posture.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package securityposture

import (
	"context"
	"reflect"

	"errors"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// A Posture represents a collection of policy set including its name, state, description
// and policy sets. A policy set includes set of policies along with their definition.
// A posture can be created at the organization level.
// Every update to a deployed posture creates a new posture revision with an updated revision_id.
//
// To get more information about Posture, see:
//
// * How-to Guides
//   - [Create and deploy a posture](https://cloud.google.com/security-command-center/docs/how-to-use-security-posture)
//
// ## Example Usage
//
// ### Securityposture Posture Basic
//
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/securityposture"
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			_, err := securityposture.NewPosture(ctx, "posture1", &securityposture.PostureArgs{
//				PostureId:   pulumi.String("posture_example"),
//				Parent:      pulumi.String("organizations/123456789"),
//				Location:    pulumi.String("global"),
//				State:       pulumi.String("ACTIVE"),
//				Description: pulumi.String("a new posture"),
//				PolicySets: securityposture.PosturePolicySetArray{
//					&securityposture.PosturePolicySetArgs{
//						PolicySetId: pulumi.String("org_policy_set"),
//						Description: pulumi.String("set of org policies"),
//						Policies: securityposture.PosturePolicySetPolicyArray{
//							&securityposture.PosturePolicySetPolicyArgs{
//								PolicyId: pulumi.String("canned_org_policy"),
//								Constraint: &securityposture.PosturePolicySetPolicyConstraintArgs{
//									OrgPolicyConstraint: &securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintArgs{
//										CannedConstraintId: pulumi.String("storage.uniformBucketLevelAccess"),
//										PolicyRules: securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintPolicyRuleArray{
//											&securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintPolicyRuleArgs{
//												Enforce: pulumi.Bool(true),
//												Condition: &securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintPolicyRuleConditionArgs{
//													Description: pulumi.String("condition description"),
//													Expression:  pulumi.String("resource.matchTag('org_id/tag_key_short_name,'tag_value_short_name')"),
//													Title:       pulumi.String("a CEL condition"),
//												},
//											},
//										},
//									},
//								},
//							},
//							&securityposture.PosturePolicySetPolicyArgs{
//								PolicyId: pulumi.String("custom_org_policy"),
//								Constraint: &securityposture.PosturePolicySetPolicyConstraintArgs{
//									OrgPolicyConstraintCustom: &securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintCustomArgs{
//										CustomConstraint: &securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintCustomCustomConstraintArgs{
//											Name:        pulumi.String("organizations/123456789/customConstraints/custom.disableGkeAutoUpgrade"),
//											DisplayName: pulumi.String("Disable GKE auto upgrade"),
//											Description: pulumi.String("Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced."),
//											ActionType:  pulumi.String("ALLOW"),
//											Condition:   pulumi.String("resource.management.autoUpgrade == false"),
//											MethodTypes: pulumi.StringArray{
//												pulumi.String("CREATE"),
//												pulumi.String("UPDATE"),
//											},
//											ResourceTypes: pulumi.StringArray{
//												pulumi.String("container.googleapis.com/NodePool"),
//											},
//										},
//										PolicyRules: securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintCustomPolicyRuleArray{
//											&securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintCustomPolicyRuleArgs{
//												Enforce: pulumi.Bool(true),
//												Condition: &securityposture.PosturePolicySetPolicyConstraintOrgPolicyConstraintCustomPolicyRuleConditionArgs{
//													Description: pulumi.String("condition description"),
//													Expression:  pulumi.String("resource.matchTagId('tagKeys/key_id','tagValues/value_id')"),
//													Title:       pulumi.String("a CEL condition"),
//												},
//											},
//										},
//									},
//								},
//							},
//						},
//					},
//					&securityposture.PosturePolicySetArgs{
//						PolicySetId: pulumi.String("sha_policy_set"),
//						Description: pulumi.String("set of sha policies"),
//						Policies: securityposture.PosturePolicySetPolicyArray{
//							&securityposture.PosturePolicySetPolicyArgs{
//								PolicyId: pulumi.String("sha_builtin_module"),
//								Constraint: &securityposture.PosturePolicySetPolicyConstraintArgs{
//									SecurityHealthAnalyticsModule: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsModuleArgs{
//										ModuleName:            pulumi.String("BIGQUERY_TABLE_CMEK_DISABLED"),
//										ModuleEnablementState: pulumi.String("ENABLED"),
//									},
//								},
//								Description: pulumi.String("enable BIGQUERY_TABLE_CMEK_DISABLED"),
//							},
//							&securityposture.PosturePolicySetPolicyArgs{
//								PolicyId: pulumi.String("sha_custom_module"),
//								Constraint: &securityposture.PosturePolicySetPolicyConstraintArgs{
//									SecurityHealthAnalyticsCustomModule: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleArgs{
//										DisplayName: pulumi.String("custom_SHA_policy"),
//										Config: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigArgs{
//											Predicate: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigPredicateArgs{
//												Expression: pulumi.String("resource.rotationPeriod > duration('2592000s')"),
//											},
//											CustomOutput: securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigCustomOutputArgs{
//												Properties: securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigCustomOutputPropertyArray{
//													&securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigCustomOutputPropertyArgs{
//														Name: pulumi.String("duration"),
//														ValueExpression: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigCustomOutputPropertyValueExpressionArgs{
//															Expression: pulumi.String("resource.rotationPeriod"),
//														},
//													},
//												},
//											},
//											ResourceSelector: &securityposture.PosturePolicySetPolicyConstraintSecurityHealthAnalyticsCustomModuleConfigResourceSelectorArgs{
//												ResourceTypes: pulumi.StringArray{
//													pulumi.String("cloudkms.googleapis.com/CryptoKey"),
//												},
//											},
//											Severity:       pulumi.String("LOW"),
//											Description:    pulumi.String("Custom Module"),
//											Recommendation: pulumi.String("Testing custom modules"),
//										},
//										ModuleEnablementState: pulumi.String("ENABLED"),
//									},
//								},
//							},
//						},
//					},
//				},
//			})
//			if err != nil {
//				return err
//			}
//			return nil
//		})
//	}
//
// ```
//
// ## Import
//
// Posture can be imported using any of these accepted formats:
//
// * `{{parent}}/locations/{{location}}/postures/{{posture_id}}`
//
// When using the `pulumi import` command, Posture can be imported using one of the formats above. For example:
//
// ```sh
// $ pulumi import gcp:securityposture/posture:Posture default {{parent}}/locations/{{location}}/postures/{{posture_id}}
// ```
type Posture struct {
	pulumi.CustomResourceState

