import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Represents a managed identity for a workload identity pool namespace. * * To get more information about WorkloadIdentityPoolManagedIdentity, see: * * * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.namespaces.managedIdentities) * * How-to Guides * * [Configure managed workload identity authentication for Compute Engine](https://cloud.google.com/iam/docs/create-managed-workload-identities) * * [Configure managed workload identity authentication for GKE](https://cloud.google.com/iam/docs/create-managed-workload-identities-gke) * * ## Example Usage * * ### Iam Workload Identity Pool Managed Identity Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const pool = new gcp.iam.WorkloadIdentityPool("pool", { * workloadIdentityPoolId: "example-pool", * mode: "TRUST_DOMAIN", * }); * const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", { * workloadIdentityPoolId: pool.workloadIdentityPoolId, * workloadIdentityPoolNamespaceId: "example-namespace", * }); * const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", { * workloadIdentityPoolId: pool.workloadIdentityPoolId, * workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId, * workloadIdentityPoolManagedIdentityId: "example-managed-identity", * }); * ``` * ### Iam Workload Identity Pool Managed Identity Full * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const pool = new gcp.iam.WorkloadIdentityPool("pool", { * workloadIdentityPoolId: "example-pool", * mode: "TRUST_DOMAIN", * }); * const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", { * workloadIdentityPoolId: pool.workloadIdentityPoolId, * workloadIdentityPoolNamespaceId: "example-namespace", * }); * const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", { * workloadIdentityPoolId: pool.workloadIdentityPoolId, * workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId, * workloadIdentityPoolManagedIdentityId: "example-managed-identity", * description: "Example Managed Identity in a Workload Identity Pool Namespace", * disabled: true, * attestationRules: [ * { * googleCloudResource: "//compute.googleapis.com/projects/1111111111111/uid/zones/us-central1-a/instances/12345678", * }, * { * googleCloudResource: "//run.googleapis.com/projects/1111111111111/name/locations/us-east1/services/my-service", * }, * ], * }); * ``` * * ## Import * * WorkloadIdentityPoolManagedIdentity can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}` * * `{{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}` * * `{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}` * * When using the `pulumi import` command, WorkloadIdentityPoolManagedIdentity can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}} * $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}} * $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}} * ``` */ export declare class WorkloadIdentityPoolManagedIdentity extends pulumi.CustomResource { /** * Get an existing WorkloadIdentityPoolManagedIdentity resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: WorkloadIdentityPoolManagedIdentityState, opts?: pulumi.CustomResourceOptions): WorkloadIdentityPoolManagedIdentity; /** * Returns true if the given object is an instance of WorkloadIdentityPoolManagedIdentity. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is WorkloadIdentityPoolManagedIdentity; /** * Defines which workloads can receive an identity within a pool. When an AttestationRule is * defined under a managed identity, matching workloads may receive that identity. A maximum of * 50 AttestationRules can be set. * Structure is documented below. */ readonly attestationRules: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * A description of the managed identity. Cannot exceed 256 characters. */ readonly description: pulumi.Output; /** * Whether the managed identity is disabled. If disabled, credentials may no longer be issued for * the identity, however existing credentials will still be accepted until they expire. */ readonly disabled: pulumi.Output; /** * The resource name of the managed identity as * `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}`. */ readonly name: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * The current state of the managed identity. * * `ACTIVE`: The managed identity is active. * * `DELETED`: The managed identity is soft-deleted. Soft-deleted managed identities are * permanently deleted after approximately 30 days. You can restore a soft-deleted managed * identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a * soft-deleted managed identity until it is permanently deleted. */ readonly state: pulumi.Output; /** * The ID to use for the pool, which becomes the final component of the resource name. This * value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix * `gcp-` is reserved for use by Google, and may not be specified. */ readonly workloadIdentityPoolId: pulumi.Output; /** * The ID to use for the managed identity. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ readonly workloadIdentityPoolManagedIdentityId: pulumi.Output; /** * The ID to use for the namespace. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ readonly workloadIdentityPoolNamespaceId: pulumi.Output; /** * Create a WorkloadIdentityPoolManagedIdentity resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: WorkloadIdentityPoolManagedIdentityArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering WorkloadIdentityPoolManagedIdentity resources. */ export interface WorkloadIdentityPoolManagedIdentityState { /** * Defines which workloads can receive an identity within a pool. When an AttestationRule is * defined under a managed identity, matching workloads may receive that identity. A maximum of * 50 AttestationRules can be set. * Structure is documented below. */ attestationRules?: pulumi.Input[] | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * A description of the managed identity. Cannot exceed 256 characters. */ description?: pulumi.Input; /** * Whether the managed identity is disabled. If disabled, credentials may no longer be issued for * the identity, however existing credentials will still be accepted until they expire. */ disabled?: pulumi.Input; /** * The resource name of the managed identity as * `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}`. */ name?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The current state of the managed identity. * * `ACTIVE`: The managed identity is active. * * `DELETED`: The managed identity is soft-deleted. Soft-deleted managed identities are * permanently deleted after approximately 30 days. You can restore a soft-deleted managed * identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a * soft-deleted managed identity until it is permanently deleted. */ state?: pulumi.Input; /** * The ID to use for the pool, which becomes the final component of the resource name. This * value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix * `gcp-` is reserved for use by Google, and may not be specified. */ workloadIdentityPoolId?: pulumi.Input; /** * The ID to use for the managed identity. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ workloadIdentityPoolManagedIdentityId?: pulumi.Input; /** * The ID to use for the namespace. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ workloadIdentityPoolNamespaceId?: pulumi.Input; } /** * The set of arguments for constructing a WorkloadIdentityPoolManagedIdentity resource. */ export interface WorkloadIdentityPoolManagedIdentityArgs { /** * Defines which workloads can receive an identity within a pool. When an AttestationRule is * defined under a managed identity, matching workloads may receive that identity. A maximum of * 50 AttestationRules can be set. * Structure is documented below. */ attestationRules?: pulumi.Input[] | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * A description of the managed identity. Cannot exceed 256 characters. */ description?: pulumi.Input; /** * Whether the managed identity is disabled. If disabled, credentials may no longer be issued for * the identity, however existing credentials will still be accepted until they expire. */ disabled?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The ID to use for the pool, which becomes the final component of the resource name. This * value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix * `gcp-` is reserved for use by Google, and may not be specified. */ workloadIdentityPoolId: pulumi.Input; /** * The ID to use for the managed identity. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ workloadIdentityPoolManagedIdentityId: pulumi.Input; /** * The ID to use for the namespace. This value must: * * contain at most 63 characters * * contain only lowercase alphanumeric characters or `-` * * start with an alphanumeric character * * end with an alphanumeric character * * The prefix `gcp-` will be reserved for future uses. */ workloadIdentityPoolNamespaceId: pulumi.Input; } //# sourceMappingURL=workloadIdentityPoolManagedIdentity.d.ts.map