import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Represents an IAM v3 Access Policy parented by a Folder. This policy defines rules * that allow or deny access to resources within the specified folder based on principals and conditions. * See the Cloud IAM documentation for more details on Access Policies. * * > **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider. * See Provider Versions for more details on beta resources. * * To get more information about FolderAccessPolicy, see: * * * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v3beta/folders.locations.accessPolicies) * * ## Example Usage * * ### Access Policy Folder Minimal * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * import * as time from "@pulumiverse/time"; * * const folder = new gcp.organizations.Folder("folder", { * displayName: "ap-folder-", * parent: "organizations/123456789", * deletionProtection: false, * }); * const project = new gcp.organizations.Project("project", { * projectId: "ap-project-", * name: "ap-project-", * folderId: folder.folderId, * billingAccount: "000000-0000000-0000000-000000", * deletionPolicy: "DELETE", * }, { * dependsOn: [folder], * }); * const iamApi = new gcp.projects.Service("iam_api", { * project: project.projectId, * service: "iam.googleapis.com", * disableOnDestroy: false, * }, { * dependsOn: [project], * }); * const waitForPropagation = new time.Sleep("wait_for_propagation", {createDuration: "30s"}, { * dependsOn: [ * folder, * iamApi, * ], * }); * const testSa = new gcp.serviceaccount.Account("test_sa", { * accountId: "svc-acc-", * displayName: "Test Service Account for Access Policy", * project: project.projectId, * }, { * dependsOn: [waitForPropagation], * }); * const example = new gcp.iam.FolderAccessPolicy("example", { * folder: folder.folderId, * location: "global", * accessPolicyId: "my-folder-policy-", * details: { * rules: [{ * effect: "ALLOW", * principals: [pulumi.interpolate`principal://iam.googleapis.com/projects/-/serviceAccounts/${testSa.email}`], * operation: { * permissions: ["eventarc.googleapis.com/messageBuses.publish"], * }, * }], * }, * }, { * dependsOn: [ * waitForPropagation, * testSa, * ], * }); * ``` * * ## Import * * FolderAccessPolicy can be imported using any of these accepted formats: * * * `folders/{{folder}}/locations/{{location}}/accessPolicies/{{access_policy_id}}` * * `{{folder}}/{{location}}/{{access_policy_id}}` * * When using the `pulumi import` command, FolderAccessPolicy can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:iam/folderAccessPolicy:FolderAccessPolicy default folders/{{folder}}/locations/{{location}}/accessPolicies/{{access_policy_id}} * $ pulumi import gcp:iam/folderAccessPolicy:FolderAccessPolicy default {{folder}}/{{location}}/{{access_policy_id}} * ``` */ export declare class FolderAccessPolicy extends pulumi.CustomResource { /** * Get an existing FolderAccessPolicy resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: FolderAccessPolicyState, opts?: pulumi.CustomResourceOptions): FolderAccessPolicy; /** * Returns true if the given object is an instance of FolderAccessPolicy. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is FolderAccessPolicy; /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ readonly accessPolicyId: pulumi.Output; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ readonly annotations: pulumi.Output<{ [key: string]: string; } | undefined>; /** * The time when the access policy was created. */ readonly createTime: pulumi.Output; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ readonly deletionPolicy: pulumi.Output; /** * Access policy details. * Structure is documented below. */ readonly details: pulumi.Output; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ readonly displayName: pulumi.Output; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ readonly effectiveAnnotations: pulumi.Output<{ [key: string]: string; }>; /** * The etag for the access policy. * If this is provided on update, it must match the server's etag. */ readonly etag: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly folder: pulumi.Output; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ readonly location: pulumi.Output; /** * Identifier. The resource name of the access policy. * The following formats are supported: * * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}` */ readonly name: pulumi.Output; /** * The globally unique ID of the access policy. */ readonly uid: pulumi.Output; /** * The time when the access policy was most recently * updated. */ readonly updateTime: pulumi.Output; /** * Create a FolderAccessPolicy resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: FolderAccessPolicyArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering FolderAccessPolicy resources. */ export interface FolderAccessPolicyState { /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ accessPolicyId?: pulumi.Input; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The time when the access policy was created. */ createTime?: pulumi.Input; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Access policy details. * Structure is documented below. */ details?: pulumi.Input; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ displayName?: pulumi.Input; /** * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services. */ effectiveAnnotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * The etag for the access policy. * If this is provided on update, it must match the server's etag. */ etag?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ folder?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location?: pulumi.Input; /** * Identifier. The resource name of the access policy. * The following formats are supported: * * `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` * * `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}` * * `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` * * `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}` */ name?: pulumi.Input; /** * The globally unique ID of the access policy. */ uid?: pulumi.Input; /** * The time when the access policy was most recently * updated. */ updateTime?: pulumi.Input; } /** * The set of arguments for constructing a FolderAccessPolicy resource. */ export interface FolderAccessPolicyArgs { /** * The ID to use for the access policy, which * will become the final component of the access policy's * resource name. * This value must start with a lowercase letter followed by up to 62 * lowercase letters, numbers, hyphens, or dots. Pattern, * /a-z{2,62}/. * This value must be unique among all access policies with the same parent. */ accessPolicyId: pulumi.Input; /** * User defined annotations. See https://google.aip.dev/148#annotations for * more details such as format and size limitations * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration. * Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource. */ annotations?: pulumi.Input<{ [key: string]: pulumi.Input; } | undefined>; /** * Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. * When a 'terraform destroy' or 'pulumi up' would delete the resource, * the command will fail if this field is set to "PREVENT" in Terraform state. * When set to "ABANDON", the command will remove the resource from Terraform * management without updating or deleting the resource in the API. * When set to "DELETE", deleting the resource is allowed. */ deletionPolicy?: pulumi.Input; /** * Access policy details. * Structure is documented below. */ details?: pulumi.Input; /** * The description of the access policy. Must be less than * or equal to 63 characters. */ displayName?: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ folder: pulumi.Input; /** * Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. */ location: pulumi.Input; } //# sourceMappingURL=folderAccessPolicy.d.ts.map