iambinding.go

// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

package serviceaccount

import (
	"context"
	"reflect"

	"github.com/pkg/errors"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// When managing IAM roles, you can treat a service account either as a resource or as an identity. This resource is to add iam policy bindings to a service account resource, such as allowing the members to run operations as or modify the service account. To configure permissions for a service account on other GCP resources, use the googleProjectIam set of resources.
//
// Three different resources help you manage your IAM policy for a service account. Each of these resources serves a different use case:
//
// * `serviceAccount.IAMPolicy`: Authoritative. Sets the IAM policy for the service account and replaces any existing policy already attached.
// * `serviceAccount.IAMBinding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the service account are preserved.
// * `serviceAccount.IAMMember`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the service account are preserved.
//
// > **Note:** `serviceAccount.IAMPolicy` **cannot** be used in conjunction with `serviceAccount.IAMBinding` and `serviceAccount.IAMMember` or they will fight over what your policy should be.
//
// > **Note:** `serviceAccount.IAMBinding` resources **can be** used in conjunction with `serviceAccount.IAMMember` resources **only if** they do not grant privilege to the same role.
//
// ## google\_service\_account\_iam\_policy
//
// ```go
// package main
//
// import (
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/organizations"
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/serviceAccount"
// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
// )
//
// func main() {
// 	pulumi.Run(func(ctx *pulumi.Context) error {
// 		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
// 			Bindings: []organizations.GetIAMPolicyBinding{
// 				organizations.GetIAMPolicyBinding{
// 					Role: "roles/iam.serviceAccountUser",
// 					Members: []string{
// 						"user:jane@example.com",
// 					},
// 				},
// 			},
// 		}, nil)
// 		if err != nil {
// 			return err
// 		}
// 		sa, err := serviceAccount.NewAccount(ctx, "sa", &serviceAccount.AccountArgs{
// 			AccountId:   pulumi.String("my-service-account"),
// 			DisplayName: pulumi.String("A service account that only Jane can interact with"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMPolicy(ctx, "admin_account_iam", &serviceAccount.IAMPolicyArgs{
// 			ServiceAccountId: sa.Name,
// 			PolicyData:       pulumi.String(admin.PolicyData),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		return nil
// 	})
// }
// ```
//
// ## google\_service\_account\_iam\_binding
//
// ```go
// package main
//
// import (
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/serviceAccount"
// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
// )
//
// func main() {
// 	pulumi.Run(func(ctx *pulumi.Context) error {
// 		sa, err := serviceAccount.NewAccount(ctx, "sa", &serviceAccount.AccountArgs{
// 			AccountId:   pulumi.String("my-service-account"),
// 			DisplayName: pulumi.String("A service account that only Jane can use"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMBinding(ctx, "admin_account_iam", &serviceAccount.IAMBindingArgs{
// 			ServiceAccountId: sa.Name,
// 			Role:             pulumi.String("roles/iam.serviceAccountUser"),
// 			Members: pulumi.StringArray{
// 				pulumi.String("user:jane@example.com"),
// 			},
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		return nil
// 	})
// }
// ```
//
// With IAM Conditions:
//
// ```go
// package main
//
// import (
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/serviceAccount"
// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
// )
//
// func main() {
// 	pulumi.Run(func(ctx *pulumi.Context) error {
// 		sa, err := serviceAccount.NewAccount(ctx, "sa", &serviceAccount.AccountArgs{
// 			AccountId:   pulumi.String("my-service-account"),
// 			DisplayName: pulumi.String("A service account that only Jane can use"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMBinding(ctx, "admin_account_iam", &serviceAccount.IAMBindingArgs{
// 			Condition: &serviceaccount.IAMBindingConditionArgs{
// 				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
// 				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
// 				Title:       pulumi.String("expires_after_2019_12_31"),
// 			},
// 			Members: pulumi.StringArray{
// 				pulumi.String("user:jane@example.com"),
// 			},
// 			Role:             pulumi.String("roles/iam.serviceAccountUser"),
// 			ServiceAccountId: sa.Name,
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		return nil
// 	})
// }
// ```
//
// ## google\_service\_account\_iam\_member
//
// ```go
// package main
//
// import (
// 	"fmt"
//
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/compute"
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/serviceAccount"
// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
// )
//
// func main() {
// 	pulumi.Run(func(ctx *pulumi.Context) error {
// 		_default, err := compute.GetDefaultServiceAccount(ctx, nil, nil)
// 		if err != nil {
// 			return err
// 		}
// 		sa, err := serviceAccount.NewAccount(ctx, "sa", &serviceAccount.AccountArgs{
// 			AccountId:   pulumi.String("my-service-account"),
// 			DisplayName: pulumi.String("A service account that Jane can use"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMMember(ctx, "admin_account_iam", &serviceAccount.IAMMemberArgs{
// 			ServiceAccountId: sa.Name,
// 			Role:             pulumi.String("roles/iam.serviceAccountUser"),
// 			Member:           pulumi.String("user:jane@example.com"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMMember(ctx, "gce_default_account_iam", &serviceAccount.IAMMemberArgs{
// 			ServiceAccountId: pulumi.String(_default.Name),
// 			Role:             pulumi.String("roles/iam.serviceAccountUser"),
// 			Member: sa.Email.ApplyT(func(email string) (string, error) {
// 				return fmt.Sprintf("%v%v", "serviceAccount:", email), nil
// 			}).(pulumi.StringOutput),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		return nil
// 	})
// }
// ```
//
// With IAM Conditions:
//
// ```go
// package main
//
// import (
// 	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/serviceAccount"
// 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
// )
//
// func main() {
// 	pulumi.Run(func(ctx *pulumi.Context) error {
// 		sa, err := serviceAccount.NewAccount(ctx, "sa", &serviceAccount.AccountArgs{
// 			AccountId:   pulumi.String("my-service-account"),
// 			DisplayName: pulumi.String("A service account that Jane can use"),
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		_, err = serviceAccount.NewIAMMember(ctx, "admin_account_iam", &serviceAccount.IAMMemberArgs{
// 			Condition: &serviceaccount.IAMMemberConditionArgs{
// 				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
// 				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
// 				Title:       pulumi.String("expires_after_2019_12_31"),
// 			},
// 			Member:           pulumi.String("user:jane@example.com"),
// 			Role:             pulumi.String("roles/iam.serviceAccountUser"),
// 			ServiceAccountId: sa.Name,
// 		})
// 		if err != nil {
// 			return err
// 		}
// 		return nil
// 	})
// }
// ```
//
// ## Import
//
// Service account IAM resources can be imported using the project, service account email, role, member identity, and condition (beta).
//
// ```sh
//  $ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam projects/{your-project-id}/serviceAccounts/{your-service-account-email}
// ```
//
// ```sh
//  $ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser"
// ```
//
// ```sh
//  $ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/editor user:foo@example.com"
// ```
//
//  -> **Custom Roles**If you're importing a IAM resource with a custom role, make sure to use the full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`. With conditions
//
// ```sh
//  $ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser expires_after_2019_12_31"
// ```
//
// ```sh
//  $ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser user:foo@example.com expires_after_2019_12_31"
// ```
type IAMBinding struct {
	pulumi.CustomResourceState

