pulumiTypes.go

// Code generated by the Pulumi SDK Generator DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package v1

import (
	"context"
	"reflect"

	"github.com/pulumi/pulumi-google-native/sdk/go/google/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

var _ = internal.GetEnvOrDefault

// Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
type AuditConfig struct {
	// The configuration for logging of each type of permission.
	AuditLogConfigs []AuditLogConfig `pulumi:"auditLogConfigs"`
	// Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
	Service *string `pulumi:"service"`
}

// AuditConfigInput is an input type that accepts AuditConfigArgs and AuditConfigOutput values.
// You can construct a concrete instance of `AuditConfigInput` via:
//
//	AuditConfigArgs{...}
type AuditConfigInput interface {
	pulumi.Input

	ToAuditConfigOutput() AuditConfigOutput
	ToAuditConfigOutputWithContext(context.Context) AuditConfigOutput
}

// Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
type AuditConfigArgs struct {
	// The configuration for logging of each type of permission.
	AuditLogConfigs AuditLogConfigArrayInput `pulumi:"auditLogConfigs"`
	// Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
	Service pulumi.StringPtrInput `pulumi:"service"`
}

func (AuditConfigArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditConfig)(nil)).Elem()
}

func (i AuditConfigArgs) ToAuditConfigOutput() AuditConfigOutput {
	return i.ToAuditConfigOutputWithContext(context.Background())
}

func (i AuditConfigArgs) ToAuditConfigOutputWithContext(ctx context.Context) AuditConfigOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AuditConfigOutput)
}

// AuditConfigArrayInput is an input type that accepts AuditConfigArray and AuditConfigArrayOutput values.
// You can construct a concrete instance of `AuditConfigArrayInput` via:
//
//	AuditConfigArray{ AuditConfigArgs{...} }
type AuditConfigArrayInput interface {
	pulumi.Input

	ToAuditConfigArrayOutput() AuditConfigArrayOutput
	ToAuditConfigArrayOutputWithContext(context.Context) AuditConfigArrayOutput
}

type AuditConfigArray []AuditConfigInput

func (AuditConfigArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditConfig)(nil)).Elem()
}

func (i AuditConfigArray) ToAuditConfigArrayOutput() AuditConfigArrayOutput {
	return i.ToAuditConfigArrayOutputWithContext(context.Background())
}

func (i AuditConfigArray) ToAuditConfigArrayOutputWithContext(ctx context.Context) AuditConfigArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AuditConfigArrayOutput)
}

// Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
type AuditConfigOutput struct{ *pulumi.OutputState }

func (AuditConfigOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditConfig)(nil)).Elem()
}

func (o AuditConfigOutput) ToAuditConfigOutput() AuditConfigOutput {
	return o
}

func (o AuditConfigOutput) ToAuditConfigOutputWithContext(ctx context.Context) AuditConfigOutput {
	return o
}

// The configuration for logging of each type of permission.
func (o AuditConfigOutput) AuditLogConfigs() AuditLogConfigArrayOutput {
	return o.ApplyT(func(v AuditConfig) []AuditLogConfig { return v.AuditLogConfigs }).(AuditLogConfigArrayOutput)
}

// Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
func (o AuditConfigOutput) Service() pulumi.StringPtrOutput {
	return o.ApplyT(func(v AuditConfig) *string { return v.Service }).(pulumi.StringPtrOutput)
}

type AuditConfigArrayOutput struct{ *pulumi.OutputState }

func (AuditConfigArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditConfig)(nil)).Elem()
}

func (o AuditConfigArrayOutput) ToAuditConfigArrayOutput() AuditConfigArrayOutput {
	return o
}

func (o AuditConfigArrayOutput) ToAuditConfigArrayOutputWithContext(ctx context.Context) AuditConfigArrayOutput {
	return o
}

func (o AuditConfigArrayOutput) Index(i pulumi.IntInput) AuditConfigOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) AuditConfig {
		return vs[0].([]AuditConfig)[vs[1].(int)]
	}).(AuditConfigOutput)
}

// Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
type AuditConfigResponse struct {
	// The configuration for logging of each type of permission.
	AuditLogConfigs []AuditLogConfigResponse `pulumi:"auditLogConfigs"`
	// Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
	Service string `pulumi:"service"`
}

// Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
type AuditConfigResponseOutput struct{ *pulumi.OutputState }

func (AuditConfigResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditConfigResponse)(nil)).Elem()
}

func (o AuditConfigResponseOutput) ToAuditConfigResponseOutput() AuditConfigResponseOutput {
	return o
}

func (o AuditConfigResponseOutput) ToAuditConfigResponseOutputWithContext(ctx context.Context) AuditConfigResponseOutput {
	return o
}

// The configuration for logging of each type of permission.
func (o AuditConfigResponseOutput) AuditLogConfigs() AuditLogConfigResponseArrayOutput {
	return o.ApplyT(func(v AuditConfigResponse) []AuditLogConfigResponse { return v.AuditLogConfigs }).(AuditLogConfigResponseArrayOutput)
}

// Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
func (o AuditConfigResponseOutput) Service() pulumi.StringOutput {
	return o.ApplyT(func(v AuditConfigResponse) string { return v.Service }).(pulumi.StringOutput)
}

type AuditConfigResponseArrayOutput struct{ *pulumi.OutputState }

func (AuditConfigResponseArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditConfigResponse)(nil)).Elem()
}

func (o AuditConfigResponseArrayOutput) ToAuditConfigResponseArrayOutput() AuditConfigResponseArrayOutput {
	return o
}

func (o AuditConfigResponseArrayOutput) ToAuditConfigResponseArrayOutputWithContext(ctx context.Context) AuditConfigResponseArrayOutput {
	return o
}

func (o AuditConfigResponseArrayOutput) Index(i pulumi.IntInput) AuditConfigResponseOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) AuditConfigResponse {
		return vs[0].([]AuditConfigResponse)[vs[1].(int)]
	}).(AuditConfigResponseOutput)
}

// Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
type AuditLogConfig struct {
	// Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
	ExemptedMembers []string `pulumi:"exemptedMembers"`
	// The log type that this config enables.
	LogType *AuditLogConfigLogType `pulumi:"logType"`
}

// AuditLogConfigInput is an input type that accepts AuditLogConfigArgs and AuditLogConfigOutput values.
// You can construct a concrete instance of `AuditLogConfigInput` via:
//
//	AuditLogConfigArgs{...}
type AuditLogConfigInput interface {
	pulumi.Input

	ToAuditLogConfigOutput() AuditLogConfigOutput
	ToAuditLogConfigOutputWithContext(context.Context) AuditLogConfigOutput
}

// Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
type AuditLogConfigArgs struct {
	// Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
	ExemptedMembers pulumi.StringArrayInput `pulumi:"exemptedMembers"`
	// The log type that this config enables.
	LogType AuditLogConfigLogTypePtrInput `pulumi:"logType"`
}

func (AuditLogConfigArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditLogConfig)(nil)).Elem()
}

func (i AuditLogConfigArgs) ToAuditLogConfigOutput() AuditLogConfigOutput {
	return i.ToAuditLogConfigOutputWithContext(context.Background())
}

func (i AuditLogConfigArgs) ToAuditLogConfigOutputWithContext(ctx context.Context) AuditLogConfigOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AuditLogConfigOutput)
}

// AuditLogConfigArrayInput is an input type that accepts AuditLogConfigArray and AuditLogConfigArrayOutput values.
// You can construct a concrete instance of `AuditLogConfigArrayInput` via:
//
//	AuditLogConfigArray{ AuditLogConfigArgs{...} }
type AuditLogConfigArrayInput interface {
	pulumi.Input

	ToAuditLogConfigArrayOutput() AuditLogConfigArrayOutput
	ToAuditLogConfigArrayOutputWithContext(context.Context) AuditLogConfigArrayOutput
}

type AuditLogConfigArray []AuditLogConfigInput

func (AuditLogConfigArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditLogConfig)(nil)).Elem()
}

func (i AuditLogConfigArray) ToAuditLogConfigArrayOutput() AuditLogConfigArrayOutput {
	return i.ToAuditLogConfigArrayOutputWithContext(context.Background())
}

func (i AuditLogConfigArray) ToAuditLogConfigArrayOutputWithContext(ctx context.Context) AuditLogConfigArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AuditLogConfigArrayOutput)
}

// Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
type AuditLogConfigOutput struct{ *pulumi.OutputState }

func (AuditLogConfigOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditLogConfig)(nil)).Elem()
}

func (o AuditLogConfigOutput) ToAuditLogConfigOutput() AuditLogConfigOutput {
	return o
}

func (o AuditLogConfigOutput) ToAuditLogConfigOutputWithContext(ctx context.Context) AuditLogConfigOutput {
	return o
}

// Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
func (o AuditLogConfigOutput) ExemptedMembers() pulumi.StringArrayOutput {
	return o.ApplyT(func(v AuditLogConfig) []string { return v.ExemptedMembers }).(pulumi.StringArrayOutput)
}

// The log type that this config enables.
func (o AuditLogConfigOutput) LogType() AuditLogConfigLogTypePtrOutput {
	return o.ApplyT(func(v AuditLogConfig) *AuditLogConfigLogType { return v.LogType }).(AuditLogConfigLogTypePtrOutput)
}

type AuditLogConfigArrayOutput struct{ *pulumi.OutputState }

func (AuditLogConfigArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditLogConfig)(nil)).Elem()
}

func (o AuditLogConfigArrayOutput) ToAuditLogConfigArrayOutput() AuditLogConfigArrayOutput {
	return o
}

func (o AuditLogConfigArrayOutput) ToAuditLogConfigArrayOutputWithContext(ctx context.Context) AuditLogConfigArrayOutput {
	return o
}

func (o AuditLogConfigArrayOutput) Index(i pulumi.IntInput) AuditLogConfigOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) AuditLogConfig {
		return vs[0].([]AuditLogConfig)[vs[1].(int)]
	}).(AuditLogConfigOutput)
}

// Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
type AuditLogConfigResponse struct {
	// Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
	ExemptedMembers []string `pulumi:"exemptedMembers"`
	// The log type that this config enables.
	LogType string `pulumi:"logType"`
}

// Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
type AuditLogConfigResponseOutput struct{ *pulumi.OutputState }

func (AuditLogConfigResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*AuditLogConfigResponse)(nil)).Elem()
}

func (o AuditLogConfigResponseOutput) ToAuditLogConfigResponseOutput() AuditLogConfigResponseOutput {
	return o
}

func (o AuditLogConfigResponseOutput) ToAuditLogConfigResponseOutputWithContext(ctx context.Context) AuditLogConfigResponseOutput {
	return o
}

// Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
func (o AuditLogConfigResponseOutput) ExemptedMembers() pulumi.StringArrayOutput {
	return o.ApplyT(func(v AuditLogConfigResponse) []string { return v.ExemptedMembers }).(pulumi.StringArrayOutput)
}

// The log type that this config enables.
func (o AuditLogConfigResponseOutput) LogType() pulumi.StringOutput {
	return o.ApplyT(func(v AuditLogConfigResponse) string { return v.LogType }).(pulumi.StringOutput)
}

type AuditLogConfigResponseArrayOutput struct{ *pulumi.OutputState }

func (AuditLogConfigResponseArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]AuditLogConfigResponse)(nil)).Elem()
}

func (o AuditLogConfigResponseArrayOutput) ToAuditLogConfigResponseArrayOutput() AuditLogConfigResponseArrayOutput {
	return o
}

func (o AuditLogConfigResponseArrayOutput) ToAuditLogConfigResponseArrayOutputWithContext(ctx context.Context) AuditLogConfigResponseArrayOutput {
	return o
}

func (o AuditLogConfigResponseArrayOutput) Index(i pulumi.IntInput) AuditLogConfigResponseOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) AuditLogConfigResponse {
		return vs[0].([]AuditLogConfigResponse)[vs[1].(int)]
	}).(AuditLogConfigResponseOutput)
}

// Associates `members`, or principals, with a `role`.
type Binding struct {
	// The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
	Condition *Expr `pulumi:"condition"`
	// Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
	Members []string `pulumi:"members"`
	// Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
	Role *string `pulumi:"role"`
}

// BindingInput is an input type that accepts BindingArgs and BindingOutput values.
// You can construct a concrete instance of `BindingInput` via:
//
//	BindingArgs{...}
type BindingInput interface {
	pulumi.Input

	ToBindingOutput() BindingOutput
	ToBindingOutputWithContext(context.Context) BindingOutput
}

// Associates `members`, or principals, with a `role`.
type BindingArgs struct {
	// The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
	Condition ExprPtrInput `pulumi:"condition"`
	// Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
	Members pulumi.StringArrayInput `pulumi:"members"`
	// Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
	Role pulumi.StringPtrInput `pulumi:"role"`
}

func (BindingArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*Binding)(nil)).Elem()
}

func (i BindingArgs) ToBindingOutput() BindingOutput {
	return i.ToBindingOutputWithContext(context.Background())
}

func (i BindingArgs) ToBindingOutputWithContext(ctx context.Context) BindingOutput {
	return pulumi.ToOutputWithContext(ctx, i).(BindingOutput)
}

// BindingArrayInput is an input type that accepts BindingArray and BindingArrayOutput values.
// You can construct a concrete instance of `BindingArrayInput` via:
//
//	BindingArray{ BindingArgs{...} }
type BindingArrayInput interface {
	pulumi.Input

	ToBindingArrayOutput() BindingArrayOutput
	ToBindingArrayOutputWithContext(context.Context) BindingArrayOutput
}

type BindingArray []BindingInput

func (BindingArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]Binding)(nil)).Elem()
}

func (i BindingArray) ToBindingArrayOutput() BindingArrayOutput {
	return i.ToBindingArrayOutputWithContext(context.Background())
}

func (i BindingArray) ToBindingArrayOutputWithContext(ctx context.Context) BindingArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(BindingArrayOutput)
}

// Associates `members`, or principals, with a `role`.
type BindingOutput struct{ *pulumi.OutputState }

func (BindingOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*Binding)(nil)).Elem()
}

func (o BindingOutput) ToBindingOutput() BindingOutput {
	return o
}

func (o BindingOutput) ToBindingOutputWithContext(ctx context.Context) BindingOutput {
	return o
}

// The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
func (o BindingOutput) Condition() ExprPtrOutput {
	return o.ApplyT(func(v Binding) *Expr { return v.Condition }).(ExprPtrOutput)
}

// Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
func (o BindingOutput) Members() pulumi.StringArrayOutput {
	return o.ApplyT(func(v Binding) []string { return v.Members }).(pulumi.StringArrayOutput)
}

// Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
func (o BindingOutput) Role() pulumi.StringPtrOutput {
	return o.ApplyT(func(v Binding) *string { return v.Role }).(pulumi.StringPtrOutput)
}

type BindingArrayOutput struct{ *pulumi.OutputState }

func (BindingArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]Binding)(nil)).Elem()
}

func (o BindingArrayOutput) ToBindingArrayOutput() BindingArrayOutput {
	return o
}

func (o BindingArrayOutput) ToBindingArrayOutputWithContext(ctx context.Context) BindingArrayOutput {
	return o
}

func (o BindingArrayOutput) Index(i pulumi.IntInput) BindingOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) Binding {
		return vs[0].([]Binding)[vs[1].(int)]
	}).(BindingOutput)
}

// Associates `members`, or principals, with a `role`.
type BindingResponse struct {
	// The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
	Condition ExprResponse `pulumi:"condition"`
	// Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
	Members []string `pulumi:"members"`
	// Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
	Role string `pulumi:"role"`
}

// Associates `members`, or principals, with a `role`.
type BindingResponseOutput struct{ *pulumi.OutputState }

func (BindingResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*BindingResponse)(nil)).Elem()
}

func (o BindingResponseOutput) ToBindingResponseOutput() BindingResponseOutput {
	return o
}

func (o BindingResponseOutput) ToBindingResponseOutputWithContext(ctx context.Context) BindingResponseOutput {
	return o
}

// The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
func (o BindingResponseOutput) Condition() ExprResponseOutput {
	return o.ApplyT(func(v BindingResponse) ExprResponse { return v.Condition }).(ExprResponseOutput)
}

// Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
func (o BindingResponseOutput) Members() pulumi.StringArrayOutput {
	return o.ApplyT(func(v BindingResponse) []string { return v.Members }).(pulumi.StringArrayOutput)
}

// Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
func (o BindingResponseOutput) Role() pulumi.StringOutput {
	return o.ApplyT(func(v BindingResponse) string { return v.Role }).(pulumi.StringOutput)
}

type BindingResponseArrayOutput struct{ *pulumi.OutputState }

func (BindingResponseArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]BindingResponse)(nil)).Elem()
}

func (o BindingResponseArrayOutput) ToBindingResponseArrayOutput() BindingResponseArrayOutput {
	return o
}

func (o BindingResponseArrayOutput) ToBindingResponseArrayOutputWithContext(ctx context.Context) BindingResponseArrayOutput {
	return o
}

func (o BindingResponseArrayOutput) Index(i pulumi.IntInput) BindingResponseOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) BindingResponse {
		return vs[0].([]BindingResponse)[vs[1].(int)]
	}).(BindingResponseOutput)
}

// A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.
type Certificate struct {
	// The raw certificate bytes in DER format.
	RawDer string `pulumi:"rawDer"`
}

// CertificateInput is an input type that accepts CertificateArgs and CertificateOutput values.
// You can construct a concrete instance of `CertificateInput` via:
//
//	CertificateArgs{...}
type CertificateInput interface {
	pulumi.Input

	ToCertificateOutput() CertificateOutput
	ToCertificateOutputWithContext(context.Context) CertificateOutput
}

// A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.
type CertificateArgs struct {
	// The raw certificate bytes in DER format.
	RawDer pulumi.StringInput `pulumi:"rawDer"`
}

func (CertificateArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*Certificate)(nil)).Elem()
}

func (i CertificateArgs) ToCertificateOutput() CertificateOutput {
	return i.ToCertificateOutputWithContext(context.Background())
}

func (i CertificateArgs) ToCertificateOutputWithContext(ctx context.Context) CertificateOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CertificateOutput)
}

// CertificateArrayInput is an input type that accepts CertificateArray and CertificateArrayOutput values.
// You can construct a concrete instance of `CertificateArrayInput` via:
//
//	CertificateArray{ CertificateArgs{...} }
type CertificateArrayInput interface {
	pulumi.Input

	ToCertificateArrayOutput() CertificateArrayOutput
	ToCertificateArrayOutputWithContext(context.Context) CertificateArrayOutput
}

type CertificateArray []CertificateInput

func (CertificateArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]Certificate)(nil)).Elem()
}

func (i CertificateArray) ToCertificateArrayOutput() CertificateArrayOutput {
	return i.ToCertificateArrayOutputWithContext(context.Background())
}

func (i CertificateArray) ToCertificateArrayOutputWithContext(ctx context.Context) CertificateArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CertificateArrayOutput)
}

// A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.
type CertificateOutput struct{ *pulumi.OutputState }

func (CertificateOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*Certificate)(nil)).Elem()
}

func (o CertificateOutput) ToCertificateOutput() CertificateOutput {
	return o
}

func (o CertificateOutput) ToCertificateOutputWithContext(ctx context.Context) CertificateOutput {
	return o
}

// The raw certificate bytes in DER format.
func (o CertificateOutput) RawDer() pulumi.StringOutput {
	return o.ApplyT(func(v Certificate) string { return v.RawDer }).(pulumi.StringOutput)
}

type CertificateArrayOutput struct{ *pulumi.OutputState }

func (CertificateArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]Certificate)(nil)).Elem()
}

func (o CertificateArrayOutput) ToCertificateArrayOutput() CertificateArrayOutput {
	return o
}

func (o CertificateArrayOutput) ToCertificateArrayOutputWithContext(ctx context.Context) CertificateArrayOutput {
	return o
}

func (o CertificateArrayOutput) Index(i pulumi.IntInput) CertificateOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) Certificate {
		return vs[0].([]Certificate)[vs[1].(int)]
	}).(CertificateOutput)
}

// Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.
type CertificateChainsResponse struct {
	// Cavium certificate chain corresponding to the attestation.
	CaviumCerts []string `pulumi:"caviumCerts"`
	// Google card certificate chain corresponding to the attestation.
	GoogleCardCerts []string `pulumi:"googleCardCerts"`
	// Google partition certificate chain corresponding to the attestation.
	GooglePartitionCerts []string `pulumi:"googlePartitionCerts"`
}

// Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.
type CertificateChainsResponseOutput struct{ *pulumi.OutputState }

func (CertificateChainsResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*CertificateChainsResponse)(nil)).Elem()
}

func (o CertificateChainsResponseOutput) ToCertificateChainsResponseOutput() CertificateChainsResponseOutput {
	return o
}

func (o CertificateChainsResponseOutput) ToCertificateChainsResponseOutputWithContext(ctx context.Context) CertificateChainsResponseOutput {
	return o
}

// Cavium certificate chain corresponding to the attestation.
func (o CertificateChainsResponseOutput) CaviumCerts() pulumi.StringArrayOutput {
	return o.ApplyT(func(v CertificateChainsResponse) []string { return v.CaviumCerts }).(pulumi.StringArrayOutput)
}

// Google card certificate chain corresponding to the attestation.
func (o CertificateChainsResponseOutput) GoogleCardCerts() pulumi.StringArrayOutput {
	return o.ApplyT(func(v CertificateChainsResponse) []string { return v.GoogleCardCerts }).(pulumi.StringArrayOutput)
}

// Google partition certificate chain corresponding to the attestation.
func (o CertificateChainsResponseOutput) GooglePartitionCerts() pulumi.StringArrayOutput {
	return o.ApplyT(func(v CertificateChainsResponse) []string { return v.GooglePartitionCerts }).(pulumi.StringArrayOutput)
}

// A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.
type CertificateResponse struct {
	// The issuer distinguished name in RFC 2253 format. Only present if parsed is true.
	Issuer string `pulumi:"issuer"`
	// The certificate is not valid after this time. Only present if parsed is true.
	NotAfterTime string `pulumi:"notAfterTime"`
	// The certificate is not valid before this time. Only present if parsed is true.
	NotBeforeTime string `pulumi:"notBeforeTime"`
	// True if the certificate was parsed successfully.
	Parsed bool `pulumi:"parsed"`
	// The raw certificate bytes in DER format.
	RawDer string `pulumi:"rawDer"`
	// The certificate serial number as a hex string. Only present if parsed is true.
	SerialNumber string `pulumi:"serialNumber"`
	// The SHA-256 certificate fingerprint as a hex string. Only present if parsed is true.
	Sha256Fingerprint string `pulumi:"sha256Fingerprint"`
	// The subject distinguished name in RFC 2253 format. Only present if parsed is true.
	Subject string `pulumi:"subject"`
	// The subject Alternative DNS names. Only present if parsed is true.
	SubjectAlternativeDnsNames []string `pulumi:"subjectAlternativeDnsNames"`
}

// A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.
type CertificateResponseOutput struct{ *pulumi.OutputState }

func (CertificateResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*CertificateResponse)(nil)).Elem()
}

func (o CertificateResponseOutput) ToCertificateResponseOutput() CertificateResponseOutput {
	return o
}

func (o CertificateResponseOutput) ToCertificateResponseOutputWithContext(ctx context.Context) CertificateResponseOutput {
	return o
}

// The issuer distinguished name in RFC 2253 format. Only present if parsed is true.
func (o CertificateResponseOutput) Issuer() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.Issuer }).(pulumi.StringOutput)
}

// The certificate is not valid after this time. Only present if parsed is true.
func (o CertificateResponseOutput) NotAfterTime() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.NotAfterTime }).(pulumi.StringOutput)
}

// The certificate is not valid before this time. Only present if parsed is true.
func (o CertificateResponseOutput) NotBeforeTime() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.NotBeforeTime }).(pulumi.StringOutput)
}

// True if the certificate was parsed successfully.
func (o CertificateResponseOutput) Parsed() pulumi.BoolOutput {
	return o.ApplyT(func(v CertificateResponse) bool { return v.Parsed }).(pulumi.BoolOutput)
}

// The raw certificate bytes in DER format.
func (o CertificateResponseOutput) RawDer() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.RawDer }).(pulumi.StringOutput)
}

