloadIdentityPoolArgs struct {
	// A description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use
	// existing tokens to access resources. If the pool is re-enabled, existing tokens grant
	// access again.
	Disabled pulumi.BoolPtrInput
	// A display name for the pool. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringPtrInput
	// The ID to use for the pool, which becomes the final component of the resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolId pulumi.StringInput
}

The set of arguments for constructing a WorkloadIdentityPool resource.

func (WorkloadIdentityPoolArgs) ElementType 

func (WorkloadIdentityPoolArgs) ElementType() reflect.Type

type WorkloadIdentityPoolArray 

type WorkloadIdentityPoolArray []WorkloadIdentityPoolInput

func (WorkloadIdentityPoolArray) ElementType 

func (WorkloadIdentityPoolArray) ElementType() reflect.Type

func (WorkloadIdentityPoolArray) ToWorkloadIdentityPoolArrayOutput 

func (i WorkloadIdentityPoolArray) ToWorkloadIdentityPoolArrayOutput() WorkloadIdentityPoolArrayOutput

func (WorkloadIdentityPoolArray) ToWorkloadIdentityPoolArrayOutputWithContext 

func (i WorkloadIdentityPoolArray) ToWorkloadIdentityPoolArrayOutputWithContext(ctx context.Context) WorkloadIdentityPoolArrayOutput

type WorkloadIdentityPoolArrayInput 

type WorkloadIdentityPoolArrayInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolArrayOutput() WorkloadIdentityPoolArrayOutput
	ToWorkloadIdentityPoolArrayOutputWithContext(context.Context) WorkloadIdentityPoolArrayOutput
}

WorkloadIdentityPoolArrayInput is an input type that accepts WorkloadIdentityPoolArray and WorkloadIdentityPoolArrayOutput values. You can construct a concrete instance of `WorkloadIdentityPoolArrayInput` via: 

WorkloadIdentityPoolArray{ WorkloadIdentityPoolArgs{...} }

type WorkloadIdentityPoolArrayOutput 

type WorkloadIdentityPoolArrayOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolArrayOutput) ElementType 

func (WorkloadIdentityPoolArrayOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolArrayOutput) Index 

func (o WorkloadIdentityPoolArrayOutput) Index(i pulumi.IntInput) WorkloadIdentityPoolOutput

func (WorkloadIdentityPoolArrayOutput) ToWorkloadIdentityPoolArrayOutput 

func (o WorkloadIdentityPoolArrayOutput) ToWorkloadIdentityPoolArrayOutput() WorkloadIdentityPoolArrayOutput

func (WorkloadIdentityPoolArrayOutput) ToWorkloadIdentityPoolArrayOutputWithContext 

func (o WorkloadIdentityPoolArrayOutput) ToWorkloadIdentityPoolArrayOutputWithContext(ctx context.Context) WorkloadIdentityPoolArrayOutput

type WorkloadIdentityPoolInput 

type WorkloadIdentityPoolInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolOutput() WorkloadIdentityPoolOutput
	ToWorkloadIdentityPoolOutputWithContext(ctx context.Context) WorkloadIdentityPoolOutput
}

type WorkloadIdentityPoolMap 

type WorkloadIdentityPoolMap map[string]WorkloadIdentityPoolInput

func (WorkloadIdentityPoolMap) ElementType 

func (WorkloadIdentityPoolMap) ElementType() reflect.Type

func (WorkloadIdentityPoolMap) ToWorkloadIdentityPoolMapOutput 

func (i WorkloadIdentityPoolMap) ToWorkloadIdentityPoolMapOutput() WorkloadIdentityPoolMapOutput

func (WorkloadIdentityPoolMap) ToWorkloadIdentityPoolMapOutputWithContext 

func (i WorkloadIdentityPoolMap) ToWorkloadIdentityPoolMapOutputWithContext(ctx context.Context) WorkloadIdentityPoolMapOutput

type WorkloadIdentityPoolMapInput 

type WorkloadIdentityPoolMapInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolMapOutput() WorkloadIdentityPoolMapOutput
	ToWorkloadIdentityPoolMapOutputWithContext(context.Context) WorkloadIdentityPoolMapOutput
}

WorkloadIdentityPoolMapInput is an input type that accepts WorkloadIdentityPoolMap and WorkloadIdentityPoolMapOutput values. You can construct a concrete instance of `WorkloadIdentityPoolMapInput` via: 

WorkloadIdentityPoolMap{ "key": WorkloadIdentityPoolArgs{...} }

type WorkloadIdentityPoolMapOutput 

type WorkloadIdentityPoolMapOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolMapOutput) ElementType 

func (WorkloadIdentityPoolMapOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolMapOutput) MapIndex 

func (o WorkloadIdentityPoolMapOutput) MapIndex(k pulumi.StringInput) WorkloadIdentityPoolOutput

func (WorkloadIdentityPoolMapOutput) ToWorkloadIdentityPoolMapOutput 

func (o WorkloadIdentityPoolMapOutput) ToWorkloadIdentityPoolMapOutput() WorkloadIdentityPoolMapOutput

func (WorkloadIdentityPoolMapOutput) ToWorkloadIdentityPoolMapOutputWithContext 

func (o WorkloadIdentityPoolMapOutput) ToWorkloadIdentityPoolMapOutputWithContext(ctx context.Context) WorkloadIdentityPoolMapOutput

type WorkloadIdentityPoolOutput 

type WorkloadIdentityPoolOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolOutput) Description added in v6.23.0 

func (o WorkloadIdentityPoolOutput) Description() pulumi.StringPtrOutput

A description of the pool. Cannot exceed 256 characters.

