Package com.pulumi.gcp.projects

Class IAMPolicy

java.lang.Object

com.pulumi.resources.Resource

com.pulumi.resources.CustomResource

com.pulumi.gcp.projects.IAMPolicy

public class IAMPolicy
extends com.pulumi.resources.CustomResource

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case: * `gcp.projects.IAMPolicy`: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached. * `gcp.projects.IAMBinding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved. * `gcp.projects.IAMMember`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved. * `gcp.projects.IAMAuditConfig`: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service. > **Note:** `gcp.projects.IAMPolicy` **cannot** be used in conjunction with `gcp.projects.IAMBinding`, `gcp.projects.IAMMember`, or `gcp.projects.IAMAuditConfig` or they will fight over what your policy should be. > **Note:** `gcp.projects.IAMBinding` resources **can be** used in conjunction with `gcp.projects.IAMMember` resources **only if** they do not grant privilege to the same role. > **Note:** The underlying API method `projects.setIamPolicy` has a lot of constraints which are documented [here](https://cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy). In addition to these constraints, IAM Conditions cannot be used with Basic Roles such as Owner. Violating these constraints will result in the API returning 400 error code so please review these if you encounter errors with this resource. ## google\_project\_iam\_policy !> **Be careful!** You can accidentally lock yourself out of your project using this resource. Deleting a `gcp.projects.IAMPolicy` removes access from anyone without organization-level access to the project. Proceed with caution. It's not recommended to use `gcp.projects.IAMPolicy` with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to **import** the policy before applying the change. ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.organizations.OrganizationsFunctions; import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs; import com.pulumi.gcp.projects.IAMPolicy; import com.pulumi.gcp.projects.IAMPolicyArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder() .bindings(GetIAMPolicyBindingArgs.builder() .role("roles/editor") .members("user:[email protected]") .build()) .build()); var project = new IAMPolicy("project", IAMPolicyArgs.builder() .project("your-project-id") .policyData(admin.applyValue(getIAMPolicyResult -> getIAMPolicyResult.policyData())) .build()); } } ``` With IAM Conditions: ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.organizations.OrganizationsFunctions; import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs; import com.pulumi.gcp.projects.IAMPolicy; import com.pulumi.gcp.projects.IAMPolicyArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder() .bindings(GetIAMPolicyBindingArgs.builder() .condition(GetIAMPolicyBindingConditionArgs.builder() .description("Expiring at midnight of 2019-12-31") .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")") .title("expires_after_2019_12_31") .build()) .members("user:[email protected]") .role("roles/compute.admin") .build()) .build()); var project = new IAMPolicy("project", IAMPolicyArgs.builder() .policyData(admin.applyValue(getIAMPolicyResult -> getIAMPolicyResult.policyData())) .project("your-project-id") .build()); } } ``` ## google\_project\_iam\_binding ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.projects.IAMBinding; import com.pulumi.gcp.projects.IAMBindingArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var project = new IAMBinding("project", IAMBindingArgs.builder() .members("user:[email protected]") .project("your-project-id") .role("roles/editor") .build()); } } ``` With IAM Conditions: ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.projects.IAMBinding; import com.pulumi.gcp.projects.IAMBindingArgs; import com.pulumi.gcp.projects.inputs.IAMBindingConditionArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var project = new IAMBinding("project", IAMBindingArgs.builder() .condition(IAMBindingConditionArgs.builder() .description("Expiring at midnight of 2019-12-31") .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")") .title("expires_after_2019_12_31") .build()) .members("user:[email protected]") .project("your-project-id") .role("roles/container.admin") .build()); } } ``` ## google\_project\_iam\_member ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.projects.IAMMember; import com.pulumi.gcp.projects.IAMMemberArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var project = new IAMMember("project", IAMMemberArgs.builder() .member("user:[email protected]") .project("your-project-id") .role("roles/editor") .build()); } } ``` With IAM Conditions: ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.projects.IAMMember; import com.pulumi.gcp.projects.IAMMemberArgs; import com.pulumi.gcp.projects.inputs.IAMMemberConditionArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var project = new IAMMember("project", IAMMemberArgs.builder() .condition(IAMMemberConditionArgs.builder() .description("Expiring at midnight of 2019-12-31") .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")") .title("expires_after_2019_12_31") .build()) .member("user:[email protected]") .project("your-project-id") .role("roles/firebase.admin") .build()); } } ``` ## google\_project\_iam\_audit\_config ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.gcp.projects.IAMAuditConfig; import com.pulumi.gcp.projects.IAMAuditConfigArgs; import com.pulumi.gcp.projects.inputs.IAMAuditConfigAuditLogConfigArgs; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var project = new IAMAuditConfig("project", IAMAuditConfigArgs.builder() .auditLogConfigs( IAMAuditConfigAuditLogConfigArgs.builder() .logType("ADMIN_READ") .build(), IAMAuditConfigAuditLogConfigArgs.builder() .exemptedMembers("user:[email protected]") .logType("DATA_READ") .build()) .project("your-project-id") .service("allServices") .build()); } } ``` ## Import ### Importing Audit Configs An audit config can be imported into a `google_project_iam_audit_config` resource using the resource's `project_id` and the `service`, e.g* `"{{project_id}} foo.googleapis.com"` An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import audit configstf import { id = "{{project_id}} foo.googleapis.com" to = google_project_iam_audit_config.default } ```sh $ pulumi import gcp:projects/iAMPolicy:IAMPolicy The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used ``` ```sh $ pulumi import gcp:projects/iAMPolicy:IAMPolicy default "{{project_id}} foo.googleapis.com" ```