// The certificate serial number as a hex string. Only present if parsed is true.
func (o CertificateResponseOutput) SerialNumber() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.SerialNumber }).(pulumi.StringOutput)
}

// The SHA-256 certificate fingerprint as a hex string. Only present if parsed is true.
func (o CertificateResponseOutput) Sha256Fingerprint() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.Sha256Fingerprint }).(pulumi.StringOutput)
}

// The subject distinguished name in RFC 2253 format. Only present if parsed is true.
func (o CertificateResponseOutput) Subject() pulumi.StringOutput {
	return o.ApplyT(func(v CertificateResponse) string { return v.Subject }).(pulumi.StringOutput)
}

// The subject Alternative DNS names. Only present if parsed is true.
func (o CertificateResponseOutput) SubjectAlternativeDnsNames() pulumi.StringArrayOutput {
	return o.ApplyT(func(v CertificateResponse) []string { return v.SubjectAlternativeDnsNames }).(pulumi.StringArrayOutput)
}

type CertificateResponseArrayOutput struct{ *pulumi.OutputState }

func (CertificateResponseArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]CertificateResponse)(nil)).Elem()
}

func (o CertificateResponseArrayOutput) ToCertificateResponseArrayOutput() CertificateResponseArrayOutput {
	return o
}

func (o CertificateResponseArrayOutput) ToCertificateResponseArrayOutputWithContext(ctx context.Context) CertificateResponseArrayOutput {
	return o
}

func (o CertificateResponseArrayOutput) Index(i pulumi.IntInput) CertificateResponseOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) CertificateResponse {
		return vs[0].([]CertificateResponse)[vs[1].(int)]
	}).(CertificateResponseOutput)
}

// A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.
type CryptoKeyVersionResponse struct {
	// The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
	Algorithm string `pulumi:"algorithm"`
	// Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.
	Attestation KeyOperationAttestationResponse `pulumi:"attestation"`
	// The time at which this CryptoKeyVersion was created.
	CreateTime string `pulumi:"createTime"`
	// The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.
	DestroyEventTime string `pulumi:"destroyEventTime"`
	// The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
	DestroyTime string `pulumi:"destroyTime"`
	// The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.
	ExternalDestructionFailureReason string `pulumi:"externalDestructionFailureReason"`
	// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
	ExternalProtectionLevelOptions ExternalProtectionLevelOptionsResponse `pulumi:"externalProtectionLevelOptions"`
	// The time this CryptoKeyVersion's key material was generated.
	GenerateTime string `pulumi:"generateTime"`
	// The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.
	GenerationFailureReason string `pulumi:"generationFailureReason"`
	// The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.
	ImportFailureReason string `pulumi:"importFailureReason"`
	// The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.
	ImportJob string `pulumi:"importJob"`
	// The time at which this CryptoKeyVersion's key material was most recently imported.
	ImportTime string `pulumi:"importTime"`
	// The resource name for this CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
	Name string `pulumi:"name"`
	// The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
	ProtectionLevel string `pulumi:"protectionLevel"`
	// Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.
	ReimportEligible bool `pulumi:"reimportEligible"`
	// The current state of the CryptoKeyVersion.
	State string `pulumi:"state"`
}

// A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.
type CryptoKeyVersionResponseOutput struct{ *pulumi.OutputState }

func (CryptoKeyVersionResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*CryptoKeyVersionResponse)(nil)).Elem()
}

func (o CryptoKeyVersionResponseOutput) ToCryptoKeyVersionResponseOutput() CryptoKeyVersionResponseOutput {
	return o
}

func (o CryptoKeyVersionResponseOutput) ToCryptoKeyVersionResponseOutputWithContext(ctx context.Context) CryptoKeyVersionResponseOutput {
	return o
}

// The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
func (o CryptoKeyVersionResponseOutput) Algorithm() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.Algorithm }).(pulumi.StringOutput)
}

// Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.
func (o CryptoKeyVersionResponseOutput) Attestation() KeyOperationAttestationResponseOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) KeyOperationAttestationResponse { return v.Attestation }).(KeyOperationAttestationResponseOutput)
}

// The time at which this CryptoKeyVersion was created.
func (o CryptoKeyVersionResponseOutput) CreateTime() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.CreateTime }).(pulumi.StringOutput)
}

// The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.
func (o CryptoKeyVersionResponseOutput) DestroyEventTime() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.DestroyEventTime }).(pulumi.StringOutput)
}

// The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
func (o CryptoKeyVersionResponseOutput) DestroyTime() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.DestroyTime }).(pulumi.StringOutput)
}

// The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.
func (o CryptoKeyVersionResponseOutput) ExternalDestructionFailureReason() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.ExternalDestructionFailureReason }).(pulumi.StringOutput)
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
func (o CryptoKeyVersionResponseOutput) ExternalProtectionLevelOptions() ExternalProtectionLevelOptionsResponseOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) ExternalProtectionLevelOptionsResponse {
		return v.ExternalProtectionLevelOptions
	}).(ExternalProtectionLevelOptionsResponseOutput)
}

// The time this CryptoKeyVersion's key material was generated.
func (o CryptoKeyVersionResponseOutput) GenerateTime() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.GenerateTime }).(pulumi.StringOutput)
}

// The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.
func (o CryptoKeyVersionResponseOutput) GenerationFailureReason() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.GenerationFailureReason }).(pulumi.StringOutput)
}

// The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.
func (o CryptoKeyVersionResponseOutput) ImportFailureReason() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.ImportFailureReason }).(pulumi.StringOutput)
}

// The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.
func (o CryptoKeyVersionResponseOutput) ImportJob() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.ImportJob }).(pulumi.StringOutput)
}

// The time at which this CryptoKeyVersion's key material was most recently imported.
func (o CryptoKeyVersionResponseOutput) ImportTime() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.ImportTime }).(pulumi.StringOutput)
}

// The resource name for this CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
func (o CryptoKeyVersionResponseOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.Name }).(pulumi.StringOutput)
}

// The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
func (o CryptoKeyVersionResponseOutput) ProtectionLevel() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.ProtectionLevel }).(pulumi.StringOutput)
}

// Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.
func (o CryptoKeyVersionResponseOutput) ReimportEligible() pulumi.BoolOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) bool { return v.ReimportEligible }).(pulumi.BoolOutput)
}

// The current state of the CryptoKeyVersion.
func (o CryptoKeyVersionResponseOutput) State() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionResponse) string { return v.State }).(pulumi.StringOutput)
}

// A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
type CryptoKeyVersionTemplate struct {
	// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
	Algorithm CryptoKeyVersionTemplateAlgorithm `pulumi:"algorithm"`
	// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
	ProtectionLevel *CryptoKeyVersionTemplateProtectionLevel `pulumi:"protectionLevel"`
}

// CryptoKeyVersionTemplateInput is an input type that accepts CryptoKeyVersionTemplateArgs and CryptoKeyVersionTemplateOutput values.
// You can construct a concrete instance of `CryptoKeyVersionTemplateInput` via:
//
//	CryptoKeyVersionTemplateArgs{...}
type CryptoKeyVersionTemplateInput interface {
	pulumi.Input

	ToCryptoKeyVersionTemplateOutput() CryptoKeyVersionTemplateOutput
	ToCryptoKeyVersionTemplateOutputWithContext(context.Context) CryptoKeyVersionTemplateOutput
}

// A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
type CryptoKeyVersionTemplateArgs struct {
	// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
	Algorithm CryptoKeyVersionTemplateAlgorithmInput `pulumi:"algorithm"`
	// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
	ProtectionLevel CryptoKeyVersionTemplateProtectionLevelPtrInput `pulumi:"protectionLevel"`
}

func (CryptoKeyVersionTemplateArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*CryptoKeyVersionTemplate)(nil)).Elem()
}

func (i CryptoKeyVersionTemplateArgs) ToCryptoKeyVersionTemplateOutput() CryptoKeyVersionTemplateOutput {
	return i.ToCryptoKeyVersionTemplateOutputWithContext(context.Background())
}

func (i CryptoKeyVersionTemplateArgs) ToCryptoKeyVersionTemplateOutputWithContext(ctx context.Context) CryptoKeyVersionTemplateOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CryptoKeyVersionTemplateOutput)
}

func (i CryptoKeyVersionTemplateArgs) ToCryptoKeyVersionTemplatePtrOutput() CryptoKeyVersionTemplatePtrOutput {
	return i.ToCryptoKeyVersionTemplatePtrOutputWithContext(context.Background())
}

func (i CryptoKeyVersionTemplateArgs) ToCryptoKeyVersionTemplatePtrOutputWithContext(ctx context.Context) CryptoKeyVersionTemplatePtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CryptoKeyVersionTemplateOutput).ToCryptoKeyVersionTemplatePtrOutputWithContext(ctx)
}

