import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Framework deployments represent the assignment of a framework to a target resource. Supported target resources are organizations, folders, and projects. * * To get more information about FrameworkDeployment, see: * * * [API documentation](https://docs.cloud.google.com/security-command-center/docs/reference/cloudsecuritycompliance/rest/v1/organizations.locations.frameworkDeployments) * * ## Example Usage * * ### Cloudsecuritycompliance Framework Deployment Org Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.cloudsecuritycompliance.Framework("example", { * parent: "organizations/123456789", * location: "global", * frameworkId: "example-framework", * displayName: "Terraform Framework Name", * description: "An Terraform description for the framework", * cloudControlDetails: [{ * name: "organizations/123456789/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown", * majorRevisionId: "2", * parameters: [ * { * name: "location", * parameterValue: { * stringValue: "us-central1", * }, * }, * { * name: "oneof-parameter", * parameterValue: { * oneofValue: { * name: "test-oneof", * parameterValue: { * stringValue: "test-value", * }, * }, * }, * }, * { * name: "bool-parameter", * parameterValue: { * oneofValue: { * name: "bool-oneof", * parameterValue: { * boolValue: true, * }, * }, * }, * }, * { * name: "number-parameter", * parameterValue: { * oneofValue: { * name: "number-oneof", * parameterValue: { * numberValue: 123.45, * }, * }, * }, * }, * { * name: "string-list-parameter", * parameterValue: { * oneofValue: { * name: "string-list-oneof", * parameterValue: { * stringListValue: { * values: [ * "value1", * "value2", * ], * }, * }, * }, * }, * }, * ], * }], * }); * const exampleFrameworkDeployment = new gcp.cloudsecuritycompliance.FrameworkDeployment("example", { * parent: "organizations/123456789", * location: "global", * frameworkDeploymentId: "example-deployment", * description: "A framework deployment for cloud security compliance", * framework: { * framework: example.name, * majorRevisionId: "1", * }, * targetResourceConfig: { * existingTargetResource: "organizations/123456789", * }, * cloudControlMetadatas: [{ * enforcementMode: "DETECTIVE", * cloudControlDetails: { * name: "organizations/123456789/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown", * majorRevisionId: "2", * parameters: [ * { * name: "enabled", * parameterValue: { * boolValue: true, * }, * }, * { * name: "regions", * parameterValue: { * stringListValue: { * values: [ * "us-central1", * "us-west1", * "us-east1", * ], * }, * }, * }, * { * name: "location", * parameterValue: { * stringValue: "us-central1", * }, * }, * { * name: "oneof-parameter", * parameterValue: { * oneofValue: { * name: "test-oneof", * parameterValue: { * stringValue: "test-value", * }, * }, * }, * }, * { * name: "bool-parameter", * parameterValue: { * oneofValue: { * name: "bool-oneof", * parameterValue: { * boolValue: true, * }, * }, * }, * }, * { * name: "number-parameter", * parameterValue: { * oneofValue: { * name: "number-oneof", * parameterValue: { * numberValue: 123.45, * }, * }, * }, * }, * { * name: "string-list-parameter", * parameterValue: { * oneofValue: { * name: "string-list-oneof", * parameterValue: { * stringListValue: { * values: [ * "value1", * "value2", * ], * }, * }, * }, * }, * }, * ], * }, * }], * }); * ``` * ### Cloudsecuritycompliance Framework Deployment Project Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const project = gcp.organizations.getProject({}); * const example = new gcp.cloudsecuritycompliance.Framework("example", { * parent: project.then(project => `projects/${project.number}`), * location: "global", * frameworkId: "example-framework", * displayName: "Terraform Framework Name", * description: "An Terraform description for the framework", * cloudControlDetails: [{ * name: project.then(project => `projects/${project.number}/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown`), * majorRevisionId: "2", * parameters: [ * { * name: "location", * parameterValue: { * stringValue: "us-central1", * }, * }, * { * name: "oneof-parameter", * parameterValue: { * oneofValue: { * name: "test-oneof", * parameterValue: { * stringValue: "test-value", * }, * }, * }, * }, * { * name: "bool-parameter", * parameterValue: { * oneofValue: { * name: "bool-oneof", * parameterValue: { * boolValue: true, * }, * }, * }, * }, * { * name: "number-parameter", * parameterValue: { * oneofValue: { * name: "number-oneof", * parameterValue: { * numberValue: 123.45, * }, * }, * }, * }, * { * name: "string-list-parameter", * parameterValue: { * oneofValue: { * name: "string-list-oneof", * parameterValue: { * stringListValue: { * values: [ * "value1", * "value2", * ], * }, * }, * }, * }, * }, * ], * }], * }); * const exampleFrameworkDeployment = new gcp.cloudsecuritycompliance.FrameworkDeployment("example", { * parent: project.then(project => `projects/${project.number}`), * location: "global", * frameworkDeploymentId: "example-deployment", * description: "A framework deployment for cloud security compliance", * framework: { * framework: example.name, * majorRevisionId: "1", * }, * targetResourceConfig: { * existingTargetResource: project.then(project => `projects/${project.projectId}`), * }, * cloudControlMetadatas: [{ * enforcementMode: "DETECTIVE", * cloudControlDetails: { * name: project.then(project => `projects/${project.number}/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown`), * majorRevisionId: "2", * parameters: [ * { * name: "enabled", * parameterValue: { * boolValue: true, * }, * }, * { * name: "regions", * parameterValue: { * stringListValue: { * values: [ * "us-central1", * "us-west1", * "us-east1", * ], * }, * }, * }, * { * name: "location", * parameterValue: { * stringValue: "us-central1", * }, * }, * { * name: "oneof-parameter", * parameterValue: { * oneofValue: { * name: "test-oneof", * parameterValue: { * stringValue: "test-value", * }, * }, * }, * }, * { * name: "bool-parameter", * parameterValue: { * oneofValue: { * name: "bool-oneof", * parameterValue: { * boolValue: true, * }, * }, * }, * }, * { * name: "number-parameter", * parameterValue: { * oneofValue: { * name: "number-oneof", * parameterValue: { * numberValue: 123.45, * }, * }, * }, * }, * { * name: "string-list-parameter", * parameterValue: { * oneofValue: { * name: "string-list-oneof", * parameterValue: { * stringListValue: { * values: [ * "value1", * "value2", * ], * }, * }, * }, * }, * }, * ], * }, * }], * }); * ``` * ### Cloudsecuritycompliance Framework Deployment Org Project Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const project = gcp.organizations.getProject({}); * const example = new gcp.cloudsecuritycompliance.Framework("example", { * parent: "organizations/123456789", * location: "global", * frameworkId: "example-framework", * displayName: "Terraform Framework Name", * description: "A Terraform description for the framework", * cloudControlDetails: [{ * name: "organizations/123456789/locations/global/cloudControls/builtin-require-cmek-on-bigquery-datasets", * majorRevisionId: "2", * parameters: [{ * name: "location", * parameterValue: { * numberValue: 1, * }, * }], * }], * }); * const exampleFrameworkDeployment = new gcp.cloudsecuritycompliance.FrameworkDeployment("example", { * parent: "organizations/123456789", * location: "global", * frameworkDeploymentId: "example-deployment", * description: "A framework deployment with org parent targeting a project", * framework: { * framework: example.name, * majorRevisionId: "1", * }, * targetResourceConfig: { * existingTargetResource: project.then(project => `projects/${project.projectId}`), * }, * cloudControlMetadatas: [{ * enforcementMode: "DETECTIVE", * cloudControlDetails: { * name: "organizations/123456789/locations/global/cloudControls/builtin-require-cmek-on-bigquery-datasets", * majorRevisionId: "2", * parameters: [{ * name: "location", * parameterValue: { * numberValue: 1, * }, * }], * }, * }], * }); * ``` * ### Cloudsecuritycompliance Framework Deployment Project Application Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const project = gcp.organizations.getProject({}); * // App Hub Application resource to act as the target * const application = new gcp.apphub.Application("application", { * location: "us-central1", * applicationId: "example-app", * scope: { * type: "REGIONAL", * }, * }); * const example = new gcp.cloudsecuritycompliance.Framework("example", { * parent: project.then(project => `projects/${project.number}`), * location: "global", * frameworkId: "example-framework", * displayName: "Terraform Framework Name", * description: "A Terraform description for the framework", * cloudControlDetails: [{ * name: project.then(project => `projects/${project.number}/locations/global/cloudControls/builtin-require-cmek-on-bigquery-datasets`), * majorRevisionId: "2", * parameters: [{ * name: "location", * parameterValue: { * numberValue: 1, * }, * }], * }], * }); * const exampleFrameworkDeployment = new gcp.cloudsecuritycompliance.FrameworkDeployment("example", { * parent: project.then(project => `projects/${project.number}`), * location: "global", * frameworkDeploymentId: "example-deployment", * description: "A framework deployment with project parent targeting an application", * framework: { * framework: example.name, * majorRevisionId: "1", * }, * targetResourceConfig: { * existingTargetResource: pulumi.all([project, application.applicationId]).apply(([project, applicationId]) => `projects/${project.number}/locations/us-central1/applications/${applicationId}`), * }, * cloudControlMetadatas: [{ * enforcementMode: "DETECTIVE", * cloudControlDetails: { * name: project.then(project => `projects/${project.number}/locations/global/cloudControls/builtin-require-cmek-on-bigquery-datasets`), * majorRevisionId: "2", * parameters: [{ * name: "location", * parameterValue: { * numberValue: 1, * }, * }], * }, * }], * }); * ``` * ### Cloudsecuritycompliance Framework Deployment Org Basic Backward * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * * const example = new gcp.cloudsecuritycompliance.Framework("example", { * organization: "123456789", * location: "global", * frameworkId: "example-framework", * displayName: "Terraform Framework Name", * description: "An Terraform description for the framework", * cloudControlDetails: [{ * name: "organizations/123456789/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown", * majorRevisionId: "2", * parameters: [{ * name: "location", * parameterValue: { * stringValue: "us-central1", * }, * }], * }], * }); * const exampleFrameworkDeployment = new gcp.cloudsecuritycompliance.FrameworkDeployment("example", { * organization: "123456789", * location: "global", * frameworkDeploymentId: "example-deployment", * description: "A framework deployment for cloud security compliance", * framework: { * framework: example.name, * majorRevisionId: "1", * }, * targetResourceConfig: { * existingTargetResource: "organizations/123456789", * }, * cloudControlMetadatas: [{ * enforcementMode: "DETECTIVE", * cloudControlDetails: { * name: "organizations/123456789/locations/global/cloudControls/builtin-detective-policy-for-vertex-ai-runtime-template-idle-shutdown", * majorRevisionId: "2", * parameters: [{ * name: "enabled", * parameterValue: { * boolValue: true, * }, * }], * }, * }], * }); * ``` * * ## Import * * FrameworkDeployment can be imported using any of these accepted formats: * * * `organizations/{{organization}}/locations/{{location}}/frameworkDeployments/{{framework_deployment_id}}` * * `{{parent}}/locations/{{location}}/frameworkDeployments/{{framework_deployment_id}}` * * When using the `pulumi import` command, FrameworkDeployment can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:cloudsecuritycompliance/frameworkDeployment:FrameworkDeployment default organizations/{{organization}}/locations/{{location}}/frameworkDeployments/{{framework_deployment_id}} * $ pulumi import gcp:cloudsecuritycompliance/frameworkDeployment:FrameworkDeployment default {{parent}}/locations/{{location}}/frameworkDeployments/{{framework_deployment_id}} * ``` */ export declare class FrameworkDeployment extends pulumi.CustomResource { /** * Get an existing FrameworkDeployment resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: FrameworkDeploymentState, opts?: pulumi.CustomResourceOptions): FrameworkDeployment; /** * Returns true if the given object is an instance of FrameworkDeployment. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is FrameworkDeployment; /** * The references to the cloud control deployments. It has all the * CloudControlDeployments which are either directly added in the framework or * through a CloudControlGroup. * Example: If a framework deployment deploys two * cloud controls, cc-deployment-1 and cc-deployment-2, then the * cloudControlDeploymentReferences will be: * { * cloud_control_deployment_reference: { * cloud_control_deployment: * "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-1" * }, * cloud_control_deployment_reference: { * cloud_control_deployment: * "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-2" * } * Structure is documented below. */ readonly cloudControlDeploymentReferences: pulumi.Output; /** * Deployment mode and parameters for each of the Cloud Controls in * the framework. Every Cloud Control in the framework must have a * CloudControlMetadata. * Structure is documented below. */ readonly cloudControlMetadatas: pulumi.Output; /** * The resource on which the Framework is deployed based on the provided * TargetResourceConfig in the following format: * organizations/{organization}, folders/{folder} or projects/{project} */ readonly computedTargetResource: pulumi.Output; /** * The time at which the resource was created. */ readonly createTime: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * The deployment state of the framework. * Possible values: * DEPLOYMENT_STATE_VALIDATING * DEPLOYMENT_STATE_CREATING * DEPLOYMENT_STATE_DELETING * DEPLOYMENT_STATE_FAILED * DEPLOYMENT_STATE_READY * DEPLOYMENT_STATE_PARTIALLY_DEPLOYED * DEPLOYMENT_STATE_PARTIALLY_DELETED */ readonly deploymentState: pulumi.Output; /** * User provided description of the Framework deployment */ readonly description: pulumi.Output; /** * To prevent concurrent updates from overwriting each other, always provide * the `etag` when you update a FrameworkDeployment. You can also * provide the `etag` when you delete a FrameworkDeployment, to help * ensure that you're deleting the intended version of the * FrameworkDeployment. */ readonly etag: pulumi.Output; /** * FrameworkReference contains the reference of a framework. * Structure is documented below. */ readonly framework: pulumi.Output; /** * User provided identifier. It should be unique in scope of a parent. * This is optional and if not provided, a random UUID will be generated. */ readonly frameworkDeploymentId: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly location: pulumi.Output; /** * Identifier. FrameworkDeployment name in the following format: * {parent}/locations/{location}/frameworkDeployments/{framework_deployment_id} */ readonly name: pulumi.Output; /** * (Optional, Deprecated) * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. * * > **Warning:** Use `parent` instead. * * @deprecated Use `parent` instead. */ readonly organization: pulumi.Output; /** * The parent resource in which to create the resource. * Must be in one of the following formats: * * `projects/{{project}}` * * `organizations/{{organization}}` */ readonly parent: pulumi.Output; /** * TargetResourceConfig contains either the name of the targetResource or * contains the config to create a new target_resource. * Structure is documented below. */ readonly targetResourceConfig: pulumi.Output; /** * The display name of the target resource. */ readonly targetResourceDisplayName: pulumi.Output; /** * The time at which the resource last updated. */ readonly updateTime: pulumi.Output; /** * Create a FrameworkDeployment resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: FrameworkDeploymentArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering FrameworkDeployment resources. */ export interface FrameworkDeploymentState { /** * The references to the cloud control deployments. It has all the * CloudControlDeployments which are either directly added in the framework or * through a CloudControlGroup. * Example: If a framework deployment deploys two * cloud controls, cc-deployment-1 and cc-deployment-2, then the * cloudControlDeploymentReferences will be: * { * cloud_control_deployment_reference: { * cloud_control_deployment: * "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-1" * }, * cloud_control_deployment_reference: { * cloud_control_deployment: * "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-2" * } * Structure