	// An [IAM Condition](https://cloud.google.com/iam/docs/conditions-overview) for a given binding.
	// Structure is documented below.
	Condition IAMBindingConditionPtrOutput `pulumi:"condition"`
	// (Computed) The etag of the service account IAM policy.
	Etag    pulumi.StringOutput      `pulumi:"etag"`
	Members pulumi.StringArrayOutput `pulumi:"members"`
	// The role that should be applied. Only one
	// `serviceAccount.IAMBinding` can be used per role. Note that custom roles must be of the format
	// `[projects|organizations]/{parent-name}/roles/{role-name}`.
	Role pulumi.StringOutput `pulumi:"role"`
	// The fully-qualified name of the service account to apply policy to.
	ServiceAccountId pulumi.StringOutput `pulumi:"serviceAccountId"`
}

// NewIAMBinding registers a new resource with the given unique name, arguments, and options.
func NewIAMBinding(ctx *pulumi.Context,
	name string, args *IAMBindingArgs, opts ...pulumi.ResourceOption) (*IAMBinding, error) {
	if args == nil {
		return nil, errors.New("missing one or more required arguments")
	}

	if args.Members == nil {
		return nil, errors.New("invalid value for required argument 'Members'")
	}
	if args.Role == nil {
		return nil, errors.New("invalid value for required argument 'Role'")
	}
	if args.ServiceAccountId == nil {
		return nil, errors.New("invalid value for required argument 'ServiceAccountId'")
	}
	var resource IAMBinding
	err := ctx.RegisterResource("gcp:serviceAccount/iAMBinding:IAMBinding", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetIAMBinding gets an existing IAMBinding resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetIAMBinding(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *IAMBindingState, opts ...pulumi.ResourceOption) (*IAMBinding, error) {
	var resource IAMBinding
	err := ctx.ReadResource("gcp:serviceAccount/iAMBinding:IAMBinding", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering IAMBinding resources.
type iambindingState struct {
	// An [IAM Condition](https://cloud.google.com/iam/docs/conditions-overview) for a given binding.
	// Structure is documented below.
	Condition *IAMBindingCondition `pulumi:"condition"`
	// (Computed) The etag of the service account IAM policy.
	Etag    *string  `pulumi:"etag"`
	Members []string `pulumi:"members"`
	// The role that should be applied. Only one
	// `serviceAccount.IAMBinding` can be used per role. Note that custom roles must be of the format
	// `[projects|organizations]/{parent-name}/roles/{role-name}`.
	Role *string `pulumi:"role"`
	// The fully-qualified name of the service account to apply policy to.
	ServiceAccountId *string `pulumi:"serviceAccountId"`
}