// CryptoKeyVersionTemplatePtrInput is an input type that accepts CryptoKeyVersionTemplateArgs, CryptoKeyVersionTemplatePtr and CryptoKeyVersionTemplatePtrOutput values.
// You can construct a concrete instance of `CryptoKeyVersionTemplatePtrInput` via:
//
//	        CryptoKeyVersionTemplateArgs{...}
//
//	or:
//
//	        nil
type CryptoKeyVersionTemplatePtrInput interface {
	pulumi.Input

	ToCryptoKeyVersionTemplatePtrOutput() CryptoKeyVersionTemplatePtrOutput
	ToCryptoKeyVersionTemplatePtrOutputWithContext(context.Context) CryptoKeyVersionTemplatePtrOutput
}

type cryptoKeyVersionTemplatePtrType CryptoKeyVersionTemplateArgs

func CryptoKeyVersionTemplatePtr(v *CryptoKeyVersionTemplateArgs) CryptoKeyVersionTemplatePtrInput {
	return (*cryptoKeyVersionTemplatePtrType)(v)
}

func (*cryptoKeyVersionTemplatePtrType) ElementType() reflect.Type {
	return reflect.TypeOf((**CryptoKeyVersionTemplate)(nil)).Elem()
}

func (i *cryptoKeyVersionTemplatePtrType) ToCryptoKeyVersionTemplatePtrOutput() CryptoKeyVersionTemplatePtrOutput {
	return i.ToCryptoKeyVersionTemplatePtrOutputWithContext(context.Background())
}

func (i *cryptoKeyVersionTemplatePtrType) ToCryptoKeyVersionTemplatePtrOutputWithContext(ctx context.Context) CryptoKeyVersionTemplatePtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CryptoKeyVersionTemplatePtrOutput)
}

// A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
type CryptoKeyVersionTemplateOutput struct{ *pulumi.OutputState }

func (CryptoKeyVersionTemplateOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*CryptoKeyVersionTemplate)(nil)).Elem()
}

func (o CryptoKeyVersionTemplateOutput) ToCryptoKeyVersionTemplateOutput() CryptoKeyVersionTemplateOutput {
	return o
}

func (o CryptoKeyVersionTemplateOutput) ToCryptoKeyVersionTemplateOutputWithContext(ctx context.Context) CryptoKeyVersionTemplateOutput {
	return o
}

func (o CryptoKeyVersionTemplateOutput) ToCryptoKeyVersionTemplatePtrOutput() CryptoKeyVersionTemplatePtrOutput {
	return o.ToCryptoKeyVersionTemplatePtrOutputWithContext(context.Background())
}

func (o CryptoKeyVersionTemplateOutput) ToCryptoKeyVersionTemplatePtrOutputWithContext(ctx context.Context) CryptoKeyVersionTemplatePtrOutput {
	return o.ApplyTWithContext(ctx, func(_ context.Context, v CryptoKeyVersionTemplate) *CryptoKeyVersionTemplate {
		return &v
	}).(CryptoKeyVersionTemplatePtrOutput)
}

// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
func (o CryptoKeyVersionTemplateOutput) Algorithm() CryptoKeyVersionTemplateAlgorithmOutput {
	return o.ApplyT(func(v CryptoKeyVersionTemplate) CryptoKeyVersionTemplateAlgorithm { return v.Algorithm }).(CryptoKeyVersionTemplateAlgorithmOutput)
}

// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
func (o CryptoKeyVersionTemplateOutput) ProtectionLevel() CryptoKeyVersionTemplateProtectionLevelPtrOutput {
	return o.ApplyT(func(v CryptoKeyVersionTemplate) *CryptoKeyVersionTemplateProtectionLevel { return v.ProtectionLevel }).(CryptoKeyVersionTemplateProtectionLevelPtrOutput)
}

type CryptoKeyVersionTemplatePtrOutput struct{ *pulumi.OutputState }

func (CryptoKeyVersionTemplatePtrOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**CryptoKeyVersionTemplate)(nil)).Elem()
}

func (o CryptoKeyVersionTemplatePtrOutput) ToCryptoKeyVersionTemplatePtrOutput() CryptoKeyVersionTemplatePtrOutput {
	return o
}

func (o CryptoKeyVersionTemplatePtrOutput) ToCryptoKeyVersionTemplatePtrOutputWithContext(ctx context.Context) CryptoKeyVersionTemplatePtrOutput {
	return o
}

func (o CryptoKeyVersionTemplatePtrOutput) Elem() CryptoKeyVersionTemplateOutput {
	return o.ApplyT(func(v *CryptoKeyVersionTemplate) CryptoKeyVersionTemplate {
		if v != nil {
			return *v
		}
		var ret CryptoKeyVersionTemplate
		return ret
	}).(CryptoKeyVersionTemplateOutput)
}

// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
func (o CryptoKeyVersionTemplatePtrOutput) Algorithm() CryptoKeyVersionTemplateAlgorithmPtrOutput {
	return o.ApplyT(func(v *CryptoKeyVersionTemplate) *CryptoKeyVersionTemplateAlgorithm {
		if v == nil {
			return nil
		}
		return &v.Algorithm
	}).(CryptoKeyVersionTemplateAlgorithmPtrOutput)
}

// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
func (o CryptoKeyVersionTemplatePtrOutput) ProtectionLevel() CryptoKeyVersionTemplateProtectionLevelPtrOutput {
	return o.ApplyT(func(v *CryptoKeyVersionTemplate) *CryptoKeyVersionTemplateProtectionLevel {
		if v == nil {
			return nil
		}
		return v.ProtectionLevel
	}).(CryptoKeyVersionTemplateProtectionLevelPtrOutput)
}

// A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
type CryptoKeyVersionTemplateResponse struct {
	// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
	Algorithm string `pulumi:"algorithm"`
	// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
	ProtectionLevel string `pulumi:"protectionLevel"`
}

// A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
type CryptoKeyVersionTemplateResponseOutput struct{ *pulumi.OutputState }

func (CryptoKeyVersionTemplateResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*CryptoKeyVersionTemplateResponse)(nil)).Elem()
}

func (o CryptoKeyVersionTemplateResponseOutput) ToCryptoKeyVersionTemplateResponseOutput() CryptoKeyVersionTemplateResponseOutput {
	return o
}

func (o CryptoKeyVersionTemplateResponseOutput) ToCryptoKeyVersionTemplateResponseOutputWithContext(ctx context.Context) CryptoKeyVersionTemplateResponseOutput {
	return o
}

// Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
func (o CryptoKeyVersionTemplateResponseOutput) Algorithm() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionTemplateResponse) string { return v.Algorithm }).(pulumi.StringOutput)
}

// ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
func (o CryptoKeyVersionTemplateResponseOutput) ProtectionLevel() pulumi.StringOutput {
	return o.ApplyT(func(v CryptoKeyVersionTemplateResponse) string { return v.ProtectionLevel }).(pulumi.StringOutput)
}

// Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
type Expr struct {
	// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
	Description *string `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression *string `pulumi:"expression"`
	// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
	Location *string `pulumi:"location"`
	// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
	Title *string `pulumi:"title"`
}

// ExprInput is an input type that accepts ExprArgs and ExprOutput values.
// You can construct a concrete instance of `ExprInput` via:
//
//	ExprArgs{...}
type ExprInput interface {
	pulumi.Input