func (WorkloadIdentityPoolOutput) Disabled added in v6.23.0 

func (o WorkloadIdentityPoolOutput) Disabled() pulumi.BoolPtrOutput

Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.

func (WorkloadIdentityPoolOutput) DisplayName added in v6.23.0 

func (o WorkloadIdentityPoolOutput) DisplayName() pulumi.StringPtrOutput

A display name for the pool. Cannot exceed 32 characters.

func (WorkloadIdentityPoolOutput) ElementType 

func (WorkloadIdentityPoolOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolOutput) Name added in v6.23.0 

func (o WorkloadIdentityPoolOutput) Name() pulumi.StringOutput

The resource name of the pool as `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}`.

func (WorkloadIdentityPoolOutput) Project added in v6.23.0 

func (o WorkloadIdentityPoolOutput) Project() pulumi.StringOutput

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

func (WorkloadIdentityPoolOutput) State added in v6.23.0 

func (o WorkloadIdentityPoolOutput) State() pulumi.StringOutput

The state of the pool.

  • STATE_UNSPECIFIED: State unspecified.
  • ACTIVE: The pool is active, and may be used in Google Cloud policies.
  • DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after approximately 30 days. You can restore a soft-deleted pool using UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or use existing tokens to access resources. If the pool is undeleted, existing tokens grant access again.

func (WorkloadIdentityPoolOutput) ToWorkloadIdentityPoolOutput 

func (o WorkloadIdentityPoolOutput) ToWorkloadIdentityPoolOutput() WorkloadIdentityPoolOutput

func (WorkloadIdentityPoolOutput) ToWorkloadIdentityPoolOutputWithContext 

func (o WorkloadIdentityPoolOutput) ToWorkloadIdentityPoolOutputWithContext(ctx context.Context) WorkloadIdentityPoolOutput

func (WorkloadIdentityPoolOutput) WorkloadIdentityPoolId added in v6.23.0 

func (o WorkloadIdentityPoolOutput) WorkloadIdentityPoolId() pulumi.StringOutput

The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.

***

type WorkloadIdentityPoolProvider 

type WorkloadIdentityPoolProvider struct {
	pulumi.CustomResourceState

	// [A Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrOutput `pulumi:"attributeCondition"`
	// Maps attributes from authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value
	//   in IAM bindings. This is also the subject that appears in Cloud Logging logs.
	//   Cannot exceed 127 characters.
	// * `google.groups`: Groups the external identity belongs to. You can grant groups
	//   access to resources using an IAM `principalSet` binding; access applies to all
	//   members of the group.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`,
	//   where `{custom_attribute}` is the name of the custom attribute to be mapped. You can
	//   define a maximum of 50 custom attributes. The maximum length of a mapped attribute key
	//   is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a
	//   workload to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For AWS providers, the following rules apply:
	// - If no attribute mapping is defined, the following default mapping applies:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// - If any custom attribute mappings are defined, they must include a mapping to the
	//   `google.subject` attribute.
	//   For OIDC providers, the following rules apply:
	// - Custom attribute mappings must be defined, and must include a mapping to the
	//   `google.subject` attribute. For example, the following maps the `sub` claim of the
	//   incoming credential to the `subject` attribute on a Google token.
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	AttributeMapping pulumi.StringMapOutput `pulumi:"attributeMapping"`
	// An Amazon Web Services identity provider. Not compatible with the property oidc.
	// Structure is documented below.
	Aws WorkloadIdentityPoolProviderAwsPtrOutput `pulumi:"aws"`
	// A description for the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrOutput `pulumi:"disabled"`
	// A display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrOutput `pulumi:"displayName"`
	// The resource name of the provider as
	// `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/providers/{workload_identity_pool_provider_id}`.
	Name pulumi.StringOutput `pulumi:"name"`
	// An OpenId Connect 1.0 identity provider. Not compatible with the property aws.
	// Structure is documented below.
	Oidc WorkloadIdentityPoolProviderOidcPtrOutput `pulumi:"oidc"`
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringOutput `pulumi:"project"`
	// The state of the provider.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The provider is active, and may be used to validate authentication credentials.
	// * DELETED: The provider is soft-deleted. Soft-deleted providers are permanently deleted
	//   after approximately 30 days. You can restore a soft-deleted provider using
	//   UndeleteWorkloadIdentityPoolProvider. You cannot reuse the ID of a soft-deleted provider
	//   until it is permanently deleted.
	State pulumi.StringOutput `pulumi:"state"`
	// The ID used for the pool, which is the final component of the pool resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	WorkloadIdentityPoolId pulumi.StringOutput `pulumi:"workloadIdentityPoolId"`
	// The ID for the provider, which becomes the final component of the resource name. This
	// value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolProviderId pulumi.StringOutput `pulumi:"workloadIdentityPoolProviderId"`
}

A configuration for an external identity provider.

