@pulumi/gcp/folder/accessApprovalSettings.d.ts

A Pulumi package for creating and managing Google Cloud Platform resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Access Approval enables you to require your explicit approval whenever Google support and engineering need to access your customer content.
 *
 * To get more information about FolderSettings, see:
 *
 * * [API documentation](https://cloud.google.com/access-approval/docs/reference/rest/v1/folders)
 *
 * ## Example Usage
 *
 * ### Folder Access Approval Full
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const myFolder = new gcp.organizations.Folder("my_folder", {
 *     displayName: "my-folder",
 *     parent: "organizations/123456789",
 *     deletionProtection: false,
 * });
 * const folderAccessApproval = new gcp.folder.AccessApprovalSettings("folder_access_approval", {
 *     folderId: myFolder.folderId,
 *     notificationEmails: [
 *         "testuser@example.com",
 *         "example.user@example.com",
 *     ],
 *     enrolledServices: [{
 *         cloudProduct: "all",
 *     }],
 * });
 * ```
 * ### Folder Access Approval Active Key Version
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const myFolder = new gcp.organizations.Folder("my_folder", {
 *     displayName: "my-folder",
 *     parent: "organizations/123456789",
 *     deletionProtection: false,
 * });
 * const myProject = new gcp.organizations.Project("my_project", {
 *     name: "My Project",
 *     projectId: "your-project-id",
 *     folderId: myFolder.name,
 *     deletionPolicy: "DELETE",
 * });
 * const keyRing = new gcp.kms.KeyRing("key_ring", {
 *     name: "key-ring",
 *     location: "global",
 *     project: myProject.projectId,
 * });
 * const cryptoKey = new gcp.kms.CryptoKey("crypto_key", {
 *     name: "crypto-key",
 *     keyRing: keyRing.id,
 *     purpose: "ASYMMETRIC_SIGN",
 *     versionTemplate: {
 *         algorithm: "EC_SIGN_P384_SHA384",
 *     },
 * });
 * const serviceAccount = gcp.accessapproval.getFolderServiceAccountOutput({
 *     folderId: myFolder.folderId,
 * });
 * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
 *     cryptoKeyId: cryptoKey.id,
 *     role: "roles/cloudkms.signerVerifier",
 *     member: serviceAccount.apply(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
 * });
 * const cryptoKeyVersion = gcp.kms.getKMSCryptoKeyVersionOutput({
 *     cryptoKey: cryptoKey.id,
 * });
 * const folderAccessApproval = new gcp.folder.AccessApprovalSettings("folder_access_approval", {
 *     folderId: myFolder.folderId,
 *     activeKeyVersion: cryptoKeyVersion.apply(cryptoKeyVersion => cryptoKeyVersion.name),
 *     enrolledServices: [{
 *         cloudProduct: "all",
 *     }],
 * }, {
 *     dependsOn: [iam],
 * });
 * ```
 *
 * ## Import
 *
 * FolderSettings can be imported using any of these accepted formats:
 *
 * * `folders/{{folder_id}}/accessApprovalSettings`
 *
 * * `{{folder_id}}`
 *
 * When using the `pulumi import` command, FolderSettings can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:folder/accessApprovalSettings:AccessApprovalSettings default folders/{{folder_id}}/accessApprovalSettings
 * ```
 *
 * ```sh
 * $ pulumi import gcp:folder/accessApprovalSettings:AccessApprovalSettings default {{folder_id}}
 * ```
 */
export declare class AccessApprovalSettings extends pulumi.CustomResource {
    /**
     * Get an existing AccessApprovalSettings resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessApprovalSettingsState, opts?: pulumi.CustomResourceOptions): AccessApprovalSettings;
    /**
     * Returns true if the given object is an instance of AccessApprovalSettings.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is AccessApprovalSettings;
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    readonly activeKeyVersion: pulumi.Output<string | undefined>;
    /**
     * If the field is true, that indicates that an ancestor of this Folder has set active_key_version.
     */
    readonly ancestorHasActiveKeyVersion: pulumi.Output<boolean>;
    /**
     * If the field is true, that indicates that at least one service is enrolled for Access Approval in one or more ancestors of the Folder.
     */
    readonly enrolledAncestor: pulumi.Output<boolean>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    readonly enrolledServices: pulumi.Output<outputs.folder.AccessApprovalSettingsEnrolledService[]>;
    /**
     * ID of the folder of the access approval settings.
     */
    readonly folderId: pulumi.Output<string>;
    /**
     * If the field is true, that indicates that there is some configuration issue with the activeKeyVersion
     * configured on this Folder (e.g. it doesn't exist or the Access Approval service account doesn't have the
     * correct permissions on it, etc.) This key version is not necessarily the effective key version at this level,
     * as key versions are inherited top-down.
     */
    readonly invalidKeyVersion: pulumi.Output<boolean>;
    /**
     * The resource name of the settings. Format is "folders/{folder_id}/accessApprovalSettings"
     */
    readonly name: pulumi.Output<string>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    readonly notificationEmails: pulumi.Output<string[]>;
    /**
     * Create a AccessApprovalSettings resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: AccessApprovalSettingsArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering AccessApprovalSettings resources.
 */
export interface AccessApprovalSettingsState {
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    activeKeyVersion?: pulumi.Input<string>;
    /**
     * If the field is true, that indicates that an ancestor of this Folder has set active_key_version.
     */
    ancestorHasActiveKeyVersion?: pulumi.Input<boolean>;
    /**
     * If the field is true, that indicates that at least one service is enrolled for Access Approval in one or more ancestors of the Folder.
     */
    enrolledAncestor?: pulumi.Input<boolean>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    enrolledServices?: pulumi.Input<pulumi.Input<inputs.folder.AccessApprovalSettingsEnrolledService>[]>;
    /**
     * ID of the folder of the access approval settings.
     */
    folderId?: pulumi.Input<string>;
    /**
     * If the field is true, that indicates that there is some configuration issue with the activeKeyVersion
     * configured on this Folder (e.g. it doesn't exist or the Access Approval service account doesn't have the
     * correct permissions on it, etc.) This key version is not necessarily the effective key version at this level,
     * as key versions are inherited top-down.
     */
    invalidKeyVersion?: pulumi.Input<boolean>;
    /**
     * The resource name of the settings. Format is "folders/{folder_id}/accessApprovalSettings"
     */
    name?: pulumi.Input<string>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    notificationEmails?: pulumi.Input<pulumi.Input<string>[]>;
}
/**
 * The set of arguments for constructing a AccessApprovalSettings resource.
 */
export interface AccessApprovalSettingsArgs {
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    activeKeyVersion?: pulumi.Input<string>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    enrolledServices: pulumi.Input<pulumi.Input<inputs.folder.AccessApprovalSettingsEnrolledService>[]>;
    /**
     * ID of the folder of the access approval settings.
     */
    folderId: pulumi.Input<string>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    notificationEmails?: pulumi.Input<pulumi.Input<string>[]>;
}