type IAMBindingState struct {
	// An [IAM Condition](https://cloud.google.com/iam/docs/conditions-overview) for a given binding.
	// Structure is documented below.
	Condition IAMBindingConditionPtrInput
	// (Computed) The etag of the service account IAM policy.
	Etag    pulumi.StringPtrInput
	Members pulumi.StringArrayInput
	// The role that should be applied. Only one
	// `serviceAccount.IAMBinding` can be used per role. Note that custom roles must be of the format
	// `[projects|organizations]/{parent-name}/roles/{role-name}`.
	Role pulumi.StringPtrInput
	// The fully-qualified name of the service account to apply policy to.
	ServiceAccountId pulumi.StringPtrInput
}

func (IAMBindingState) ElementType() reflect.Type {
	return reflect.TypeOf((*iambindingState)(nil)).Elem()
}

type iambindingArgs struct {
	// An [IAM Condition](https://cloud.google.com/iam/docs/conditions-overview) for a given binding.
	// Structure is documented below.
	Condition *IAMBindingCondition `pulumi:"condition"`
	Members   []string             `pulumi:"members"`
	// The role that should be applied. Only one
	// `serviceAccount.IAMBinding` can be used per role. Note that custom roles must be of the format
	// `[projects|organizations]/{parent-name}/roles/{role-name}`.
	Role string `pulumi:"role"`
	// The fully-qualified name of the service account to apply policy to.
	ServiceAccountId string `pulumi:"serviceAccountId"`
}

// The set of arguments for constructing a IAMBinding resource.
type IAMBindingArgs struct {
	// An [IAM Condition](https://cloud.google.com/iam/docs/conditions-overview) for a given binding.
	// Structure is documented below.
	Condition IAMBindingConditionPtrInput
	Members   pulumi.StringArrayInput
	// The role that should be applied. Only one
	// `serviceAccount.IAMBinding` can be used per role. Note that custom roles must be of the format
	// `[projects|organizations]/{parent-name}/roles/{role-name}`.
	Role pulumi.StringInput
	// The fully-qualified name of the service account to apply policy to.
	ServiceAccountId pulumi.StringInput
}

func (IAMBindingArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*iambindingArgs)(nil)).Elem()
}

type IAMBindingInput interface {
	pulumi.Input

	ToIAMBindingOutput() IAMBindingOutput
	ToIAMBindingOutputWithContext(ctx context.Context) IAMBindingOutput
}

func (*IAMBinding) ElementType() reflect.Type {
	return reflect.TypeOf((*IAMBinding)(nil))
}

func (i *IAMBinding) ToIAMBindingOutput() IAMBindingOutput {
	return i.ToIAMBindingOutputWithContext(context.Background())
}

func (i *IAMBinding) ToIAMBindingOutputWithContext(ctx context.Context) IAMBindingOutput {
	return pulumi.ToOutputWithContext(ctx, i).(IAMBindingOutput)
}

func (i *IAMBinding) ToIAMBindingPtrOutput() IAMBindingPtrOutput {
	return i.ToIAMBindingPtrOutputWithContext(context.Background())
}

func (i *IAMBinding) ToIAMBindingPtrOutputWithContext(ctx context.Context) IAMBindingPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(IAMBindingPtrOutput)
}

type IAMBindingPtrInput interface {
	pulumi.Input

	ToIAMBindingPtrOutput() IAMBindingPtrOutput
	ToIAMBindingPtrOutputWithContext(ctx context.Context) IAMBindingPtrOutput
}

type iambindingPtrType IAMBindingArgs

func (*iambindingPtrType) ElementType() reflect.Type {
	return reflect.TypeOf((**IAMBinding)(nil))
}

func (i *iambindingPtrType) ToIAMBindingPtrOutput() IAMBindingPtrOutput {
	return i.ToIAMBindingPtrOutputWithContext(context.Background())
}

func (i *iambindingPtrType) ToIAMBindingPtrOutputWithContext(ctx context.Context) IAMBindingPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(IAMBindingPtrOutput)
}

// IAMBindingArrayInput is an input type that accepts IAMBindingArray and IAMBindingArrayOutput values.
// You can construct a concrete instance of `IAMBindingArrayInput` via:
//
//          IAMBindingArray{ IAMBindingArgs{...} }
type IAMBindingArrayInput interface {
	pulumi.Input