	// Time the Posture was created in UTC.
	CreateTime pulumi.StringOutput `pulumi:"createTime"`
	// Description of the posture.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// For Resource freshness validation (https://google.aip.dev/154)
	Etag pulumi.StringOutput `pulumi:"etag"`
	// Location of the resource, eg: global.
	Location pulumi.StringOutput `pulumi:"location"`
	// Name of the posture.
	Name pulumi.StringOutput `pulumi:"name"`
	// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
	Parent pulumi.StringOutput `pulumi:"parent"`
	// List of policy sets for the posture.
	// Structure is documented below.
	PolicySets PosturePolicySetArrayOutput `pulumi:"policySets"`
	// Id of the posture. It is an immutable field.
	PostureId pulumi.StringOutput `pulumi:"postureId"`
	// If set, there are currently changes in flight to the posture.
	Reconciling pulumi.BoolOutput `pulumi:"reconciling"`
	// Revision_id of the posture.
	RevisionId pulumi.StringOutput `pulumi:"revisionId"`
	// State of the posture. Update to state field should not be triggered along with
	// with other field updates.
	// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
	State pulumi.StringOutput `pulumi:"state"`
	// Time the Posture was updated in UTC.
	UpdateTime pulumi.StringOutput `pulumi:"updateTime"`
}

// NewPosture registers a new resource with the given unique name, arguments, and options.
func NewPosture(ctx *pulumi.Context,
	name string, args *PostureArgs, opts ...pulumi.ResourceOption) (*Posture, error) {
	if args == nil {
		return nil, errors.New("missing one or more required arguments")
	}

	if args.Location == nil {
		return nil, errors.New("invalid value for required argument 'Location'")
	}
	if args.Parent == nil {
		return nil, errors.New("invalid value for required argument 'Parent'")
	}
	if args.PolicySets == nil {
		return nil, errors.New("invalid value for required argument 'PolicySets'")
	}
	if args.PostureId == nil {
		return nil, errors.New("invalid value for required argument 'PostureId'")
	}
	if args.State == nil {
		return nil, errors.New("invalid value for required argument 'State'")
	}
	opts = internal.PkgResourceDefaultOpts(opts)
	var resource Posture
	err := ctx.RegisterResource("gcp:securityposture/posture:Posture", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetPosture gets an existing Posture resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetPosture(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *PostureState, opts ...pulumi.ResourceOption) (*Posture, error) {
	var resource Posture
	err := ctx.ReadResource("gcp:securityposture/posture:Posture", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering Posture resources.
type postureState struct {
	// Time the Posture was created in UTC.
	CreateTime *string `pulumi:"createTime"`
	// Description of the posture.
	Description *string `pulumi:"description"`
	// For Resource freshness validation (https://google.aip.dev/154)
	Etag *string `pulumi:"etag"`
	// Location of the resource, eg: global.
	Location *string `pulumi:"location"`
	// Name of the posture.
	Name *string `pulumi:"name"`
	// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
	Parent *string `pulumi:"parent"`
	// List of policy sets for the posture.
	// Structure is documented below.
	PolicySets []PosturePolicySet `pulumi:"policySets"`
	// Id of the posture. It is an immutable field.
	PostureId *string `pulumi:"postureId"`
	// If set, there are currently changes in flight to the posture.
	Reconciling *bool `pulumi:"reconciling"`
	// Revision_id of the posture.
	RevisionId *string `pulumi:"revisionId"`
	// State of the posture. Update to state field should not be triggered along with
	// with other field updates.
	// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
	State *string `pulumi:"state"`
	// Time the Posture was updated in UTC.
	UpdateTime *string `pulumi:"updateTime"`
}