	ToExprOutput() ExprOutput
	ToExprOutputWithContext(context.Context) ExprOutput
}

// Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
type ExprArgs struct {
	// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
	Description pulumi.StringPtrInput `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression pulumi.StringPtrInput `pulumi:"expression"`
	// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
	Location pulumi.StringPtrInput `pulumi:"location"`
	// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
	Title pulumi.StringPtrInput `pulumi:"title"`
}

func (ExprArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*Expr)(nil)).Elem()
}

func (i ExprArgs) ToExprOutput() ExprOutput {
	return i.ToExprOutputWithContext(context.Background())
}

func (i ExprArgs) ToExprOutputWithContext(ctx context.Context) ExprOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExprOutput)
}

func (i ExprArgs) ToExprPtrOutput() ExprPtrOutput {
	return i.ToExprPtrOutputWithContext(context.Background())
}

func (i ExprArgs) ToExprPtrOutputWithContext(ctx context.Context) ExprPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExprOutput).ToExprPtrOutputWithContext(ctx)
}

// ExprPtrInput is an input type that accepts ExprArgs, ExprPtr and ExprPtrOutput values.
// You can construct a concrete instance of `ExprPtrInput` via:
//
//	        ExprArgs{...}
//
//	or:
//
//	        nil
type ExprPtrInput interface {
	pulumi.Input

	ToExprPtrOutput() ExprPtrOutput
	ToExprPtrOutputWithContext(context.Context) ExprPtrOutput
}

type exprPtrType ExprArgs

func ExprPtr(v *ExprArgs) ExprPtrInput {
	return (*exprPtrType)(v)
}

func (*exprPtrType) ElementType() reflect.Type {
	return reflect.TypeOf((**Expr)(nil)).Elem()
}

func (i *exprPtrType) ToExprPtrOutput() ExprPtrOutput {
	return i.ToExprPtrOutputWithContext(context.Background())
}

func (i *exprPtrType) ToExprPtrOutputWithContext(ctx context.Context) ExprPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExprPtrOutput)
}

// Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
type ExprOutput struct{ *pulumi.OutputState }

func (ExprOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*Expr)(nil)).Elem()
}

func (o ExprOutput) ToExprOutput() ExprOutput {
	return o
}

func (o ExprOutput) ToExprOutputWithContext(ctx context.Context) ExprOutput {
	return o
}

func (o ExprOutput) ToExprPtrOutput() ExprPtrOutput {
	return o.ToExprPtrOutputWithContext(context.Background())
}

func (o ExprOutput) ToExprPtrOutputWithContext(ctx context.Context) ExprPtrOutput {
	return o.ApplyTWithContext(ctx, func(_ context.Context, v Expr) *Expr {
		return &v
	}).(ExprPtrOutput)
}

// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
func (o ExprOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v Expr) *string { return v.Description }).(pulumi.StringPtrOutput)
}

// Textual representation of an expression in Common Expression Language syntax.
func (o ExprOutput) Expression() pulumi.StringPtrOutput {
	return o.ApplyT(func(v Expr) *string { return v.Expression }).(pulumi.StringPtrOutput)
}

// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
func (o ExprOutput) Location() pulumi.StringPtrOutput {
	return o.ApplyT(func(v Expr) *string { return v.Location }).(pulumi.StringPtrOutput)
}

// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
func (o ExprOutput) Title() pulumi.StringPtrOutput {
	return o.ApplyT(func(v Expr) *string { return v.Title }).(pulumi.StringPtrOutput)
}

type ExprPtrOutput struct{ *pulumi.OutputState }

func (ExprPtrOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**Expr)(nil)).Elem()
}

func (o ExprPtrOutput) ToExprPtrOutput() ExprPtrOutput {
	return o
}

func (o ExprPtrOutput) ToExprPtrOutputWithContext(ctx context.Context) ExprPtrOutput {
	return o
}

func (o ExprPtrOutput) Elem() ExprOutput {
	return o.ApplyT(func(v *Expr) Expr {
		if v != nil {
			return *v
		}
		var ret Expr
		return ret
	}).(ExprOutput)
}

// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
func (o ExprPtrOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *Expr) *string {
		if v == nil {
			return nil
		}
		return v.Description
	}).(pulumi.StringPtrOutput)
}

// Textual representation of an expression in Common Expression Language syntax.
func (o ExprPtrOutput) Expression() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *Expr) *string {
		if v == nil {
			return nil
		}
		return v.Expression
	}).(pulumi.StringPtrOutput)
}

// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
func (o ExprPtrOutput) Location() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *Expr) *string {
		if v == nil {
			return nil
		}
		return v.Location
	}).(pulumi.StringPtrOutput)
}

// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
func (o ExprPtrOutput) Title() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *Expr) *string {
		if v == nil {
			return nil
		}
		return v.Title
	}).(pulumi.StringPtrOutput)
}

// Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
type ExprResponse struct {
	// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
	Description string `pulumi:"description"`
	// Textual representation of an expression in Common Expression Language syntax.
	Expression string `pulumi:"expression"`
	// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
	Location string `pulumi:"location"`
	// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
	Title string `pulumi:"title"`
}

// Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
type ExprResponseOutput struct{ *pulumi.OutputState }

func (ExprResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*ExprResponse)(nil)).Elem()
}

func (o ExprResponseOutput) ToExprResponseOutput() ExprResponseOutput {
	return o
}

func (o ExprResponseOutput) ToExprResponseOutputWithContext(ctx context.Context) ExprResponseOutput {
	return o
}

// Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
func (o ExprResponseOutput) Description() pulumi.StringOutput {
	return o.ApplyT(func(v ExprResponse) string { return v.Description }).(pulumi.StringOutput)
}

// Textual representation of an expression in Common Expression Language syntax.
func (o ExprResponseOutput) Expression() pulumi.StringOutput {
	return o.ApplyT(func(v ExprResponse) string { return v.Expression }).(pulumi.StringOutput)
}

// Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
func (o ExprResponseOutput) Location() pulumi.StringOutput {
	return o.ApplyT(func(v ExprResponse) string { return v.Location }).(pulumi.StringOutput)
}

// Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
func (o ExprResponseOutput) Title() pulumi.StringOutput {
	return o.ApplyT(func(v ExprResponse) string { return v.Title }).(pulumi.StringOutput)
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
type ExternalProtectionLevelOptions struct {
	// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
	EkmConnectionKeyPath *string `pulumi:"ekmConnectionKeyPath"`
	// The URI for an external resource that this CryptoKeyVersion represents.
	ExternalKeyUri *string `pulumi:"externalKeyUri"`
}

// ExternalProtectionLevelOptionsInput is an input type that accepts ExternalProtectionLevelOptionsArgs and ExternalProtectionLevelOptionsOutput values.
// You can construct a concrete instance of `ExternalProtectionLevelOptionsInput` via:
//
//	ExternalProtectionLevelOptionsArgs{...}
type ExternalProtectionLevelOptionsInput interface {
	pulumi.Input

	ToExternalProtectionLevelOptionsOutput() ExternalProtectionLevelOptionsOutput
	ToExternalProtectionLevelOptionsOutputWithContext(context.Context) ExternalProtectionLevelOptionsOutput
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
type ExternalProtectionLevelOptionsArgs struct {
	// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
	EkmConnectionKeyPath pulumi.StringPtrInput `pulumi:"ekmConnectionKeyPath"`
	// The URI for an external resource that this CryptoKeyVersion represents.
	ExternalKeyUri pulumi.StringPtrInput `pulumi:"externalKeyUri"`
}

func (ExternalProtectionLevelOptionsArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*ExternalProtectionLevelOptions)(nil)).Elem()
}

func (i ExternalProtectionLevelOptionsArgs) ToExternalProtectionLevelOptionsOutput() ExternalProtectionLevelOptionsOutput {
	return i.ToExternalProtectionLevelOptionsOutputWithContext(context.Background())
}

func (i ExternalProtectionLevelOptionsArgs) ToExternalProtectionLevelOptionsOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExternalProtectionLevelOptionsOutput)
}

func (i ExternalProtectionLevelOptionsArgs) ToExternalProtectionLevelOptionsPtrOutput() ExternalProtectionLevelOptionsPtrOutput {
	return i.ToExternalProtectionLevelOptionsPtrOutputWithContext(context.Background())
}

func (i ExternalProtectionLevelOptionsArgs) ToExternalProtectionLevelOptionsPtrOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExternalProtectionLevelOptionsOutput).ToExternalProtectionLevelOptionsPtrOutputWithContext(ctx)
}

