@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
295 lines (294 loc) • 14.2 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* Represents a managed identity for a workload identity pool namespace.
*
* To get more information about WorkloadIdentityPoolManagedIdentity, see:
*
* * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.namespaces.managedIdentities)
* * How-to Guides
* * [Configure managed workload identity authentication for Compute Engine](https://cloud.google.com/iam/docs/create-managed-workload-identities)
* * [Configure managed workload identity authentication for GKE](https://cloud.google.com/iam/docs/create-managed-workload-identities-gke)
*
* ## Example Usage
*
* ### Iam Workload Identity Pool Managed Identity Basic
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const pool = new gcp.iam.WorkloadIdentityPool("pool", {
* workloadIdentityPoolId: "example-pool",
* mode: "TRUST_DOMAIN",
* });
* const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", {
* workloadIdentityPoolId: pool.workloadIdentityPoolId,
* workloadIdentityPoolNamespaceId: "example-namespace",
* });
* const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", {
* workloadIdentityPoolId: pool.workloadIdentityPoolId,
* workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId,
* workloadIdentityPoolManagedIdentityId: "example-managed-identity",
* });
* ```
* ### Iam Workload Identity Pool Managed Identity Full
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const pool = new gcp.iam.WorkloadIdentityPool("pool", {
* workloadIdentityPoolId: "example-pool",
* mode: "TRUST_DOMAIN",
* });
* const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", {
* workloadIdentityPoolId: pool.workloadIdentityPoolId,
* workloadIdentityPoolNamespaceId: "example-namespace",
* });
* const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", {
* workloadIdentityPoolId: pool.workloadIdentityPoolId,
* workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId,
* workloadIdentityPoolManagedIdentityId: "example-managed-identity",
* description: "Example Managed Identity in a Workload Identity Pool Namespace",
* disabled: true,
* attestationRules: [
* {
* googleCloudResource: "//compute.googleapis.com/projects/1111111111111/uid/zones/us-central1-a/instances/12345678",
* },
* {
* googleCloudResource: "//run.googleapis.com/projects/1111111111111/name/locations/us-east1/services/my-service",
* },
* ],
* });
* ```
*
* ## Import
*
* WorkloadIdentityPoolManagedIdentity can be imported using any of these accepted formats:
*
* * `projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}`
*
* * `{{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}`
*
* * `{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}`
*
* When using the `pulumi import` command, WorkloadIdentityPoolManagedIdentity can be imported using one of the formats above. For example:
*
* ```sh
* $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}
* ```
*
* ```sh
* $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}
* ```
*
* ```sh
* $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}
* ```
*/
export declare class WorkloadIdentityPoolManagedIdentity extends pulumi.CustomResource {
/**
* Get an existing WorkloadIdentityPoolManagedIdentity resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: WorkloadIdentityPoolManagedIdentityState, opts?: pulumi.CustomResourceOptions): WorkloadIdentityPoolManagedIdentity;
/**
* Returns true if the given object is an instance of WorkloadIdentityPoolManagedIdentity. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is WorkloadIdentityPoolManagedIdentity;
/**
* Defines which workloads can receive an identity within a pool. When an AttestationRule is
* defined under a managed identity, matching workloads may receive that identity. A maximum of
* 50 AttestationRules can be set.
* Structure is documented below.
*/
readonly attestationRules: pulumi.Output<outputs.iam.WorkloadIdentityPoolManagedIdentityAttestationRule[] | undefined>;
/**
* A description of the managed identity. Cannot exceed 256 characters.
*/
readonly description: pulumi.Output<string | undefined>;
/**
* Whether the managed identity is disabled. If disabled, credentials may no longer be issued for
* the identity, however existing credentials will still be accepted until they expire.
*/
readonly disabled: pulumi.Output<boolean | undefined>;
/**
* The resource name of the managed identity as
* `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}`.
*/
readonly name: pulumi.Output<string>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
readonly project: pulumi.Output<string>;
/**
* The current state of the managed identity.
* * `ACTIVE`: The managed identity is active.