type PostureState struct {
	// Time the Posture was created in UTC.
	CreateTime pulumi.StringPtrInput
	// Description of the posture.
	Description pulumi.StringPtrInput
	// For Resource freshness validation (https://google.aip.dev/154)
	Etag pulumi.StringPtrInput
	// Location of the resource, eg: global.
	Location pulumi.StringPtrInput
	// Name of the posture.
	Name pulumi.StringPtrInput
	// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
	Parent pulumi.StringPtrInput
	// List of policy sets for the posture.
	// Structure is documented below.
	PolicySets PosturePolicySetArrayInput
	// Id of the posture. It is an immutable field.
	PostureId pulumi.StringPtrInput
	// If set, there are currently changes in flight to the posture.
	Reconciling pulumi.BoolPtrInput
	// Revision_id of the posture.
	RevisionId pulumi.StringPtrInput
	// State of the posture. Update to state field should not be triggered along with
	// with other field updates.
	// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
	State pulumi.StringPtrInput
	// Time the Posture was updated in UTC.
	UpdateTime pulumi.StringPtrInput
}

func (PostureState) ElementType() reflect.Type {
	return reflect.TypeOf((*postureState)(nil)).Elem()
}

type postureArgs struct {
	// Description of the posture.
	Description *string `pulumi:"description"`
	// Location of the resource, eg: global.
	Location string `pulumi:"location"`
	// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
	Parent string `pulumi:"parent"`
	// List of policy sets for the posture.
	// Structure is documented below.
	PolicySets []PosturePolicySet `pulumi:"policySets"`
	// Id of the posture. It is an immutable field.
	PostureId string `pulumi:"postureId"`
	// State of the posture. Update to state field should not be triggered along with
	// with other field updates.
	// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
	State string `pulumi:"state"`
}

// The set of arguments for constructing a Posture resource.
type PostureArgs struct {
	// Description of the posture.
	Description pulumi.StringPtrInput
	// Location of the resource, eg: global.
	Location pulumi.StringInput
	// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
	Parent pulumi.StringInput
	// List of policy sets for the posture.
	// Structure is documented below.
	PolicySets PosturePolicySetArrayInput
	// Id of the posture. It is an immutable field.
	PostureId pulumi.StringInput
	// State of the posture. Update to state field should not be triggered along with
	// with other field updates.
	// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
	State pulumi.StringInput
}

func (PostureArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*postureArgs)(nil)).Elem()
}

type PostureInput interface {
	pulumi.Input

	ToPostureOutput() PostureOutput
	ToPostureOutputWithContext(ctx context.Context) PostureOutput
}

func (*Posture) ElementType() reflect.Type {
	return reflect.TypeOf((**Posture)(nil)).Elem()
}

func (i *Posture) ToPostureOutput() PostureOutput {
	return i.ToPostureOutputWithContext(context.Background())
}

func (i *Posture) ToPostureOutputWithContext(ctx context.Context) PostureOutput {
	return pulumi.ToOutputWithContext(ctx, i).(PostureOutput)
}

// PostureArrayInput is an input type that accepts PostureArray and PostureArrayOutput values.
// You can construct a concrete instance of `PostureArrayInput` via:
//
//	PostureArray{ PostureArgs{...} }
type PostureArrayInput interface {
	pulumi.Input

	ToPostureArrayOutput() PostureArrayOutput
	ToPostureArrayOutputWithContext(context.Context) PostureArrayOutput
}

type PostureArray []PostureInput

func (PostureArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*Posture)(nil)).Elem()
}

func (i PostureArray) ToPostureArrayOutput() PostureArrayOutput {
	return i.ToPostureArrayOutputWithContext(context.Background())
}

func (i PostureArray) ToPostureArrayOutputWithContext(ctx context.Context) PostureArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(PostureArrayOutput)
}