// ExternalProtectionLevelOptionsPtrInput is an input type that accepts ExternalProtectionLevelOptionsArgs, ExternalProtectionLevelOptionsPtr and ExternalProtectionLevelOptionsPtrOutput values.
// You can construct a concrete instance of `ExternalProtectionLevelOptionsPtrInput` via:
//
//	        ExternalProtectionLevelOptionsArgs{...}
//
//	or:
//
//	        nil
type ExternalProtectionLevelOptionsPtrInput interface {
	pulumi.Input

	ToExternalProtectionLevelOptionsPtrOutput() ExternalProtectionLevelOptionsPtrOutput
	ToExternalProtectionLevelOptionsPtrOutputWithContext(context.Context) ExternalProtectionLevelOptionsPtrOutput
}

type externalProtectionLevelOptionsPtrType ExternalProtectionLevelOptionsArgs

func ExternalProtectionLevelOptionsPtr(v *ExternalProtectionLevelOptionsArgs) ExternalProtectionLevelOptionsPtrInput {
	return (*externalProtectionLevelOptionsPtrType)(v)
}

func (*externalProtectionLevelOptionsPtrType) ElementType() reflect.Type {
	return reflect.TypeOf((**ExternalProtectionLevelOptions)(nil)).Elem()
}

func (i *externalProtectionLevelOptionsPtrType) ToExternalProtectionLevelOptionsPtrOutput() ExternalProtectionLevelOptionsPtrOutput {
	return i.ToExternalProtectionLevelOptionsPtrOutputWithContext(context.Background())
}

func (i *externalProtectionLevelOptionsPtrType) ToExternalProtectionLevelOptionsPtrOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsPtrOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ExternalProtectionLevelOptionsPtrOutput)
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
type ExternalProtectionLevelOptionsOutput struct{ *pulumi.OutputState }

func (ExternalProtectionLevelOptionsOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*ExternalProtectionLevelOptions)(nil)).Elem()
}

func (o ExternalProtectionLevelOptionsOutput) ToExternalProtectionLevelOptionsOutput() ExternalProtectionLevelOptionsOutput {
	return o
}

func (o ExternalProtectionLevelOptionsOutput) ToExternalProtectionLevelOptionsOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsOutput {
	return o
}

func (o ExternalProtectionLevelOptionsOutput) ToExternalProtectionLevelOptionsPtrOutput() ExternalProtectionLevelOptionsPtrOutput {
	return o.ToExternalProtectionLevelOptionsPtrOutputWithContext(context.Background())
}

func (o ExternalProtectionLevelOptionsOutput) ToExternalProtectionLevelOptionsPtrOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsPtrOutput {
	return o.ApplyTWithContext(ctx, func(_ context.Context, v ExternalProtectionLevelOptions) *ExternalProtectionLevelOptions {
		return &v
	}).(ExternalProtectionLevelOptionsPtrOutput)
}

// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
func (o ExternalProtectionLevelOptionsOutput) EkmConnectionKeyPath() pulumi.StringPtrOutput {
	return o.ApplyT(func(v ExternalProtectionLevelOptions) *string { return v.EkmConnectionKeyPath }).(pulumi.StringPtrOutput)
}

// The URI for an external resource that this CryptoKeyVersion represents.
func (o ExternalProtectionLevelOptionsOutput) ExternalKeyUri() pulumi.StringPtrOutput {
	return o.ApplyT(func(v ExternalProtectionLevelOptions) *string { return v.ExternalKeyUri }).(pulumi.StringPtrOutput)
}

type ExternalProtectionLevelOptionsPtrOutput struct{ *pulumi.OutputState }

func (ExternalProtectionLevelOptionsPtrOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**ExternalProtectionLevelOptions)(nil)).Elem()
}

func (o ExternalProtectionLevelOptionsPtrOutput) ToExternalProtectionLevelOptionsPtrOutput() ExternalProtectionLevelOptionsPtrOutput {
	return o
}

func (o ExternalProtectionLevelOptionsPtrOutput) ToExternalProtectionLevelOptionsPtrOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsPtrOutput {
	return o
}

func (o ExternalProtectionLevelOptionsPtrOutput) Elem() ExternalProtectionLevelOptionsOutput {
	return o.ApplyT(func(v *ExternalProtectionLevelOptions) ExternalProtectionLevelOptions {
		if v != nil {
			return *v
		}
		var ret ExternalProtectionLevelOptions
		return ret
	}).(ExternalProtectionLevelOptionsOutput)
}

// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
func (o ExternalProtectionLevelOptionsPtrOutput) EkmConnectionKeyPath() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *ExternalProtectionLevelOptions) *string {
		if v == nil {
			return nil
		}
		return v.EkmConnectionKeyPath
	}).(pulumi.StringPtrOutput)
}

// The URI for an external resource that this CryptoKeyVersion represents.
func (o ExternalProtectionLevelOptionsPtrOutput) ExternalKeyUri() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *ExternalProtectionLevelOptions) *string {
		if v == nil {
			return nil
		}
		return v.ExternalKeyUri
	}).(pulumi.StringPtrOutput)
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
type ExternalProtectionLevelOptionsResponse struct {
	// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
	EkmConnectionKeyPath string `pulumi:"ekmConnectionKeyPath"`
	// The URI for an external resource that this CryptoKeyVersion represents.
	ExternalKeyUri string `pulumi:"externalKeyUri"`
}

// ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
type ExternalProtectionLevelOptionsResponseOutput struct{ *pulumi.OutputState }

func (ExternalProtectionLevelOptionsResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*ExternalProtectionLevelOptionsResponse)(nil)).Elem()
}

func (o ExternalProtectionLevelOptionsResponseOutput) ToExternalProtectionLevelOptionsResponseOutput() ExternalProtectionLevelOptionsResponseOutput {
	return o
}

func (o ExternalProtectionLevelOptionsResponseOutput) ToExternalProtectionLevelOptionsResponseOutputWithContext(ctx context.Context) ExternalProtectionLevelOptionsResponseOutput {
	return o
}

// The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of external_key_uri when using an EkmConnection.
func (o ExternalProtectionLevelOptionsResponseOutput) EkmConnectionKeyPath() pulumi.StringOutput {
	return o.ApplyT(func(v ExternalProtectionLevelOptionsResponse) string { return v.EkmConnectionKeyPath }).(pulumi.StringOutput)
}

// The URI for an external resource that this CryptoKeyVersion represents.
func (o ExternalProtectionLevelOptionsResponseOutput) ExternalKeyUri() pulumi.StringOutput {
	return o.ApplyT(func(v ExternalProtectionLevelOptionsResponse) string { return v.ExternalKeyUri }).(pulumi.StringOutput)
}

// Contains an HSM-generated attestation about a key operation. For more information, see [Verifying attestations] (https://cloud.google.com/kms/docs/attest-key).
type KeyOperationAttestationResponse struct {
	// The certificate chains needed to validate the attestation
	CertChains CertificateChainsResponse `pulumi:"certChains"`
	// The attestation data provided by the HSM when the key operation was performed.
	Content string `pulumi:"content"`
	// The format of the attestation data.
	Format string `pulumi:"format"`
}

// Contains an HSM-generated attestation about a key operation. For more information, see [Verifying attestations] (https://cloud.google.com/kms/docs/attest-key).
type KeyOperationAttestationResponseOutput struct{ *pulumi.OutputState }

func (KeyOperationAttestationResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*KeyOperationAttestationResponse)(nil)).Elem()
}

func (o KeyOperationAttestationResponseOutput) ToKeyOperationAttestationResponseOutput() KeyOperationAttestationResponseOutput {
	return o
}

func (o KeyOperationAttestationResponseOutput) ToKeyOperationAttestationResponseOutputWithContext(ctx context.Context) KeyOperationAttestationResponseOutput {
	return o
}

// The certificate chains needed to validate the attestation
func (o KeyOperationAttestationResponseOutput) CertChains() CertificateChainsResponseOutput {
	return o.ApplyT(func(v KeyOperationAttestationResponse) CertificateChainsResponse { return v.CertChains }).(CertificateChainsResponseOutput)
}

