import * as pulumi from "@pulumi/pulumi"; /** * `ProjectAutokeyConfig` is a singleton resource used to configure the auto-provisioning * flow of CryptoKeys for CMEK. * * > **Note:** ProjectAutokeyConfigs cannot be deleted from Google Cloud Platform. * Destroying a Terraform-managed ProjectAutokeyConfigs will remove it from state but * *will not delete the resource from the project.* * * To get more information about ProjectAutokeyConfig, see: * * * [API documentation](https://cloud.google.com/kms/docs/reference/rest/v1/AutokeyConfig) * * How-to Guides * * [Cloud KMS with Autokey](https://cloud.google.com/kms/docs/kms-with-autokey) * * ## Example Usage * * ### Kms Autokey Config Project * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * import * as time from "@pulumiverse/time"; * * // Create the resource project * const resourceProject = new gcp.organizations.Project("resource_project", { * projectId: "my-project", * name: "my-project", * orgId: "123456789", * billingAccount: "000000-0000000-0000000-000000", * deletionPolicy: "DELETE", * }); * // Enable the Cloud KMS API * const kmsApiService = new gcp.projects.Service("kms_api_service", { * service: "cloudkms.googleapis.com", * project: resourceProject.projectId, * disableDependentServices: true, * }, { * dependsOn: [resourceProject], * }); * // Wait delay after enabling APIs * const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, { * dependsOn: [kmsApiService], * }); * // Create KMS Service Agent * const kmsServiceAgent = new gcp.projects.ServiceIdentity("kms_service_agent", { * service: "cloudkms.googleapis.com", * project: resourceProject.number, * }, { * dependsOn: [waitEnableServiceApi], * }); * // Wait delay after creating service agent * const waitServiceAgent = new time.Sleep("wait_service_agent", {createDuration: "10s"}, { * dependsOn: [kmsServiceAgent], * }); * // Grant the KMS Service Agent the Cloud KMS Admin role * const autokeyProjectAdmin = new gcp.projects.IAMMember("autokey_project_admin", { * project: resourceProject.projectId, * role: "roles/cloudkms.admin", * member: pulumi.interpolate`serviceAccount:service-${resourceProject.number}@gcp-sa-cloudkms.iam.gserviceaccount.com`, * }, { * dependsOn: [waitServiceAgent], * }); * // Wait delay after granting IAM permissions * const waitSrvAccPermissions = new time.Sleep("wait_srv_acc_permissions", {createDuration: "10s"}, { * dependsOn: [autokeyProjectAdmin], * }); * const example_autokeyconfig_project = new gcp.kms.ProjectAutokeyConfig("example-autokeyconfig-project", { * project: resourceProject.number, * keyProjectResolutionMode: "RESOURCE_PROJECT", * }, { * dependsOn: [waitSrvAccPermissions], * }); * ``` * * ## Import * * ProjectAutokeyConfig can be imported using any of these accepted formats: * * * `projects/{{project}}/autokeyConfig` * * `{{project}}` * * When using the `pulumi import` command, ProjectAutokeyConfig can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:kms/projectAutokeyConfig:ProjectAutokeyConfig default projects/{{project}}/autokeyConfig * $ pulumi import gcp:kms/projectAutokeyConfig:ProjectAutokeyConfig default {{project}} * ``` */ export declare class ProjectAutokeyConfig extends pulumi.CustomResource { /** * Get an existing ProjectAutokeyConfig resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ProjectAutokeyConfigState, opts?: pulumi.CustomResourceOptions): ProjectAutokeyConfig; /** * Returns true if the given object is an instance of ProjectAutokeyConfig. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ProjectAutokeyConfig; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * The etag of the AutokeyConfig for optimistic concurrency control. */ readonly etag: pulumi.Output; /** * How Autokey determines which project to use when provisioning CMEK keys. * Possible values are: `RESOURCE_PROJECT`, `DISABLED`. */ readonly keyProjectResolutionMode: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * Create a ProjectAutokeyConfig resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args?: ProjectAutokeyConfigArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ProjectAutokeyConfig resources. */ export interface ProjectAutokeyConfigState { /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * The etag of the AutokeyConfig for optimistic concurrency control. */ etag?: pulumi.Input; /** * How Autokey determines which project to use when provisioning CMEK keys. * Possible values are: `RESOURCE_PROJECT`, `DISABLED`. */ keyProjectResolutionMode?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; } /** * The set of arguments for constructing a ProjectAutokeyConfig resource. */ export interface ProjectAutokeyConfigArgs { /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * How Autokey determines which project to use when provisioning CMEK keys. * Possible values are: `RESOURCE_PROJECT`, `DISABLED`. */ keyProjectResolutionMode?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; } //# sourceMappingURL=projectAutokeyConfig.d.ts.map