@pulumi/gcp/projects/accessApprovalSettings.d.ts

A Pulumi package for creating and managing Google Cloud Platform resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Access Approval enables you to require your explicit approval whenever Google support and engineering need to access your customer content.
 *
 * To get more information about ProjectSettings, see:
 *
 * * [API documentation](https://cloud.google.com/access-approval/docs/reference/rest/v1/projects)
 *
 * ## Example Usage
 *
 * ### Project Access Approval Full
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const projectAccessApproval = new gcp.projects.AccessApprovalSettings("project_access_approval", {
 *     projectId: "my-project-name",
 *     notificationEmails: [
 *         "testuser@example.com",
 *         "example.user@example.com",
 *     ],
 *     enrolledServices: [{
 *         cloudProduct: "all",
 *         enrollmentLevel: "BLOCK_ALL",
 *     }],
 * });
 * ```
 * ### Project Access Approval Active Key Version
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const keyRing = new gcp.kms.KeyRing("key_ring", {
 *     name: "key-ring",
 *     location: "global",
 *     project: "my-project-name",
 * });
 * const cryptoKey = new gcp.kms.CryptoKey("crypto_key", {
 *     name: "crypto-key",
 *     keyRing: keyRing.id,
 *     purpose: "ASYMMETRIC_SIGN",
 *     versionTemplate: {
 *         algorithm: "EC_SIGN_P384_SHA384",
 *     },
 * });
 * const serviceAccount = gcp.accessapproval.getProjectServiceAccount({
 *     projectId: "my-project-name",
 * });
 * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
 *     cryptoKeyId: cryptoKey.id,
 *     role: "roles/cloudkms.signerVerifier",
 *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
 * });
 * const cryptoKeyVersion = gcp.kms.getKMSCryptoKeyVersionOutput({
 *     cryptoKey: cryptoKey.id,
 * });
 * const projectAccessApproval = new gcp.projects.AccessApprovalSettings("project_access_approval", {
 *     projectId: "my-project-name",
 *     activeKeyVersion: cryptoKeyVersion.apply(cryptoKeyVersion => cryptoKeyVersion.name),
 *     enrolledServices: [{
 *         cloudProduct: "all",
 *     }],
 * }, {
 *     dependsOn: [iam],
 * });
 * ```
 *
 * ## Import
 *
 * ProjectSettings can be imported using any of these accepted formats:
 *
 * * `projects/{{project_id}}/accessApprovalSettings`
 *
 * * `{{project_id}}`
 *
 * When using the `pulumi import` command, ProjectSettings can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:projects/accessApprovalSettings:AccessApprovalSettings default projects/{{project_id}}/accessApprovalSettings
 * ```
 *
 * ```sh
 * $ pulumi import gcp:projects/accessApprovalSettings:AccessApprovalSettings default {{project_id}}
 * ```
 */
export declare class AccessApprovalSettings extends pulumi.CustomResource {
    /**
     * Get an existing AccessApprovalSettings resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessApprovalSettingsState, opts?: pulumi.CustomResourceOptions): AccessApprovalSettings;
    /**
     * Returns true if the given object is an instance of AccessApprovalSettings.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is AccessApprovalSettings;
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    readonly activeKeyVersion: pulumi.Output<string | undefined>;
    /**
     * If the field is true, that indicates that an ancestor of this Project has set active_key_version.
     */
    readonly ancestorHasActiveKeyVersion: pulumi.Output<boolean>;
    /**
     * If the field is true, that indicates that at least one service is enrolled for Access Approval in one or more ancestors of the Project.
     */
    readonly enrolledAncestor: pulumi.Output<boolean>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    readonly enrolledServices: pulumi.Output<outputs.projects.AccessApprovalSettingsEnrolledService[]>;
    /**
     * If the field is true, that indicates that there is some configuration issue with the activeKeyVersion
     * configured on this Project (e.g. it doesn't exist or the Access Approval service account doesn't have the
     * correct permissions on it, etc.) This key version is not necessarily the effective key version at this level,
     * as key versions are inherited top-down.
     */
    readonly invalidKeyVersion: pulumi.Output<boolean>;
    /**
     * The resource name of the settings. Format is "projects/{project_id}/accessApprovalSettings"
     */
    readonly name: pulumi.Output<string>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    readonly notificationEmails: pulumi.Output<string[]>;
    /**
     * (Optional, Deprecated)
     * Project id.
     *
     * > **Warning:** `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     *
     * @deprecated `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     */
    readonly project: pulumi.Output<string | undefined>;
    /**
     * ID of the project of the access approval settings.
     */
    readonly projectId: pulumi.Output<string>;
    /**
     * Create a AccessApprovalSettings resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: AccessApprovalSettingsArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering AccessApprovalSettings resources.
 */
export interface AccessApprovalSettingsState {
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    activeKeyVersion?: pulumi.Input<string>;
    /**
     * If the field is true, that indicates that an ancestor of this Project has set active_key_version.
     */
    ancestorHasActiveKeyVersion?: pulumi.Input<boolean>;
    /**
     * If the field is true, that indicates that at least one service is enrolled for Access Approval in one or more ancestors of the Project.
     */
    enrolledAncestor?: pulumi.Input<boolean>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    enrolledServices?: pulumi.Input<pulumi.Input<inputs.projects.AccessApprovalSettingsEnrolledService>[]>;
    /**
     * If the field is true, that indicates that there is some configuration issue with the activeKeyVersion
     * configured on this Project (e.g. it doesn't exist or the Access Approval service account doesn't have the
     * correct permissions on it, etc.) This key version is not necessarily the effective key version at this level,
     * as key versions are inherited top-down.
     */
    invalidKeyVersion?: pulumi.Input<boolean>;
    /**
     * The resource name of the settings. Format is "projects/{project_id}/accessApprovalSettings"
     */
    name?: pulumi.Input<string>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    notificationEmails?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional, Deprecated)
     * Project id.
     *
     * > **Warning:** `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     *
     * @deprecated `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     */
    project?: pulumi.Input<string>;
    /**
     * ID of the project of the access approval settings.
     */
    projectId?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a AccessApprovalSettings resource.
 */
export interface AccessApprovalSettingsArgs {
    /**
     * The asymmetric crypto key version to use for signing approval requests.
     * Empty activeKeyVersion indicates that a Google-managed key should be used for signing.
     * This property will be ignored if set by an ancestor of the resource, and new non-empty values may not be set.
     */
    activeKeyVersion?: pulumi.Input<string>;
    /**
     * A list of Google Cloud Services for which the given resource has Access Approval enrolled.
     * Access requests for the resource given by name against any of these services contained here will be required
     * to have explicit approval. Enrollment can only be done on an all or nothing basis.
     * A maximum of 10 enrolled services will be enforced, to be expanded as the set of supported services is expanded.
     * Structure is documented below.
     */
    enrolledServices: pulumi.Input<pulumi.Input<inputs.projects.AccessApprovalSettingsEnrolledService>[]>;
    /**
     * A list of email addresses to which notifications relating to approval requests should be sent.
     * Notifications relating to a resource will be sent to all emails in the settings of ancestor
     * resources of that resource. A maximum of 50 email addresses are allowed.
     */
    notificationEmails?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional, Deprecated)
     * Project id.
     *
     * > **Warning:** `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     *
     * @deprecated `project` is deprecated and will be removed in a future major release. Use `projectId` instead.
     */
    project?: pulumi.Input<string>;
    /**
     * ID of the project of the access approval settings.
     */
    projectId: pulumi.Input<string>;
}