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

com.pulumi.resources.CustomResource.CustomResourceInternal

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary

Fields inherited from class com.pulumi.resources.Resource

childResources, remote

Constructor Summary

Constructors

Constructor	Description
IAMPolicy(java.lang.String name)
IAMPolicy(java.lang.String name, IAMPolicyArgs args)
IAMPolicy(java.lang.String name, IAMPolicyArgs args, com.pulumi.resources.CustomResourceOptions options)

Method Summary

Modifier and Type	Method	Description
com.pulumi.core.Output<java.lang.String>	etag()
static IAMPolicy	get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, IAMPolicyState state, com.pulumi.resources.CustomResourceOptions options)	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
com.pulumi.core.Output<java.lang.String>	policyData()
com.pulumi.core.Output<java.lang.String>	project()

Methods inherited from class com.pulumi.resources.CustomResource

getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource

getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

IAMPolicy

public IAMPolicy(java.lang.String name)

Parameters:

name - The _unique_ name of the resulting resource.

IAMPolicy

public IAMPolicy(java.lang.String name,
                 IAMPolicyArgs args)

Parameters:

name - The _unique_ name of the resulting resource.

args - The arguments to use to populate this resource's properties.

IAMPolicy

public IAMPolicy(java.lang.String name,
                 IAMPolicyArgs args,
                 @Nullable
                 com.pulumi.resources.CustomResourceOptions options)

Parameters:

name - The _unique_ name of the resulting resource.

args - The arguments to use to populate this resource's properties.

options - A bag of options that control this resource's behavior.

Method Detail

etag

public com.pulumi.core.Output<java.lang.String> etag()

Returns:

(Computed) The etag of the project's IAM policy.

policyData

public com.pulumi.core.Output<java.lang.String> policyData()

Returns:

The `gcp.organizations.getIAMPolicy` data source that represents the IAM policy that will be applied to the project. The policy will be merged with any existing policy applied to the project. Changing this updates the policy. Deleting this removes all policies from the project, locking out users without organization-level access.

project

public com.pulumi.core.Output<java.lang.String> project()

Returns:

The project id of the target project. This is not inferred from the provider.

get

public static IAMPolicy get(java.lang.String name,
                            com.pulumi.core.Output<java.lang.String> id,
                            @Nullable
                            IAMPolicyState state,
                            @Nullable
                            com.pulumi.resources.CustomResourceOptions options)

Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Parameters:

name - The _unique_ name of the resulting resource.

id - The _unique_ provider ID of the resource to lookup.

state -

options - Optional settings to control the behavior of the CustomResource.