To get more information about WorkloadIdentityPoolProvider, see:

* [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers) * How-to Guides

## Example Usage ### Iam Workload Identity Pool Provider Aws Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolProvider(ctx, "example", &iam.WorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolProviderId: pulumi.String("example-prvdr"),
			Aws: &iam.WorkloadIdentityPoolProviderAwsArgs{
				AccountId: pulumi.String("999999999999"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workload Identity Pool Provider Aws Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolProvider(ctx, "example", &iam.WorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolProviderId: pulumi.String("example-prvdr"),
			DisplayName:                    pulumi.String("Name of provider"),
			Description:                    pulumi.String("AWS identity pool provider for automated test"),
			Disabled:                       pulumi.Bool(true),
			AttributeCondition:             pulumi.String("attribute.aws_role==\"arn:aws:sts::999999999999:assumed-role/stack-eu-central-1-lambdaRole\""),
			AttributeMapping: pulumi.StringMap{
				"google.subject":        pulumi.String("assertion.arn"),
				"attribute.aws_account": pulumi.String("assertion.account"),
				"attribute.environment": pulumi.String("assertion.arn.contains(\":instance-profile/Production\") ? \"prod\" : \"test\""),
			},
			Aws: &iam.WorkloadIdentityPoolProviderAwsArgs{
				AccountId: pulumi.String("999999999999"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workload Identity Pool Provider Oidc Basic

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolProvider(ctx, "example", &iam.WorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolProviderId: pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Oidc: &iam.WorkloadIdentityPoolProviderOidcArgs{
				IssuerUri: pulumi.String("https://sts.windows.net/azure-tenant-id"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workload Identity Pool Provider Oidc Full

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolProvider(ctx, "example", &iam.WorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolProviderId: pulumi.String("example-prvdr"),
			DisplayName:                    pulumi.String("Name of provider"),
			Description:                    pulumi.String("OIDC identity pool provider for automated test"),
			Disabled:                       pulumi.Bool(true),
			AttributeCondition:             pulumi.String("\"e968c2ef-047c-498d-8d79-16ca1b61e77e\" in assertion.groups"),
			AttributeMapping: pulumi.StringMap{
				"google.subject":                  pulumi.String("\"azure::\" + assertion.tid + \"::\" + assertion.sub"),
				"attribute.tid":                   pulumi.String("assertion.tid"),
				"attribute.managed_identity_name": pulumi.String("      {\n        \"8bb39bdb-1cc5-4447-b7db-a19e920eb111\":\"workload1\",\n        \"55d36609-9bcf-48e0-a366-a3cf19027d2a\":\"workload2\"\n      }[assertion.oid]\n"),
			},
			Oidc: &iam.WorkloadIdentityPoolProviderOidcArgs{
				AllowedAudiences: pulumi.StringArray{
					pulumi.String("https://example.com/gcp-oidc-federation"),
					pulumi.String("example.com/gcp-oidc-federation"),
				},
				IssuerUri: pulumi.String("https://sts.windows.net/azure-tenant-id"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

``` ### Iam Workload Identity Pool Provider Oidc Upload Key

```go package main

import ( 

"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolProvider(ctx, "example", &iam.WorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolProviderId: pulumi.String("example-prvdr"),
			DisplayName:                    pulumi.String("Name of provider"),
			Description:                    pulumi.String("OIDC identity pool provider for automated test"),
			Disabled:                       pulumi.Bool(true),
			AttributeCondition:             pulumi.String("\"e968c2ef-047c-498d-8d79-16ca1b61e77e\" in assertion.groups"),
			AttributeMapping: pulumi.StringMap{
				"google.subject":                  pulumi.String("\"azure::\" + assertion.tid + \"::\" + assertion.sub"),
				"attribute.tid":                   pulumi.String("assertion.tid"),
				"attribute.managed_identity_name": pulumi.String("      {\n        \"8bb39bdb-1cc5-4447-b7db-a19e920eb111\":\"workload1\",\n        \"55d36609-9bcf-48e0-a366-a3cf19027d2a\":\"workload2\"\n      }[assertion.oid]\n"),
			},
			Oidc: &iam.WorkloadIdentityPoolProviderOidcArgs{
				AllowedAudiences: pulumi.StringArray{
					pulumi.String("https://example.com/gcp-oidc-federation"),
					pulumi.String("example.com/gcp-oidc-federation"),
				},
				IssuerUri: pulumi.String("https://sts.windows.net/azure-tenant-id"),
				JwksJson:  pulumi.String("{\"keys\":[{\"kty\":\"RSA\",\"alg\":\"RS256\",\"kid\":\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\",\"use\":\"sig\",\"e\":\"AQAB\",\"n\":\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\"}]}"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

```

## Import

WorkloadIdentityPoolProvider can be imported using any of these accepted formats

```sh 

$ pulumi import gcp:iam/workloadIdentityPoolProvider:WorkloadIdentityPoolProvider default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/providers/{{workload_identity_pool_provider_id}}

```

```sh 

$ pulumi import gcp:iam/workloadIdentityPoolProvider:WorkloadIdentityPoolProvider default {{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_provider_id}}

```