* * `DELETED`: The managed identity is soft-deleted. Soft-deleted managed identities are
* permanently deleted after approximately 30 days. You can restore a soft-deleted managed
* identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a
* soft-deleted managed identity until it is permanently deleted.
*/
readonly state: pulumi.Output<string>;
/**
* The ID to use for the pool, which becomes the final component of the resource name. This
* value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
* `gcp-` is reserved for use by Google, and may not be specified.
*/
readonly workloadIdentityPoolId: pulumi.Output<string>;
/**
* The ID to use for the managed identity. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
readonly workloadIdentityPoolManagedIdentityId: pulumi.Output<string>;
/**
* The ID to use for the namespace. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
readonly workloadIdentityPoolNamespaceId: pulumi.Output<string>;
/**
* Create a WorkloadIdentityPoolManagedIdentity resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: WorkloadIdentityPoolManagedIdentityArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering WorkloadIdentityPoolManagedIdentity resources.
*/
export interface WorkloadIdentityPoolManagedIdentityState {
/**
* Defines which workloads can receive an identity within a pool. When an AttestationRule is
* defined under a managed identity, matching workloads may receive that identity. A maximum of
* 50 AttestationRules can be set.
* Structure is documented below.
*/
attestationRules?: pulumi.Input<pulumi.Input<inputs.iam.WorkloadIdentityPoolManagedIdentityAttestationRule>[]>;
/**
* A description of the managed identity. Cannot exceed 256 characters.
*/
description?: pulumi.Input<string>;
/**
* Whether the managed identity is disabled. If disabled, credentials may no longer be issued for
* the identity, however existing credentials will still be accepted until they expire.
*/
disabled?: pulumi.Input<boolean>;
/**
* The resource name of the managed identity as
* `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}`.
*/
name?: pulumi.Input<string>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string>;
/**
* The current state of the managed identity.
* * `ACTIVE`: The managed identity is active.
* * `DELETED`: The managed identity is soft-deleted. Soft-deleted managed identities are
* permanently deleted after approximately 30 days. You can restore a soft-deleted managed
* identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a
* soft-deleted managed identity until it is permanently deleted.
*/
state?: pulumi.Input<string>;
/**
* The ID to use for the pool, which becomes the final component of the resource name. This
* value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
* `gcp-` is reserved for use by Google, and may not be specified.
*/
workloadIdentityPoolId?: pulumi.Input<string>;
/**
* The ID to use for the managed identity. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
workloadIdentityPoolManagedIdentityId?: pulumi.Input<string>;
/**
* The ID to use for the namespace. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
workloadIdentityPoolNamespaceId?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a WorkloadIdentityPoolManagedIdentity resource.
*/
export interface WorkloadIdentityPoolManagedIdentityArgs {
/**
* Defines which workloads can receive an identity within a pool. When an AttestationRule is
* defined under a managed identity, matching workloads may receive that identity. A maximum of
* 50 AttestationRules can be set.
* Structure is documented below.
*/
attestationRules?: pulumi.Input<pulumi.Input<inputs.iam.WorkloadIdentityPoolManagedIdentityAttestationRule>[]>;
/**
* A description of the managed identity. Cannot exceed 256 characters.
*/
description?: pulumi.Input<string>;
/**
* Whether the managed identity is disabled. If disabled, credentials may no longer be issued for
* the identity, however existing credentials will still be accepted until they expire.
*/
disabled?: pulumi.Input<boolean>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string>;
/**
* The ID to use for the pool, which becomes the final component of the resource name. This
* value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
* `gcp-` is reserved for use by Google, and may not be specified.
*/
workloadIdentityPoolId: pulumi.Input<string>;
/**
* The ID to use for the managed identity. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
workloadIdentityPoolManagedIdentityId: pulumi.Input<string>;
/**
* The ID to use for the namespace. This value must:
* * contain at most 63 characters
* * contain only lowercase alphanumeric characters or `-`
* * start with an alphanumeric character
* * end with an alphanumeric character
*
* The prefix `gcp-` will be reserved for future uses.
*/
workloadIdentityPoolNamespaceId: pulumi.Input<string>;
}