import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * A Regional Secret is a logical secret whose value and versions can be created and accessed within a region only. * * To get more information about RegionalSecret, see: * * * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.locations.secrets) * * How-to Guides * * [Create and deploy a Regional Secret](https://cloud.google.com/secret-manager/regional-secrets/create-regional-secret) * * ## Example Usage * * ### Regional Secret Config Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const regional_secret_basic = new gcp.secretmanager.RegionalSecret("regional-secret-basic", { * secretId: "tf-reg-secret", * location: "us-central1", * labels: { * label: "my-label", * }, * annotations: { * key1: "value1", * key2: "value2", * key3: "value3", * }, * deletionProtection: false, * }); * ``` * ### Regional Secret With Cmek * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const project = gcp.organizations.getProject({}); * const kms_secret_binding = new gcp.kms.CryptoKeyIAMMember("kms-secret-binding", { * cryptoKeyId: "kms-key", * role: "roles/cloudkms.cryptoKeyEncrypterDecrypter", * member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com`), * }); * const regional_secret_with_cmek = new gcp.secretmanager.RegionalSecret("regional-secret-with-cmek", { * secretId: "tf-reg-secret", * location: "us-central1", * customerManagedEncryption: { * kmsKeyName: "kms-key", * }, * }, { * dependsOn: [kms_secret_binding], * }); * ``` * ### Regional Secret With Rotation * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const project = gcp.organizations.getProject({}); * const topic = new gcp.pubsub.Topic("topic", {name: "tf-topic"}); * const secretsManagerAccess = new gcp.pubsub.TopicIAMMember("secrets_manager_access", { * topic: topic.name, * role: "roles/pubsub.publisher", * member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com`), * }); * const regional_secret_with_rotation = new gcp.secretmanager.RegionalSecret("regional-secret-with-rotation", { * secretId: "tf-reg-secret", * location: "us-central1", * topics: [{ * name: topic.id, * }], * rotation: { * rotationPeriod: "3600s", * nextRotationTime: "2045-11-30T00:00:00Z", * }, * }, { * dependsOn: [secretsManagerAccess], * }); * ``` * ### Regional Secret With Ttl * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const regional_secret_with_ttl = new gcp.secretmanager.RegionalSecret("regional-secret-with-ttl", { * secretId: "tf-reg-secret", * location: "us-central1", * labels: { * label: "my-label", * }, * annotations: { * key1: "value1", * key2: "value2", * key3: "value3", * }, * ttl: "36000s", * }); * ``` * ### Regional Secret With Expire Time * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const regional_secret_with_expire_time = new gcp.secretmanager.RegionalSecret("regional-secret-with-expire-time", { * secretId: "tf-reg-secret", * location: "us-central1", * labels: { * label: "my-label", * }, * annotations: { * key1: "value1", * key2: "value2", * key3: "value3", * }, * expireTime: "2055-11-30T00:00:00Z", * }); * ``` * ### Regional Secret With Version Destroy Ttl * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const regional_secret_with_version_destroy_ttl = new gcp.secretmanager.RegionalSecret("regional-secret-with-version-destroy-ttl", { * secretId: "tf-reg-secret", * location: "us-central1", * labels: { * label: "my-label", * }, * annotations: { * key1: "value1", * key2: "value2", * key3: "value3", * }, * versionDestroyTtl: "86400s", * }); * ``` * * ## Import * * RegionalSecret can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}` * * `{{project}}/{{location}}/{{secret_id}}` * * `{{location}}/{{secret_id}}` * * When using the `pulumi import` command, RegionalSecret can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default projects/{{project}}/locations/{{location}}/secrets/{{secret_id}} * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default {{project}}/{{location}}/{{secret_id}} * $ pulumi import gcp:secretmanager/regionalSecret:RegionalSecret default {{location}}/{{secret_id}} * ``` */ export declare class RegionalSecret extends pulumi.CustomResource { /** * Get an existing RegionalSecret resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: RegionalSecretState, opts?: pulumi.CustomResourceOptions): RegionalSecret; /** * Returns true if the given object is an instance of RegionalSecret. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is RegionalSecret; /** * Custom metadata about the regional secret. * Annotations are distinct from various forms of labels. Annotations exist to allow * client tools to store their own state information without requiring a database. * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these * symbols. * The total size of annotation keys and values must be less than 16KiB. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ readonly annotations: pulumi.Output<{ [key: string]: string; } | undefined>; /** * The time at which the regional secret was created. */ readonly createTime: pulumi.Output; /** * The customer-managed encryption configuration of the regional secret. * Structure is documented below. */ readonly customerManagedEncryption: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * Whether Terraform will be prevented from destroying the regional secret. Defaults to false. * When the field is set to true in Terraform state, a `pulumi up` * or `terraform destroy` that would delete the federation will fail. */ readonly deletionProtection: pulumi.Output; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ readonly effectiveAnnotations: pulumi.Output<{ [key: string]: string; }>; /** * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services. */ readonly effectiveLabels: pulumi.Output<{ [key: string]: string; }>; /** * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided. */ readonly expireTime: pulumi.Output; /** * The labels assigned to this regional secret. * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62} * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63} * No more than 64 labels can be assigned to a given resource. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration. * Please refer to the field `effectiveLabels` for all of the labels present on the resource. */ readonly labels: pulumi.Output<{ [key: string]: string; } | undefined>; /** * The location of the regional secret. eg us-central1 */ readonly location: pulumi.Output; /** * The resource name of the regional secret. Format: * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}` */ readonly name: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * The combination of labels configured directly on the resource * and default labels configured on the provider. */ readonly pulumiLabels: pulumi.Output<{ [key: string]: string; }>; /** * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be * set to configure rotation. * Structure is documented below. */ readonly rotation: pulumi.Output; /** * This must be unique within the project. */ readonly secretId: pulumi.Output; /** * A map of resource manager tags. * Resource manager tag keys and values have the same definition as resource manager tags. * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}. */ readonly tags: pulumi.Output<{ [key: string]: string; } | undefined>; /** * A list of up to 10 Pub/Sub topics to which messages are published when control plane * operations are called on the regional secret or its versions. * Structure is documented below. */ readonly topics: pulumi.Output; /** * The TTL for the regional secret. A duration in seconds with up to nine fractional digits, * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided. */ readonly ttl: pulumi.Output; /** * Mapping from version alias to version name. * A version alias is a string with a maximum length of 63 characters and can contain * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_') * characters. An alias string must start with a letter and cannot be the string * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. */ readonly versionAliases: pulumi.Output<{ [key: string]: string; } | undefined>; /** * Secret Version TTL after destruction request. * This is a part of the delayed delete feature on Secret Version. * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately * on calling destroy instead the version goes to a disabled state and * the actual destruction happens after this TTL expires. It must be atleast 24h. */ readonly versionDestroyTtl: pulumi.Output; /** * Create a RegionalSecret resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: RegionalSecretArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering RegionalSecret resources. */ export interface RegionalSecretState { /** * Custom metadata about the regional secret. * Annotations are distinct from various forms of labels. Annotations exist to allow * client tools to store their own state information without requiring a database. * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these * symbols. * The total size of annotation keys and values must be less than 16KiB. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The time at which the regional secret was created. */ createTime?: pulumi.Input; /** * The customer-managed encryption configuration of the regional secret. * Structure is documented below. */ customerManagedEncryption?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the regional secret. Defaults to false. * When the field is set to true in Terraform state, a `pulumi up` * or `terraform destroy` that would delete the federation will fail. */ deletionProtection?: pulumi.Input; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ effectiveAnnotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services. */ effectiveLabels?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided. */ expireTime?: pulumi.Input; /** * The labels assigned to this regional secret. * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62} * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63} * No more than 64 labels can be assigned to a given resource. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration. * Please refer to the field `effectiveLabels` for all of the labels present on the resource. */ labels?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The location of the regional secret. eg us-central1 */ location?: pulumi.Input; /** * The resource name of the regional secret. Format: * `projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}` */ name?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The combination of labels configured directly on the resource * and default labels configured on the provider. */ pulumiLabels?