```sh 

$ pulumi import gcp:iam/workloadIdentityPoolProvider:WorkloadIdentityPoolProvider default {{workload_identity_pool_id}}/{{workload_identity_pool_provider_id}}

```

func GetWorkloadIdentityPoolProvider 

func GetWorkloadIdentityPoolProvider(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *WorkloadIdentityPoolProviderState, opts ...pulumi.ResourceOption) (*WorkloadIdentityPoolProvider, error)

GetWorkloadIdentityPoolProvider gets an existing WorkloadIdentityPoolProvider resource's state with the given name, ID, and optional state properties that are used to uniquely qualify the lookup (nil if not required).

func NewWorkloadIdentityPoolProvider 

func NewWorkloadIdentityPoolProvider(ctx *pulumi.Context,
	name string, args *WorkloadIdentityPoolProviderArgs, opts ...pulumi.ResourceOption) (*WorkloadIdentityPoolProvider, error)

NewWorkloadIdentityPoolProvider registers a new resource with the given unique name, arguments, and options.

func (*WorkloadIdentityPoolProvider) ElementType 

func (*WorkloadIdentityPoolProvider) ElementType() reflect.Type

func (*WorkloadIdentityPoolProvider) ToWorkloadIdentityPoolProviderOutput 

func (i *WorkloadIdentityPoolProvider) ToWorkloadIdentityPoolProviderOutput() WorkloadIdentityPoolProviderOutput

func (*WorkloadIdentityPoolProvider) ToWorkloadIdentityPoolProviderOutputWithContext 

func (i *WorkloadIdentityPoolProvider) ToWorkloadIdentityPoolProviderOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOutput

type WorkloadIdentityPoolProviderArgs 

type WorkloadIdentityPoolProviderArgs struct {
	// [A Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrInput
	// Maps attributes from authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value
	//   in IAM bindings. This is also the subject that appears in Cloud Logging logs.
	//   Cannot exceed 127 characters.
	// * `google.groups`: Groups the external identity belongs to. You can grant groups
	//   access to resources using an IAM `principalSet` binding; access applies to all
	//   members of the group.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`,
	//   where `{custom_attribute}` is the name of the custom attribute to be mapped. You can
	//   define a maximum of 50 custom attributes. The maximum length of a mapped attribute key
	//   is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a
	//   workload to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For AWS providers, the following rules apply:
	// - If no attribute mapping is defined, the following default mapping applies:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// - If any custom attribute mappings are defined, they must include a mapping to the
	//   `google.subject` attribute.
	//   For OIDC providers, the following rules apply:
	// - Custom attribute mappings must be defined, and must include a mapping to the
	//   `google.subject` attribute. For example, the following maps the `sub` claim of the
	//   incoming credential to the `subject` attribute on a Google token.
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	AttributeMapping pulumi.StringMapInput
	// An Amazon Web Services identity provider. Not compatible with the property oidc.
	// Structure is documented below.
	Aws WorkloadIdentityPoolProviderAwsPtrInput
	// A description for the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrInput
	// A display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// An OpenId Connect 1.0 identity provider. Not compatible with the property aws.
	// Structure is documented below.
	Oidc WorkloadIdentityPoolProviderOidcPtrInput
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringPtrInput
	// The ID used for the pool, which is the final component of the pool resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	WorkloadIdentityPoolId pulumi.StringInput
	// The ID for the provider, which becomes the final component of the resource name. This
	// value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolProviderId pulumi.StringInput
}

The set of arguments for constructing a WorkloadIdentityPoolProvider resource.

func (WorkloadIdentityPoolProviderArgs) ElementType 

func (WorkloadIdentityPoolProviderArgs) ElementType() reflect.Type

type WorkloadIdentityPoolProviderArray 

type WorkloadIdentityPoolProviderArray []WorkloadIdentityPoolProviderInput

func (WorkloadIdentityPoolProviderArray) ElementType 

func (WorkloadIdentityPoolProviderArray) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderArray) ToWorkloadIdentityPoolProviderArrayOutput 

func (i WorkloadIdentityPoolProviderArray) ToWorkloadIdentityPoolProviderArrayOutput() WorkloadIdentityPoolProviderArrayOutput

func (WorkloadIdentityPoolProviderArray) ToWorkloadIdentityPoolProviderArrayOutputWithContext 

func (i WorkloadIdentityPoolProviderArray) ToWorkloadIdentityPoolProviderArrayOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderArrayOutput

type WorkloadIdentityPoolProviderArrayInput 

type WorkloadIdentityPoolProviderArrayInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderArrayOutput() WorkloadIdentityPoolProviderArrayOutput
	ToWorkloadIdentityPoolProviderArrayOutputWithContext(context.Context) WorkloadIdentityPoolProviderArrayOutput
}

WorkloadIdentityPoolProviderArrayInput is an input type that accepts WorkloadIdentityPoolProviderArray and WorkloadIdentityPoolProviderArrayOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderArrayInput` via: 

WorkloadIdentityPoolProviderArray{ WorkloadIdentityPoolProviderArgs{...} }

type WorkloadIdentityPoolProviderArrayOutput 

type WorkloadIdentityPoolProviderArrayOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderArrayOutput) ElementType 

func (WorkloadIdentityPoolProviderArrayOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderArrayOutput) Index 

func (o WorkloadIdentityPoolProviderArrayOutput) Index(i pulumi.IntInput) WorkloadIdentityPoolProviderOutput

func (WorkloadIdentityPoolProviderArrayOutput) ToWorkloadIdentityPoolProviderArrayOutput 

func (o WorkloadIdentityPoolProviderArrayOutput) ToWorkloadIdentityPoolProviderArrayOutput() WorkloadIdentityPoolProviderArrayOutput

func (WorkloadIdentityPoolProviderArrayOutput) ToWorkloadIdentityPoolProviderArrayOutputWithContext 

func (o WorkloadIdentityPoolProviderArrayOutput) ToWorkloadIdentityPoolProviderArrayOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderArrayOutput

type WorkloadIdentityPoolProviderAws 

type WorkloadIdentityPoolProviderAws struct {
	// The AWS account ID.
	AccountId string `pulumi:"accountId"`
}

type WorkloadIdentityPoolProviderAwsArgs 

type WorkloadIdentityPoolProviderAwsArgs struct {
	// The AWS account ID.
	AccountId pulumi.StringInput `pulumi:"accountId"`
}

func (WorkloadIdentityPoolProviderAwsArgs) ElementType 

func (WorkloadIdentityPoolProviderAwsArgs) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsOutput 

func (i WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsOutput() WorkloadIdentityPoolProviderAwsOutput

func (WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsOutputWithContext 

func (i WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderAwsOutput

func (WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsPtrOutput 

func (i WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsPtrOutput() WorkloadIdentityPoolProviderAwsPtrOutput

func (WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext 

