@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
168 lines • 6.74 kB
JavaScript
;
// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.getAccountIdTokenOutput = exports.getAccountIdToken = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
* This data source provides a Google OpenID Connect (`oidc`) `idToken`. Tokens issued from this data source are typically used to call external services that accept OIDC tokens for authentication (e.g. [Google Cloud Run](https://cloud.google.com/run/docs/authenticating/service-to-service)).
*
* For more information see
* [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html#IDToken).
*
* ## Example Usage
*
* ### ServiceAccount JSON Credential File.
* `gcp.serviceaccount.getAccountIdToken` will use the configured provider credentials
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetAudience: "https://foo.bar/",
* });
* export const oidcToken = oidc.then(oidc => oidc.idToken);
* ```
*
* ### Service Account Impersonation.
* `gcp.serviceaccount.getAccountIdToken` will use background impersonated credentials provided by `gcp.serviceaccount.getAccountAccessToken`.
*
* Note: to use the following, you must grant `targetServiceAccount` the
* `roles/iam.serviceAccountTokenCreator` role on itself.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const impersonated = gcp.serviceaccount.getAccountAccessToken({
* targetServiceAccount: "impersonated-account@project.iam.gserviceaccount.com",
* delegates: [],
* scopes: [
* "userinfo-email",
* "cloud-platform",
* ],
* lifetime: "300s",
* });
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetServiceAccount: "impersonated-account@project.iam.gserviceaccount.com",
* delegates: [],
* includeEmail: true,
* targetAudience: "https://foo.bar/",
* });
* export const oidcToken = oidc.then(oidc => oidc.idToken);
* ```
*
* ### Invoking Cloud Run Endpoint
*
* The following configuration will invoke [Cloud Run](https://cloud.google.com/run/docs/authenticating/service-to-service) endpoint where the service account for the provider has been granted `roles/run.invoker` role previously.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
* import * as http from "@pulumi/http";
*
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetAudience: "https://your.cloud.run.app/",
* });
* const cloudrun = oidc.then(oidc => http.getHttp({
* url: "https://your.cloud.run.app/",
* requestHeaders: {
* Authorization: `Bearer ${oidc.idToken}`,
* },
* }));
* export const cloudRunResponse = cloudrun.then(cloudrun => cloudrun.body);
* ```
*/
function getAccountIdToken(args, opts) {
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
return pulumi.runtime.invoke("gcp:serviceaccount/getAccountIdToken:getAccountIdToken", {
"delegates": args.delegates,
"includeEmail": args.includeEmail,
"targetAudience": args.targetAudience,
"targetServiceAccount": args.targetServiceAccount,
}, opts);
}
exports.getAccountIdToken = getAccountIdToken;
/**
* This data source provides a Google OpenID Connect (`oidc`) `idToken`. Tokens issued from this data source are typically used to call external services that accept OIDC tokens for authentication (e.g. [Google Cloud Run](https://cloud.google.com/run/docs/authenticating/service-to-service)).
*
* For more information see
* [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html#IDToken).
*
* ## Example Usage
*
* ### ServiceAccount JSON Credential File.
* `gcp.serviceaccount.getAccountIdToken` will use the configured provider credentials
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetAudience: "https://foo.bar/",
* });
* export const oidcToken = oidc.then(oidc => oidc.idToken);
* ```
*
* ### Service Account Impersonation.
* `gcp.serviceaccount.getAccountIdToken` will use background impersonated credentials provided by `gcp.serviceaccount.getAccountAccessToken`.
*
* Note: to use the following, you must grant `targetServiceAccount` the
* `roles/iam.serviceAccountTokenCreator` role on itself.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const impersonated = gcp.serviceaccount.getAccountAccessToken({
* targetServiceAccount: "impersonated-account@project.iam.gserviceaccount.com",
* delegates: [],
* scopes: [
* "userinfo-email",
* "cloud-platform",
* ],
* lifetime: "300s",
* });
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetServiceAccount: "impersonated-account@project.iam.gserviceaccount.com",
* delegates: [],
* includeEmail: true,
* targetAudience: "https://foo.bar/",
* });
* export const oidcToken = oidc.then(oidc => oidc.idToken);
* ```
*
* ### Invoking Cloud Run Endpoint
*
* The following configuration will invoke [Cloud Run](https://cloud.google.com/run/docs/authenticating/service-to-service) endpoint where the service account for the provider has been granted `roles/run.invoker` role previously.
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
* import * as http from "@pulumi/http";
*
* const oidc = gcp.serviceaccount.getAccountIdToken({
* targetAudience: "https://your.cloud.run.app/",
* });
* const cloudrun = oidc.then(oidc => http.getHttp({
* url: "https://your.cloud.run.app/",
* requestHeaders: {
* Authorization: `Bearer ${oidc.idToken}`,
* },
* }));
* export const cloudRunResponse = cloudrun.then(cloudrun => cloudrun.body);
* ```
*/
function getAccountIdTokenOutput(args, opts) {
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
return pulumi.runtime.invokeOutput("gcp:serviceaccount/getAccountIdToken:getAccountIdToken", {
"delegates": args.delegates,
"includeEmail": args.includeEmail,
"targetAudience": args.targetAudience,
"targetServiceAccount": args.targetServiceAccount,
}, opts);
}
exports.getAccountIdTokenOutput = getAccountIdTokenOutput;
//# sourceMappingURL=getAccountIdToken.js.map