@pulumi/gcp

import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Represents an IAM v3 Access Policy parented by a Project. This policy defines rules * that allow or deny access to resources within the specified project based on principals and conditions. * See the Cloud IAM documentation for more details on Access Policies. * * > **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider. * See Provider Versions for more details on beta resources. * * To get more information about ProjectAccessPolicy, see: * * * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v3beta/projects.locations.accessPolicies) * * ## Example Usage * * ### Access Policy Project Minimal * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * import * as time from "@pulumiverse/time"; * * const project = new gcp.organizations.Project("project", { * projectId: "ap-project-", * name: "ap-project-", * orgId: "123456789", * billingAccount: "000000-0000000-0000000-000000", * deletionPolicy: "DELETE", * }); * const iamApi = new gcp.projects.Service("iam_api", { * project: project.projectId, * service: "iam.googleapis.com", * disableOnDestroy: false, * }); * const waitForProjectPropagation = new time.Sleep("wait_for_project_propagation", {createDuration: "30s"}, { * dependsOn: [iamApi], * }); * const testSa = new gcp.serviceaccount.Account("test_sa", { * accountId: "svc-acc-", * displayName: "Test Service Account for Access Policy", * project: project.projectId, * }, { * dependsOn: [waitForProjectPropagation], * }); * const example = new gcp.iam.ProjectAccessPolicy("example", { * project: project.projectId, * location: "global", * accessPolicyId: "my-project-policy-", * details: { * rules: [{ * effect: "ALLOW", * principals: [pulumi.interpolate`principal://iam.googleapis.com/projects/-/serviceAccounts/${testSa.email}`], * operation: { * permissions: ["eventarc.googleapis.com/messageBuses.publish"], * }, * }], * }, * }, { * dependsOn: [ * waitForProjectPropagation, * testSa, * ], * }); * ``` * * ## Import * * ProjectAccessPolicy can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/{{location}}/accessPolicies/{{access_policy_id}}` * * `{{project}}/{{location}}/{{access_policy_id}}` * * `{{location}}/{{access_policy_id}}` * * When using the `pulumi import` command, ProjectAccessPolicy can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:iam/projectAccessPolicy:ProjectAccessPolicy default projects/{{project}}/locations/{{location}}/accessPolicies/{{access_policy_id}} * $ pulumi import gcp:iam/projectAccessPolicy:ProjectAccessPolicy default {{project}}/{{location}}/{{access_policy_id}} * $ pulumi import gcp:iam/projectAccessPolicy:ProjectAccessPolicy default {{location}}/{{access_policy_id}} * ``` */ export declare class ProjectAccessPolicy extends pulumi.CustomResource { /** * Get an existing ProjectAccessPolicy resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ProjectAccessPolicyState, opts?: pulumi.CustomResourceOptions): ProjectAccessPolicy; /** * Returns true if the given object is an instance of ProjectAccessPolicy. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ProjectAccessPolicy; /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ readonly accessPolicyId: pulumi.Output<string>; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ readonly annotations: pulumi.Output<{ [key: string]: string; } | undefined>; /** * The time when the access policy was created. */ readonly createTime: pulumi.Output<string>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output<string>; /** * Access policy details. * Structure is documented below. */ readonly details: pulumi.Output<outputs.iam.ProjectAccessPolicyDetails | undefined>; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ readonly displayName: pulumi.Output<string | undefined>; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ readonly effectiveAnnotations: pulumi.Output<{ [key: string]: string; }>; /** * The etag for the access policy. * If this is provided on update, it must match the server's etag. */ readonly etag: pulumi.Output<string>; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly location: pulumi.Output<string>; /** * Identifier. The resource name of the access policy. * The following formats are supported: * * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}` */ readonly name: pulumi.Output<string>; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output<string>; /** * The globally unique ID of the access policy. */ readonly uid: pulumi.Output<string>; /** * The time when the access policy was most recently * updated. */ readonly updateTime: pulumi.Output<string>; /** * Create a ProjectAccessPolicy resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: ProjectAccessPolicyArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ProjectAccessPolicy resources. */ export interface ProjectAccessPolicyState { /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ accessPolicyId?: pulumi.Input<string | undefined>; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input<string>; } | undefined>; /** * The time when the access policy was created. */ createTime?: pulumi.Input<string | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input<string | undefined>; /** * Access policy details. * Structure is documented below. */ details?: pulumi.Input<inputs.iam.ProjectAccessPolicyDetails | undefined>; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ displayName?: pulumi.Input<string | undefined>; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ effectiveAnnotations?: pulumi.Input<{ [key: string]: pulumi.Input<string>; } | undefined>; /** * The etag for the access policy. * If this is provided on update, it must match the server's etag. */ etag?: pulumi.Input<string | undefined>; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input<string | undefined>; /** * Identifier. The resource name of the access policy. * The following formats are supported: * * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}` */ name?: pulumi.Input<string | undefined>; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input<string | undefined>; /** * The globally unique ID of the access policy. */ uid?: pulumi.Input<string | undefined>; /** * The time when the access policy was most recently * updated. */ updateTime?: pulumi.Input<string | undefined>; } /** * The set of arguments for constructing a ProjectAccessPolicy resource. */ export interface ProjectAccessPolicyArgs { /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ accessPolicyId: pulumi.Input<string>; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input<string>; } | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input<string | undefined>; /** * Access policy details. * Structure is documented below. */ details?: pulumi.Input<inputs.iam.ProjectAccessPolicyDetails | undefined>; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ displayName?: pulumi.Input<string | undefined>; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location: pulumi.Input<string>; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input<string | undefined>; } //# sourceMappingURL=projectAccessPolicy.d.ts.map