@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
195 lines • 10.3 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getProjectServiceAccountOutput = exports.getProjectServiceAccount = void 0;
const pulumi = __importStar(require("@pulumi/pulumi"));
const utilities = __importStar(require("../utilities"));
/**
* Get the email address of a project's unique [automatic Google Cloud Storage service account](https://cloud.google.com/storage/docs/projects#service-accounts).
*
* For each Google Cloud project, Google maintains a unique service account which
* is used as the identity for various Google Cloud Storage operations, including
* operations involving
* [customer-managed encryption keys](https://cloud.google.com/storage/docs/encryption/customer-managed-keys)
* and those involving
* [storage notifications to pub/sub](https://cloud.google.com/storage/docs/gsutil/commands/notification).
* This automatic Google service account requires access to the relevant Cloud KMS keys or pub/sub topics, respectively, in order for Cloud Storage to use
* these customer-managed resources.
*
* The service account has a well-known, documented naming format which is parameterised on the numeric Google project ID.
* However, as noted in [the docs](https://cloud.google.com/storage/docs/projects#service-accounts), it is only created when certain relevant actions occur which
* presuppose its existence.
* These actions include calling a [Cloud Storage API endpoint](https://cloud.google.com/storage/docs/json_api/v1/projects/serviceAccount/get) to yield the
* service account's identity, or performing some operations in the UI which must use the service account's identity, such as attempting to list Cloud KMS keys
* on the bucket creation page.
*
* Use of this data source calls the relevant API endpoint to obtain the service account's identity and thus ensures it exists prior to any API operations
* which demand its existence, such as specifying it in Cloud IAM policy.
* Always prefer to use this data source over interpolating the project ID into the well-known format for this service account, as the latter approach may cause
* Pulumi update errors in cases where the service account does not yet exist.
*
* > When you write Pulumi code which uses features depending on this service account *and* your Pulumi code adds the service account in IAM policy on other resources,
* you must take care for race conditions between the establishment of the IAM policy and creation of the relevant Cloud Storage resource.
* Cloud Storage APIs will require permissions on resources such as pub/sub topics or Cloud KMS keys to exist *before* the attempt to utilise them in a
* bucket configuration, otherwise the API calls will fail.
* You may need to use `dependsOn` to create an explicit dependency between the IAM policy resource and the Cloud Storage resource which depends on it.
* See the examples here and in the `gcp.storage.Notification` resource.
*
* For more information see
* [the API reference](https://cloud.google.com/storage/docs/json_api/v1/projects/serviceAccount).
*
* ## Example Usage
*
* ### Pub/Sub Notifications
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const gcsAccount = gcp.storage.getProjectServiceAccount({});
* const binding = new gcp.pubsub.TopicIAMBinding("binding", {
* topic: topic.name,
* role: "roles/pubsub.publisher",
* members: [gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`)],
* });
* ```
*
* ### Cloud KMS Keys
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const gcsAccount = gcp.storage.getProjectServiceAccount({});
* const binding = new gcp.kms.CryptoKeyIAMBinding("binding", {
* cryptoKeyId: "your-crypto-key-id",
* role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
* members: [gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`)],
* });
* const bucket = new gcp.storage.Bucket("bucket", {
* name: "kms-protected-bucket",
* location: "US",
* encryption: {
* defaultKmsKeyName: "your-crypto-key-id",
* },
* }, {
* dependsOn: [binding],
* });
* ```
*/
function getProjectServiceAccount(args, opts) {
args = args || {};
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
return pulumi.runtime.invoke("gcp:storage/getProjectServiceAccount:getProjectServiceAccount", {
"project": args.project,
"userProject": args.userProject,
}, opts);
}
exports.getProjectServiceAccount = getProjectServiceAccount;
/**
* Get the email address of a project's unique [automatic Google Cloud Storage service account](https://cloud.google.com/storage/docs/projects#service-accounts).
*
* For each Google Cloud project, Google maintains a unique service account which
* is used as the identity for various Google Cloud Storage operations, including
* operations involving
* [customer-managed encryption keys](https://cloud.google.com/storage/docs/encryption/customer-managed-keys)
* and those involving
* [storage notifications to pub/sub](https://cloud.google.com/storage/docs/gsutil/commands/notification).
* This automatic Google service account requires access to the relevant Cloud KMS keys or pub/sub topics, respectively, in order for Cloud Storage to use
* these customer-managed resources.
*
* The service account has a well-known, documented naming format which is parameterised on the numeric Google project ID.
* However, as noted in [the docs](https://cloud.google.com/storage/docs/projects#service-accounts), it is only created when certain relevant actions occur which
* presuppose its existence.
* These actions include calling a [Cloud Storage API endpoint](https://cloud.google.com/storage/docs/json_api/v1/projects/serviceAccount/get) to yield the
* service account's identity, or performing some operations in the UI which must use the service account's identity, such as attempting to list Cloud KMS keys
* on the bucket creation page.
*
* Use of this data source calls the relevant API endpoint to obtain the service account's identity and thus ensures it exists prior to any API operations
* which demand its existence, such as specifying it in Cloud IAM policy.
* Always prefer to use this data source over interpolating the project ID into the well-known format for this service account, as the latter approach may cause
* Pulumi update errors in cases where the service account does not yet exist.
*
* > When you write Pulumi code which uses features depending on this service account *and* your Pulumi code adds the service account in IAM policy on other resources,
* you must take care for race conditions between the establishment of the IAM policy and creation of the relevant Cloud Storage resource.
* Cloud Storage APIs will require permissions on resources such as pub/sub topics or Cloud KMS keys to exist *before* the attempt to utilise them in a
* bucket configuration, otherwise the API calls will fail.
* You may need to use `dependsOn` to create an explicit dependency between the IAM policy resource and the Cloud Storage resource which depends on it.
* See the examples here and in the `gcp.storage.Notification` resource.
*
* For more information see
* [the API reference](https://cloud.google.com/storage/docs/json_api/v1/projects/serviceAccount).
*
* ## Example Usage
*
* ### Pub/Sub Notifications
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const gcsAccount = gcp.storage.getProjectServiceAccount({});
* const binding = new gcp.pubsub.TopicIAMBinding("binding", {
* topic: topic.name,
* role: "roles/pubsub.publisher",
* members: [gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`)],
* });
* ```
*
* ### Cloud KMS Keys
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const gcsAccount = gcp.storage.getProjectServiceAccount({});
* const binding = new gcp.kms.CryptoKeyIAMBinding("binding", {
* cryptoKeyId: "your-crypto-key-id",
* role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
* members: [gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`)],
* });
* const bucket = new gcp.storage.Bucket("bucket", {
* name: "kms-protected-bucket",
* location: "US",
* encryption: {
* defaultKmsKeyName: "your-crypto-key-id",
* },
* }, {
* dependsOn: [binding],
* });
* ```
*/
function getProjectServiceAccountOutput(args, opts) {
args = args || {};
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
return pulumi.runtime.invokeOutput("gcp:storage/getProjectServiceAccount:getProjectServiceAccount", {
"project": args.project,
"userProject": args.userProject,
}, opts);
}
exports.getProjectServiceAccountOutput = getProjectServiceAccountOutput;
//# sourceMappingURL=getProjectServiceAccount.js.map