// PostureMapInput is an input type that accepts PostureMap and PostureMapOutput values.
// You can construct a concrete instance of `PostureMapInput` via:
//
//	PostureMap{ "key": PostureArgs{...} }
type PostureMapInput interface {
	pulumi.Input

	ToPostureMapOutput() PostureMapOutput
	ToPostureMapOutputWithContext(context.Context) PostureMapOutput
}

type PostureMap map[string]PostureInput

func (PostureMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*Posture)(nil)).Elem()
}

func (i PostureMap) ToPostureMapOutput() PostureMapOutput {
	return i.ToPostureMapOutputWithContext(context.Background())
}

func (i PostureMap) ToPostureMapOutputWithContext(ctx context.Context) PostureMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(PostureMapOutput)
}

type PostureOutput struct{ *pulumi.OutputState }

func (PostureOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**Posture)(nil)).Elem()
}

func (o PostureOutput) ToPostureOutput() PostureOutput {
	return o
}

func (o PostureOutput) ToPostureOutputWithContext(ctx context.Context) PostureOutput {
	return o
}

// Time the Posture was created in UTC.
func (o PostureOutput) CreateTime() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.CreateTime }).(pulumi.StringOutput)
}

// Description of the posture.
func (o PostureOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringPtrOutput { return v.Description }).(pulumi.StringPtrOutput)
}

// For Resource freshness validation (https://google.aip.dev/154)
func (o PostureOutput) Etag() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.Etag }).(pulumi.StringOutput)
}

// Location of the resource, eg: global.
func (o PostureOutput) Location() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.Location }).(pulumi.StringOutput)
}

// Name of the posture.
func (o PostureOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
}

// The parent of the resource, an organization. Format should be `organizations/{organization_id}`.
func (o PostureOutput) Parent() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.Parent }).(pulumi.StringOutput)
}

// List of policy sets for the posture.
// Structure is documented below.
func (o PostureOutput) PolicySets() PosturePolicySetArrayOutput {
	return o.ApplyT(func(v *Posture) PosturePolicySetArrayOutput { return v.PolicySets }).(PosturePolicySetArrayOutput)
}

// Id of the posture. It is an immutable field.
func (o PostureOutput) PostureId() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.PostureId }).(pulumi.StringOutput)
}

// If set, there are currently changes in flight to the posture.
func (o PostureOutput) Reconciling() pulumi.BoolOutput {
	return o.ApplyT(func(v *Posture) pulumi.BoolOutput { return v.Reconciling }).(pulumi.BoolOutput)
}

// Revision_id of the posture.
func (o PostureOutput) RevisionId() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.RevisionId }).(pulumi.StringOutput)
}

// State of the posture. Update to state field should not be triggered along with
// with other field updates.
// Possible values are: `DEPRECATED`, `DRAFT`, `ACTIVE`.
func (o PostureOutput) State() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.State }).(pulumi.StringOutput)
}

// Time the Posture was updated in UTC.
func (o PostureOutput) UpdateTime() pulumi.StringOutput {
	return o.ApplyT(func(v *Posture) pulumi.StringOutput { return v.UpdateTime }).(pulumi.StringOutput)
}

type PostureArrayOutput struct{ *pulumi.OutputState }

func (PostureArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*Posture)(nil)).Elem()
}

func (o PostureArrayOutput) ToPostureArrayOutput() PostureArrayOutput {
	return o
}

func (o PostureArrayOutput) ToPostureArrayOutputWithContext(ctx context.Context) PostureArrayOutput {
	return o
}

func (o PostureArrayOutput) Index(i pulumi.IntInput) PostureOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) *Posture {
		return vs[0].([]*Posture)[vs[1].(int)]
	}).(PostureOutput)
}

type PostureMapOutput struct{ *pulumi.OutputState }

func (PostureMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*Posture)(nil)).Elem()
}

func (o PostureMapOutput) ToPostureMapOutput() PostureMapOutput {
	return o
}

func (o PostureMapOutput) ToPostureMapOutputWithContext(ctx context.Context) PostureMapOutput {
	return o
}

func (o PostureMapOutput) MapIndex(k pulumi.StringInput) PostureOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) *Posture {
		return vs[0].(map[string]*Posture)[vs[1].(string)]
	}).(PostureOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*PostureInput)(nil)).Elem(), &Posture{})
	pulumi.RegisterInputType(reflect.TypeOf((*PostureArrayInput)(nil)).Elem(), PostureArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*PostureMapInput)(nil)).Elem(), PostureMap{})
	pulumi.RegisterOutputType(PostureOutput{})
	pulumi.RegisterOutputType(PostureArrayOutput{})
	pulumi.RegisterOutputType(PostureMapOutput{})
}