	ToIAMBindingArrayOutput() IAMBindingArrayOutput
	ToIAMBindingArrayOutputWithContext(context.Context) IAMBindingArrayOutput
}

type IAMBindingArray []IAMBindingInput

func (IAMBindingArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*IAMBinding)(nil)).Elem()
}

func (i IAMBindingArray) ToIAMBindingArrayOutput() IAMBindingArrayOutput {
	return i.ToIAMBindingArrayOutputWithContext(context.Background())
}

func (i IAMBindingArray) ToIAMBindingArrayOutputWithContext(ctx context.Context) IAMBindingArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(IAMBindingArrayOutput)
}

// IAMBindingMapInput is an input type that accepts IAMBindingMap and IAMBindingMapOutput values.
// You can construct a concrete instance of `IAMBindingMapInput` via:
//
//          IAMBindingMap{ "key": IAMBindingArgs{...} }
type IAMBindingMapInput interface {
	pulumi.Input

	ToIAMBindingMapOutput() IAMBindingMapOutput
	ToIAMBindingMapOutputWithContext(context.Context) IAMBindingMapOutput
}

type IAMBindingMap map[string]IAMBindingInput

func (IAMBindingMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*IAMBinding)(nil)).Elem()
}

func (i IAMBindingMap) ToIAMBindingMapOutput() IAMBindingMapOutput {
	return i.ToIAMBindingMapOutputWithContext(context.Background())
}

func (i IAMBindingMap) ToIAMBindingMapOutputWithContext(ctx context.Context) IAMBindingMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(IAMBindingMapOutput)
}

type IAMBindingOutput struct{ *pulumi.OutputState }

func (IAMBindingOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*IAMBinding)(nil))
}

func (o IAMBindingOutput) ToIAMBindingOutput() IAMBindingOutput {
	return o
}

func (o IAMBindingOutput) ToIAMBindingOutputWithContext(ctx context.Context) IAMBindingOutput {
	return o
}

func (o IAMBindingOutput) ToIAMBindingPtrOutput() IAMBindingPtrOutput {
	return o.ToIAMBindingPtrOutputWithContext(context.Background())
}

func (o IAMBindingOutput) ToIAMBindingPtrOutputWithContext(ctx context.Context) IAMBindingPtrOutput {
	return o.ApplyTWithContext(ctx, func(_ context.Context, v IAMBinding) *IAMBinding {
		return &v
	}).(IAMBindingPtrOutput)
}

type IAMBindingPtrOutput struct{ *pulumi.OutputState }

func (IAMBindingPtrOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**IAMBinding)(nil))
}

func (o IAMBindingPtrOutput) ToIAMBindingPtrOutput() IAMBindingPtrOutput {
	return o
}

func (o IAMBindingPtrOutput) ToIAMBindingPtrOutputWithContext(ctx context.Context) IAMBindingPtrOutput {
	return o
}

func (o IAMBindingPtrOutput) Elem() IAMBindingOutput {
	return o.ApplyT(func(v *IAMBinding) IAMBinding {
		if v != nil {
			return *v
		}
		var ret IAMBinding
		return ret
	}).(IAMBindingOutput)
}

type IAMBindingArrayOutput struct{ *pulumi.OutputState }

func (IAMBindingArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]IAMBinding)(nil))
}

func (o IAMBindingArrayOutput) ToIAMBindingArrayOutput() IAMBindingArrayOutput {
	return o
}

func (o IAMBindingArrayOutput) ToIAMBindingArrayOutputWithContext(ctx context.Context) IAMBindingArrayOutput {
	return o
}

func (o IAMBindingArrayOutput) Index(i pulumi.IntInput) IAMBindingOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) IAMBinding {
		return vs[0].([]IAMBinding)[vs[1].(int)]
	}).(IAMBindingOutput)
}

type IAMBindingMapOutput struct{ *pulumi.OutputState }

func (IAMBindingMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]IAMBinding)(nil))
}

func (o IAMBindingMapOutput) ToIAMBindingMapOutput() IAMBindingMapOutput {
	return o
}

func (o IAMBindingMapOutput) ToIAMBindingMapOutputWithContext(ctx context.Context) IAMBindingMapOutput {
	return o
}

func (o IAMBindingMapOutput) MapIndex(k pulumi.StringInput) IAMBindingOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) IAMBinding {
		return vs[0].(map[string]IAMBinding)[vs[1].(string)]
	}).(IAMBindingOutput)
}

func init() {
	pulumi.RegisterOutputType(IAMBindingOutput{})
	pulumi.RegisterOutputType(IAMBindingPtrOutput{})
	pulumi.RegisterOutputType(IAMBindingArrayOutput{})
	pulumi.RegisterOutputType(IAMBindingMapOutput{})
}