func (i WorkloadIdentityPoolProviderAwsArgs) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderAwsPtrOutput

type WorkloadIdentityPoolProviderAwsInput 

type WorkloadIdentityPoolProviderAwsInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderAwsOutput() WorkloadIdentityPoolProviderAwsOutput
	ToWorkloadIdentityPoolProviderAwsOutputWithContext(context.Context) WorkloadIdentityPoolProviderAwsOutput
}

WorkloadIdentityPoolProviderAwsInput is an input type that accepts WorkloadIdentityPoolProviderAwsArgs and WorkloadIdentityPoolProviderAwsOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderAwsInput` via: 

WorkloadIdentityPoolProviderAwsArgs{...}

type WorkloadIdentityPoolProviderAwsOutput 

type WorkloadIdentityPoolProviderAwsOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderAwsOutput) AccountId 

func (o WorkloadIdentityPoolProviderAwsOutput) AccountId() pulumi.StringOutput

The AWS account ID.

func (WorkloadIdentityPoolProviderAwsOutput) ElementType 

func (WorkloadIdentityPoolProviderAwsOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsOutput 

func (o WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsOutput() WorkloadIdentityPoolProviderAwsOutput

func (WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsOutputWithContext 

func (o WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderAwsOutput

func (WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsPtrOutput 

func (o WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsPtrOutput() WorkloadIdentityPoolProviderAwsPtrOutput

func (WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext 

func (o WorkloadIdentityPoolProviderAwsOutput) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderAwsPtrOutput

type WorkloadIdentityPoolProviderAwsPtrInput 

type WorkloadIdentityPoolProviderAwsPtrInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderAwsPtrOutput() WorkloadIdentityPoolProviderAwsPtrOutput
	ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext(context.Context) WorkloadIdentityPoolProviderAwsPtrOutput
}

WorkloadIdentityPoolProviderAwsPtrInput is an input type that accepts WorkloadIdentityPoolProviderAwsArgs, WorkloadIdentityPoolProviderAwsPtr and WorkloadIdentityPoolProviderAwsPtrOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderAwsPtrInput` via: 

        WorkloadIdentityPoolProviderAwsArgs{...}

or:

        nil

func WorkloadIdentityPoolProviderAwsPtr 

func WorkloadIdentityPoolProviderAwsPtr(v *WorkloadIdentityPoolProviderAwsArgs) WorkloadIdentityPoolProviderAwsPtrInput

type WorkloadIdentityPoolProviderAwsPtrOutput 

type WorkloadIdentityPoolProviderAwsPtrOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderAwsPtrOutput) AccountId 

func (o WorkloadIdentityPoolProviderAwsPtrOutput) AccountId() pulumi.StringPtrOutput

The AWS account ID.

func (WorkloadIdentityPoolProviderAwsPtrOutput) Elem 

func (o WorkloadIdentityPoolProviderAwsPtrOutput) Elem() WorkloadIdentityPoolProviderAwsOutput

func (WorkloadIdentityPoolProviderAwsPtrOutput) ElementType 

func (WorkloadIdentityPoolProviderAwsPtrOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderAwsPtrOutput) ToWorkloadIdentityPoolProviderAwsPtrOutput 

func (o WorkloadIdentityPoolProviderAwsPtrOutput) ToWorkloadIdentityPoolProviderAwsPtrOutput() WorkloadIdentityPoolProviderAwsPtrOutput

func (WorkloadIdentityPoolProviderAwsPtrOutput) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext 

func (o WorkloadIdentityPoolProviderAwsPtrOutput) ToWorkloadIdentityPoolProviderAwsPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderAwsPtrOutput

type WorkloadIdentityPoolProviderInput 

type WorkloadIdentityPoolProviderInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderOutput() WorkloadIdentityPoolProviderOutput
	ToWorkloadIdentityPoolProviderOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOutput
}

type WorkloadIdentityPoolProviderMap 

type WorkloadIdentityPoolProviderMap map[string]WorkloadIdentityPoolProviderInput

func (WorkloadIdentityPoolProviderMap) ElementType 

func (WorkloadIdentityPoolProviderMap) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderMap) ToWorkloadIdentityPoolProviderMapOutput 

func (i WorkloadIdentityPoolProviderMap) ToWorkloadIdentityPoolProviderMapOutput() WorkloadIdentityPoolProviderMapOutput

func (WorkloadIdentityPoolProviderMap) ToWorkloadIdentityPoolProviderMapOutputWithContext 

func (i WorkloadIdentityPoolProviderMap) ToWorkloadIdentityPoolProviderMapOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderMapOutput

type WorkloadIdentityPoolProviderMapInput 

type WorkloadIdentityPoolProviderMapInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderMapOutput() WorkloadIdentityPoolProviderMapOutput
	ToWorkloadIdentityPoolProviderMapOutputWithContext(context.Context) WorkloadIdentityPoolProviderMapOutput
}

WorkloadIdentityPoolProviderMapInput is an input type that accepts WorkloadIdentityPoolProviderMap and WorkloadIdentityPoolProviderMapOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderMapInput` via: 

WorkloadIdentityPoolProviderMap{ "key": WorkloadIdentityPoolProviderArgs{...} }

type WorkloadIdentityPoolProviderMapOutput 

type WorkloadIdentityPoolProviderMapOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderMapOutput) ElementType 

func (WorkloadIdentityPoolProviderMapOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderMapOutput) MapIndex 

func (o WorkloadIdentityPoolProviderMapOutput) MapIndex(k pulumi.StringInput) WorkloadIdentityPoolProviderOutput

func (WorkloadIdentityPoolProviderMapOutput) ToWorkloadIdentityPoolProviderMapOutput 

func (o WorkloadIdentityPoolProviderMapOutput) ToWorkloadIdentityPoolProviderMapOutput() WorkloadIdentityPoolProviderMapOutput

func (WorkloadIdentityPoolProviderMapOutput) ToWorkloadIdentityPoolProviderMapOutputWithContext 

func (o WorkloadIdentityPoolProviderMapOutput) ToWorkloadIdentityPoolProviderMapOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderMapOutput

type WorkloadIdentityPoolProviderOidc 

type WorkloadIdentityPoolProviderOidc struct {
	// Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
	// requests are rejected if the token audience does not match one of the configured
	// values. Each audience may be at most 256 characters. A maximum of 10 audiences may
	// be configured.
	// If this list is empty, the OIDC token audience must be equal to the full canonical
	// resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
	// For example:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	AllowedAudiences []string `pulumi:"allowedAudiences"`
	// The OIDC issuer URL.
	IssuerUri string `pulumi:"issuerUri"`
	// OIDC JWKs in JSON String format. For details on definition of a
	// JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
	// use the `jwksUri` from the discovery document fetched from the
	// .well-known path for the `issuerUri`. Currently, RSA and EC asymmetric
	// keys are supported. The JWK must use following format and include only
	// the following fields:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	JwksJson *string `pulumi:"jwksJson"`
}

type WorkloadIdentityPoolProviderOidcArgs 

type WorkloadIdentityPoolProviderOidcArgs struct {
	// Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
	// requests are rejected if the token audience does not match one of the configured
	// values. Each audience may be at most 256 characters. A maximum of 10 audiences may
	// be configured.