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be * set to configure rotation. * Structure is documented below. */ rotation?: pulumi.Input; /** * This must be unique within the project. */ secretId?: pulumi.Input; /** * A map of resource manager tags. * Resource manager tag keys and values have the same definition as resource manager tags. * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}. */ tags?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * A list of up to 10 Pub/Sub topics to which messages are published when control plane * operations are called on the regional secret or its versions. * Structure is documented below. */ topics?: pulumi.Input[] | undefined>; /** * The TTL for the regional secret. A duration in seconds with up to nine fractional digits, * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided. */ ttl?: pulumi.Input; /** * Mapping from version alias to version name. * A version alias is a string with a maximum length of 63 characters and can contain * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_') * characters. An alias string must start with a letter and cannot be the string * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. */ versionAliases?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * Secret Version TTL after destruction request. * This is a part of the delayed delete feature on Secret Version. * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately * on calling destroy instead the version goes to a disabled state and * the actual destruction happens after this TTL expires. It must be atleast 24h. */ versionDestroyTtl?: pulumi.Input; } /** * The set of arguments for constructing a RegionalSecret resource. */ export interface RegionalSecretArgs { /** * Custom metadata about the regional secret. * Annotations are distinct from various forms of labels. Annotations exist to allow * client tools to store their own state information without requiring a database. * Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of * maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and * may have dashes (-), underscores (_), dots (.), and alphanumerics in between these * symbols. * The total size of annotation keys and values must be less than 16KiB. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The customer-managed encryption configuration of the regional secret. * Structure is documented below. */ customerManagedEncryption?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the regional secret. Defaults to false. * When the field is set to true in Terraform state, a `pulumi up` * or `terraform destroy` that would delete the federation will fail. */ deletionProtection?: pulumi.Input; /** * Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on * output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with * nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and * "2014-10-02T15:01:23.045123456Z". Only one of `expireTime` or `ttl` can be provided. */ expireTime?: pulumi.Input; /** * The labels assigned to this regional secret. * Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62} * Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, * and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63} * No more than 64 labels can be assigned to a given resource. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. * * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration. * Please refer to the field `effectiveLabels` for all of the labels present on the resource. */ labels?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The location of the regional secret. eg us-central1 */ location: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * The rotation time and period for a regional secret. At `nextRotationTime`, Secret Manager * will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be * set to configure rotation. * Structure is documented below. */ rotation?: pulumi.Input; /** * This must be unique within the project. */ secretId: pulumi.Input; /** * A map of resource manager tags. * Resource manager tag keys and values have the same definition as resource manager tags. * Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}. */ tags?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * A list of up to 10 Pub/Sub topics to which messages are published when control plane * operations are called on the regional secret or its versions. * Structure is documented below. */ topics?: pulumi.Input[] | undefined>; /** * The TTL for the regional secret. A duration in seconds with up to nine fractional digits, * terminated by 's'. Example: "3.5s". Only one of `ttl` or `expireTime` can be provided. */ ttl?: pulumi.Input; /** * Mapping from version alias to version name. * A version alias is a string with a maximum length of 63 characters and can contain * uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_') * characters. An alias string must start with a letter and cannot be the string * 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret. * An object containing a list of "key": value pairs. Example: * { "name": "wrench", "mass": "1.3kg", "count": "3" }. */ versionAliases?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * Secret Version TTL after destruction request. * This is a part of the delayed delete feature on Secret Version. * For secret with versionDestroyTtl>0, version destruction doesn't happen immediately * on calling destroy instead the version goes to a disabled state and * the actual destruction happens after this TTL expires. It must be atleast 24h. */ versionDestroyTtl?: pulumi.Input; } //# sourceMappingURL=regionalSecret.d.ts.map