is documented below. */ cloudControlDeploymentReferences?: pulumi.Input[] | undefined>; /** * Deployment mode and parameters for each of the Cloud Controls in * the framework. Every Cloud Control in the framework must have a * CloudControlMetadata. * Structure is documented below. */ cloudControlMetadatas?: pulumi.Input[] | undefined>; /** * The resource on which the Framework is deployed based on the provided * TargetResourceConfig in the following format: * organizations/{organization}, folders/{folder} or projects/{project} */ computedTargetResource?: pulumi.Input; /** * The time at which the resource was created. */ createTime?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * The deployment state of the framework. * Possible values: * DEPLOYMENT_STATE_VALIDATING * DEPLOYMENT_STATE_CREATING * DEPLOYMENT_STATE_DELETING * DEPLOYMENT_STATE_FAILED * DEPLOYMENT_STATE_READY * DEPLOYMENT_STATE_PARTIALLY_DEPLOYED * DEPLOYMENT_STATE_PARTIALLY_DELETED */ deploymentState?: pulumi.Input; /** * User provided description of the Framework deployment */ description?: pulumi.Input; /** * To prevent concurrent updates from overwriting each other, always provide * the `etag` when you update a FrameworkDeployment. You can also * provide the `etag` when you delete a FrameworkDeployment, to help * ensure that you're deleting the intended version of the * FrameworkDeployment. */ etag?: pulumi.Input; /** * FrameworkReference contains the reference of a framework. * Structure is documented below. */ framework?: pulumi.Input; /** * User provided identifier. It should be unique in scope of a parent. * This is optional and if not provided, a random UUID will be generated. */ frameworkDeploymentId?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input; /** * Identifier. FrameworkDeployment name in the following format: * {parent}/locations/{location}/frameworkDeployments/{framework_deployment_id} */ name?: pulumi.Input; /** * (Optional, Deprecated) * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. * * > **Warning:** Use `parent` instead. * * @deprecated Use `parent` instead. */ organization?: pulumi.Input; /** * The parent resource in which to create the resource. * Must be in one of the following formats: * * `projects/{{project}}` * * `organizations/{{organization}}` */ parent?: pulumi.Input; /** * TargetResourceConfig contains either the name of the targetResource or * contains the config to create a new target_resource. * Structure is documented below. */ targetResourceConfig?: pulumi.Input; /** * The display name of the target resource. */ targetResourceDisplayName?: pulumi.Input; /** * The time at which the resource last updated. */ updateTime?: pulumi.Input; } /** * The set of arguments for constructing a FrameworkDeployment resource. */ export interface FrameworkDeploymentArgs { /** * Deployment mode and parameters for each of the Cloud Controls in * the framework. Every Cloud Control in the framework must have a * CloudControlMetadata. * Structure is documented below. */ cloudControlMetadatas: pulumi.Input[]>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * User provided description of the Framework deployment */ description?: pulumi.Input; /** * FrameworkReference contains the reference of a framework. * Structure is documented below. */ framework: pulumi.Input; /** * User provided identifier. It should be unique in scope of a parent. * This is optional and if not provided, a random UUID will be generated. */ frameworkDeploymentId: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input; /** * (Optional, Deprecated) * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. * * > **Warning:** Use `parent` instead. * * @deprecated Use `parent` instead. */ organization?: pulumi.Input; /** * The parent resource in which to create the resource. * Must be in one of the following formats: * * `projects/{{project}}` * * `organizations/{{organization}}` */ parent?: pulumi.Input; /** * TargetResourceConfig contains either the name of the targetResource or * contains the config to create a new target_resource. * Structure is documented below. */ targetResourceConfig: pulumi.Input; } //# sourceMappingURL=frameworkDeployment.d.ts.map