	// If this list is empty, the OIDC token audience must be equal to the full canonical
	// resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
	// For example:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	AllowedAudiences pulumi.StringArrayInput `pulumi:"allowedAudiences"`
	// The OIDC issuer URL.
	IssuerUri pulumi.StringInput `pulumi:"issuerUri"`
	// OIDC JWKs in JSON String format. For details on definition of a
	// JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
	// use the `jwksUri` from the discovery document fetched from the
	// .well-known path for the `issuerUri`. Currently, RSA and EC asymmetric
	// keys are supported. The JWK must use following format and include only
	// the following fields:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	JwksJson pulumi.StringPtrInput `pulumi:"jwksJson"`
}

func (WorkloadIdentityPoolProviderOidcArgs) ElementType 

func (WorkloadIdentityPoolProviderOidcArgs) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcOutput 

func (i WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcOutput() WorkloadIdentityPoolProviderOidcOutput

func (WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcOutputWithContext 

func (i WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOidcOutput

func (WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcPtrOutput 

func (i WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcPtrOutput() WorkloadIdentityPoolProviderOidcPtrOutput

func (WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext 

func (i WorkloadIdentityPoolProviderOidcArgs) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOidcPtrOutput

type WorkloadIdentityPoolProviderOidcInput 

type WorkloadIdentityPoolProviderOidcInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderOidcOutput() WorkloadIdentityPoolProviderOidcOutput
	ToWorkloadIdentityPoolProviderOidcOutputWithContext(context.Context) WorkloadIdentityPoolProviderOidcOutput
}

WorkloadIdentityPoolProviderOidcInput is an input type that accepts WorkloadIdentityPoolProviderOidcArgs and WorkloadIdentityPoolProviderOidcOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderOidcInput` via: 

WorkloadIdentityPoolProviderOidcArgs{...}

type WorkloadIdentityPoolProviderOidcOutput 

type WorkloadIdentityPoolProviderOidcOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderOidcOutput) AllowedAudiences 

func (o WorkloadIdentityPoolProviderOidcOutput) AllowedAudiences() pulumi.StringArrayOutput

Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

func (WorkloadIdentityPoolProviderOidcOutput) ElementType 

func (WorkloadIdentityPoolProviderOidcOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderOidcOutput) IssuerUri 

func (o WorkloadIdentityPoolProviderOidcOutput) IssuerUri() pulumi.StringOutput

The OIDC issuer URL.

func (WorkloadIdentityPoolProviderOidcOutput) JwksJson added in v6.60.0 

func (o WorkloadIdentityPoolProviderOidcOutput) JwksJson() pulumi.StringPtrOutput

OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the `jwksUri` from the discovery document fetched from the .well-known path for the `issuerUri`. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

func (WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcOutput 

func (o WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcOutput() WorkloadIdentityPoolProviderOidcOutput

func (WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcOutputWithContext 

func (o WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOidcOutput

func (WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcPtrOutput 

func (o WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcPtrOutput() WorkloadIdentityPoolProviderOidcPtrOutput

func (WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext 

func (o WorkloadIdentityPoolProviderOidcOutput) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOidcPtrOutput

type WorkloadIdentityPoolProviderOidcPtrInput 

type WorkloadIdentityPoolProviderOidcPtrInput interface {
	pulumi.Input

	ToWorkloadIdentityPoolProviderOidcPtrOutput() WorkloadIdentityPoolProviderOidcPtrOutput
	ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext(context.Context) WorkloadIdentityPoolProviderOidcPtrOutput
}

WorkloadIdentityPoolProviderOidcPtrInput is an input type that accepts WorkloadIdentityPoolProviderOidcArgs, WorkloadIdentityPoolProviderOidcPtr and WorkloadIdentityPoolProviderOidcPtrOutput values. You can construct a concrete instance of `WorkloadIdentityPoolProviderOidcPtrInput` via: 

        WorkloadIdentityPoolProviderOidcArgs{...}

or:

        nil

func WorkloadIdentityPoolProviderOidcPtr 

func WorkloadIdentityPoolProviderOidcPtr(v *WorkloadIdentityPoolProviderOidcArgs) WorkloadIdentityPoolProviderOidcPtrInput

type WorkloadIdentityPoolProviderOidcPtrOutput 

type WorkloadIdentityPoolProviderOidcPtrOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderOidcPtrOutput) AllowedAudiences 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) AllowedAudiences() pulumi.StringArrayOutput

Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

func (WorkloadIdentityPoolProviderOidcPtrOutput) Elem 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) Elem() WorkloadIdentityPoolProviderOidcOutput

func (WorkloadIdentityPoolProviderOidcPtrOutput) ElementType 

func (WorkloadIdentityPoolProviderOidcPtrOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderOidcPtrOutput) IssuerUri 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) IssuerUri() pulumi.StringPtrOutput

The OIDC issuer URL.

func (WorkloadIdentityPoolProviderOidcPtrOutput) JwksJson added in v6.60.0 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) JwksJson() pulumi.StringPtrOutput

OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the `jwksUri` from the discovery document fetched from the .well-known path for the `issuerUri`. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

func (WorkloadIdentityPoolProviderOidcPtrOutput) ToWorkloadIdentityPoolProviderOidcPtrOutput 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) ToWorkloadIdentityPoolProviderOidcPtrOutput() WorkloadIdentityPoolProviderOidcPtrOutput

func (WorkloadIdentityPoolProviderOidcPtrOutput) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext 

func (o WorkloadIdentityPoolProviderOidcPtrOutput) ToWorkloadIdentityPoolProviderOidcPtrOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOidcPtrOutput

type WorkloadIdentityPoolProviderOutput 

type WorkloadIdentityPoolProviderOutput struct{ *pulumi.OutputState }

func (WorkloadIdentityPoolProviderOutput) AttributeCondition added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) AttributeCondition() pulumi.StringPtrOutput

[A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions:

func (WorkloadIdentityPoolProviderOutput) AttributeMapping added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) AttributeMapping() pulumi.StringMapOutput

Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported:

  • `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters.
  • `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example:
  • `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
  • `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
  • `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language](https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, the following rules apply:
  • If no attribute mapping is defined, the following default mapping applies:

```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

  • If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, the following rules apply:
  • Custom attribute mappings must be defined, and must include a mapping to the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token.

```go package main

import ( 

"github.com/pulumi/pulumi/sdk/v3/go/pulumi"

) 

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

```

func (WorkloadIdentityPoolProviderOutput) Aws added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Aws() WorkloadIdentityPoolProviderAwsPtrOutput

An Amazon Web Services identity provider. Not compatible with the property oidc. Structure is documented below.

func (WorkloadIdentityPoolProviderOutput) Description added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Description() pulumi.StringPtrOutput

A description for the provider. Cannot exceed 256 characters.

func (WorkloadIdentityPoolProviderOutput) Disabled added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Disabled() pulumi.BoolPtrOutput

Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

func (WorkloadIdentityPoolProviderOutput) DisplayName added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) DisplayName() pulumi.StringPtrOutput

A display name for the provider. Cannot exceed 32 characters.

func (WorkloadIdentityPoolProviderOutput) ElementType 

func (WorkloadIdentityPoolProviderOutput) ElementType() reflect.Type

func (WorkloadIdentityPoolProviderOutput) Name added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Name() pulumi.StringOutput

The resource name of the provider as `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/providers/{workload_identity_pool_provider_id}`.

func (WorkloadIdentityPoolProviderOutput) Oidc added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Oidc() WorkloadIdentityPoolProviderOidcPtrOutput

An OpenId Connect 1.0 identity provider. Not compatible with the property aws. Structure is documented below.

func (WorkloadIdentityPoolProviderOutput) Project added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) Project() pulumi.StringOutput

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

func (WorkloadIdentityPoolProviderOutput) State added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) State() pulumi.StringOutput

The state of the provider.

  • STATE_UNSPECIFIED: State unspecified.
  • ACTIVE: The provider is active, and may be used to validate authentication credentials.
  • DELETED: The provider is soft-deleted. Soft-deleted providers are permanently deleted after approximately 30 days. You can restore a soft-deleted provider using UndeleteWorkloadIdentityPoolProvider. You cannot reuse the ID of a soft-deleted provider until it is permanently deleted.

func (WorkloadIdentityPoolProviderOutput) ToWorkloadIdentityPoolProviderOutput 

func (o WorkloadIdentityPoolProviderOutput) ToWorkloadIdentityPoolProviderOutput() WorkloadIdentityPoolProviderOutput

func (WorkloadIdentityPoolProviderOutput) ToWorkloadIdentityPoolProviderOutputWithContext 

func (o WorkloadIdentityPoolProviderOutput) ToWorkloadIdentityPoolProviderOutputWithContext(ctx context.Context) WorkloadIdentityPoolProviderOutput

func (WorkloadIdentityPoolProviderOutput) WorkloadIdentityPoolId added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) WorkloadIdentityPoolId() pulumi.StringOutput

The ID used for the pool, which is the final component of the pool resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.

func (WorkloadIdentityPoolProviderOutput) WorkloadIdentityPoolProviderId added in v6.23.0 

func (o WorkloadIdentityPoolProviderOutput) WorkloadIdentityPoolProviderId() pulumi.StringOutput

The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.

***

type WorkloadIdentityPoolProviderState 

type WorkloadIdentityPoolProviderState struct {
	// [A Common Expression Language](https://opensource.google/projects/cel) expression, in
	// plain text, to restrict what otherwise valid authentication credentials issued by the
	// provider should not be accepted.
	// The expression must output a boolean representing whether to allow the federation.
	// The following keywords may be referenced in the expressions:
	AttributeCondition pulumi.StringPtrInput
	// Maps attributes from authentication credentials issued by an external identity provider
	// to Google Cloud attributes, such as `subject` and `segment`.
	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
	// The following keys are supported:
	// * `google.subject`: The principal IAM is authenticating. You can reference this value
	//   in IAM bindings. This is also the subject that appears in Cloud Logging logs.
	//   Cannot exceed 127 characters.
	// * `google.groups`: Groups the external identity belongs to. You can grant groups
	//   access to resources using an IAM `principalSet` binding; access applies to all
	//   members of the group.
	//   You can also provide custom attributes by specifying `attribute.{custom_attribute}`,
	//   where `{custom_attribute}` is the name of the custom attribute to be mapped. You can
	//   define a maximum of 50 custom attributes. The maximum length of a mapped attribute key
	//   is 100 characters, and the key may only contain the characters [a-z0-9_].
	//   You can reference these attributes in IAM policies to define fine-grained access for a
	//   workload to Google Cloud resources. For example:
	// * `google.subject`:
	//   `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
	// * `google.groups`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
	// * `attribute.{custom_attribute}`:
	//   `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}`
	//   Each value must be a [Common Expression Language](https://opensource.google/projects/cel)
	//   function that maps an identity provider credential to the normalized attribute specified
	//   by the corresponding map key.
	//   You can use the `assertion` keyword in the expression to access a JSON representation of
	//   the authentication credential issued by the provider.
	//   The maximum length of an attribute mapping expression is 2048 characters. When evaluated,
	//   the total size of all mapped attributes must not exceed 8KB.
	//   For AWS providers, the following rules apply:
	// - If no attribute mapping is defined, the following default mapping applies:
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	// - If any custom attribute mappings are defined, they must include a mapping to the
	//   `google.subject` attribute.
	//   For OIDC providers, the following rules apply:
	// - Custom attribute mappings must be defined, and must include a mapping to the
	//   `google.subject` attribute. For example, the following maps the `sub` claim of the
	//   incoming credential to the `subject` attribute on a Google token.
	// “`go
	// package main
	//
	// import (
	// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	// )
	//
	// func main() {
	// 	pulumi.Run(func(ctx *pulumi.Context) error {
	// 		return nil
	// 	})
	// }
	// “`
	AttributeMapping pulumi.StringMapInput
	// An Amazon Web Services identity provider. Not compatible with the property oidc.
	// Structure is documented below.
	Aws WorkloadIdentityPoolProviderAwsPtrInput
	// A description for the provider. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the provider is disabled. You cannot use a disabled provider to exchange tokens.
	// However, existing tokens still grant access.
	Disabled pulumi.BoolPtrInput
	// A display name for the provider. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The resource name of the provider as
	// `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/providers/{workload_identity_pool_provider_id}`.
	Name pulumi.StringPtrInput
	// An OpenId Connect 1.0 identity provider. Not compatible with the property aws.
	// Structure is documented below.
	Oidc WorkloadIdentityPoolProviderOidcPtrInput
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringPtrInput
	// The state of the provider.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The provider is active, and may be used to validate authentication credentials.
	// * DELETED: The provider is soft-deleted. Soft-deleted providers are permanently deleted
	//   after approximately 30 days. You can restore a soft-deleted provider using
	//   UndeleteWorkloadIdentityPoolProvider. You cannot reuse the ID of a soft-deleted provider
	//   until it is permanently deleted.
	State pulumi.StringPtrInput
	// The ID used for the pool, which is the final component of the pool resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	WorkloadIdentityPoolId pulumi.StringPtrInput
	// The ID for the provider, which becomes the final component of the resource name. This
	// value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolProviderId pulumi.StringPtrInput
}

func (WorkloadIdentityPoolProviderState) ElementType 

func (WorkloadIdentityPoolProviderState) ElementType() reflect.Type

type WorkloadIdentityPoolState 

type WorkloadIdentityPoolState struct {
	// A description of the pool. Cannot exceed 256 characters.
	Description pulumi.StringPtrInput
	// Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use
	// existing tokens to access resources. If the pool is re-enabled, existing tokens grant
	// access again.
	Disabled pulumi.BoolPtrInput
	// A display name for the pool. Cannot exceed 32 characters.
	DisplayName pulumi.StringPtrInput
	// The resource name of the pool as
	// `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}`.
	Name pulumi.StringPtrInput
	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project pulumi.StringPtrInput
	// The state of the pool.
	// * STATE_UNSPECIFIED: State unspecified.
	// * ACTIVE: The pool is active, and may be used in Google Cloud policies.
	// * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
	//   approximately 30 days. You can restore a soft-deleted pool using
	//   UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
	//   permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
	//   use existing tokens to access resources. If the pool is undeleted, existing tokens grant
	//   access again.
	State pulumi.StringPtrInput
	// The ID to use for the pool, which becomes the final component of the resource name. This
	// value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
	// `gcp-` is reserved for use by Google, and may not be specified.
	//
	// ***
	WorkloadIdentityPoolId pulumi.StringPtrInput
}

func (WorkloadIdentityPoolState) ElementType 

func (WorkloadIdentityPoolState) ElementType() reflect.Type

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.