// The attestation data provided by the HSM when the key operation was performed.
func (o KeyOperationAttestationResponseOutput) Content() pulumi.StringOutput {
	return o.ApplyT(func(v KeyOperationAttestationResponse) string { return v.Content }).(pulumi.StringOutput)
}

// The format of the attestation data.
func (o KeyOperationAttestationResponseOutput) Format() pulumi.StringOutput {
	return o.ApplyT(func(v KeyOperationAttestationResponse) string { return v.Format }).(pulumi.StringOutput)
}

// A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.
type ServiceResolver struct {
	// Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
	EndpointFilter *string `pulumi:"endpointFilter"`
	// The hostname of the EKM replica used at TLS and HTTP layers.
	Hostname string `pulumi:"hostname"`
	// A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
	ServerCertificates []Certificate `pulumi:"serverCertificates"`
	// The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
	ServiceDirectoryService string `pulumi:"serviceDirectoryService"`
}

// ServiceResolverInput is an input type that accepts ServiceResolverArgs and ServiceResolverOutput values.
// You can construct a concrete instance of `ServiceResolverInput` via:
//
//	ServiceResolverArgs{...}
type ServiceResolverInput interface {
	pulumi.Input

	ToServiceResolverOutput() ServiceResolverOutput
	ToServiceResolverOutputWithContext(context.Context) ServiceResolverOutput
}

// A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.
type ServiceResolverArgs struct {
	// Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
	EndpointFilter pulumi.StringPtrInput `pulumi:"endpointFilter"`
	// The hostname of the EKM replica used at TLS and HTTP layers.
	Hostname pulumi.StringInput `pulumi:"hostname"`
	// A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
	ServerCertificates CertificateArrayInput `pulumi:"serverCertificates"`
	// The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
	ServiceDirectoryService pulumi.StringInput `pulumi:"serviceDirectoryService"`
}

func (ServiceResolverArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*ServiceResolver)(nil)).Elem()
}

func (i ServiceResolverArgs) ToServiceResolverOutput() ServiceResolverOutput {
	return i.ToServiceResolverOutputWithContext(context.Background())
}

func (i ServiceResolverArgs) ToServiceResolverOutputWithContext(ctx context.Context) ServiceResolverOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ServiceResolverOutput)
}

// ServiceResolverArrayInput is an input type that accepts ServiceResolverArray and ServiceResolverArrayOutput values.
// You can construct a concrete instance of `ServiceResolverArrayInput` via:
//
//	ServiceResolverArray{ ServiceResolverArgs{...} }
type ServiceResolverArrayInput interface {
	pulumi.Input

	ToServiceResolverArrayOutput() ServiceResolverArrayOutput
	ToServiceResolverArrayOutputWithContext(context.Context) ServiceResolverArrayOutput
}

type ServiceResolverArray []ServiceResolverInput

func (ServiceResolverArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]ServiceResolver)(nil)).Elem()
}

func (i ServiceResolverArray) ToServiceResolverArrayOutput() ServiceResolverArrayOutput {
	return i.ToServiceResolverArrayOutputWithContext(context.Background())
}

func (i ServiceResolverArray) ToServiceResolverArrayOutputWithContext(ctx context.Context) ServiceResolverArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(ServiceResolverArrayOutput)
}

// A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.
type ServiceResolverOutput struct{ *pulumi.OutputState }

func (ServiceResolverOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*ServiceResolver)(nil)).Elem()
}

func (o ServiceResolverOutput) ToServiceResolverOutput() ServiceResolverOutput {
	return o
}

func (o ServiceResolverOutput) ToServiceResolverOutputWithContext(ctx context.Context) ServiceResolverOutput {
	return o
}

// Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
func (o ServiceResolverOutput) EndpointFilter() pulumi.StringPtrOutput {
	return o.ApplyT(func(v ServiceResolver) *string { return v.EndpointFilter }).(pulumi.StringPtrOutput)
}

// The hostname of the EKM replica used at TLS and HTTP layers.
func (o ServiceResolverOutput) Hostname() pulumi.StringOutput {
	return o.ApplyT(func(v ServiceResolver) string { return v.Hostname }).(pulumi.StringOutput)
}

// A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
func (o ServiceResolverOutput) ServerCertificates() CertificateArrayOutput {
	return o.ApplyT(func(v ServiceResolver) []Certificate { return v.ServerCertificates }).(CertificateArrayOutput)
}

// The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
func (o ServiceResolverOutput) ServiceDirectoryService() pulumi.StringOutput {
	return o.ApplyT(func(v ServiceResolver) string { return v.ServiceDirectoryService }).(pulumi.StringOutput)
}

type ServiceResolverArrayOutput struct{ *pulumi.OutputState }

func (ServiceResolverArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]ServiceResolver)(nil)).Elem()
}

func (o ServiceResolverArrayOutput) ToServiceResolverArrayOutput() ServiceResolverArrayOutput {
	return o
}

func (o ServiceResolverArrayOutput) ToServiceResolverArrayOutputWithContext(ctx context.Context) ServiceResolverArrayOutput {
	return o
}

func (o ServiceResolverArrayOutput) Index(i pulumi.IntInput) ServiceResolverOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) ServiceResolver {
		return vs[0].([]ServiceResolver)[vs[1].(int)]
	}).(ServiceResolverOutput)
}

// A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.
type ServiceResolverResponse struct {
	// Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
	EndpointFilter string `pulumi:"endpointFilter"`
	// The hostname of the EKM replica used at TLS and HTTP layers.
	Hostname string `pulumi:"hostname"`
	// A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
	ServerCertificates []CertificateResponse `pulumi:"serverCertificates"`
	// The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
	ServiceDirectoryService string `pulumi:"serviceDirectoryService"`
}

// A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.
type ServiceResolverResponseOutput struct{ *pulumi.OutputState }

func (ServiceResolverResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*ServiceResolverResponse)(nil)).Elem()
}

func (o ServiceResolverResponseOutput) ToServiceResolverResponseOutput() ServiceResolverResponseOutput {
	return o
}

func (o ServiceResolverResponseOutput) ToServiceResolverResponseOutputWithContext(ctx context.Context) ServiceResolverResponseOutput {
	return o
}

// Optional. The filter applied to the endpoints of the resolved service. If no filter is specified, all endpoints will be considered. An endpoint will be chosen arbitrarily from the filtered list for each request. For endpoint filter syntax and examples, see https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
func (o ServiceResolverResponseOutput) EndpointFilter() pulumi.StringOutput {
	return o.ApplyT(func(v ServiceResolverResponse) string { return v.EndpointFilter }).(pulumi.StringOutput)
}

// The hostname of the EKM replica used at TLS and HTTP layers.
func (o ServiceResolverResponseOutput) Hostname() pulumi.StringOutput {
	return o.ApplyT(func(v ServiceResolverResponse) string { return v.Hostname }).(pulumi.StringOutput)
}

// A list of leaf server certificates used to authenticate HTTPS connections to the EKM replica. Currently, a maximum of 10 Certificate is supported.
func (o ServiceResolverResponseOutput) ServerCertificates() CertificateResponseArrayOutput {
	return o.ApplyT(func(v ServiceResolverResponse) []CertificateResponse { return v.ServerCertificates }).(CertificateResponseArrayOutput)
}

// The resource name of the Service Directory service pointing to an EKM replica, in the format `projects/*/locations/*/namespaces/*/services/*`.
func (o ServiceResolverResponseOutput) ServiceDirectoryService() pulumi.StringOutput {
	return o.ApplyT(func(v ServiceResolverResponse) string { return v.ServiceDirectoryService }).(pulumi.StringOutput)
}

type ServiceResolverResponseArrayOutput struct{ *pulumi.OutputState }

func (ServiceResolverResponseArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]ServiceResolverResponse)(nil)).Elem()
}

func (o ServiceResolverResponseArrayOutput) ToServiceResolverResponseArrayOutput() ServiceResolverResponseArrayOutput {
	return o
}

func (o ServiceResolverResponseArrayOutput) ToServiceResolverResponseArrayOutputWithContext(ctx context.Context) ServiceResolverResponseArrayOutput {
	return o
}

func (o ServiceResolverResponseArrayOutput) Index(i pulumi.IntInput) ServiceResolverResponseOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) ServiceResolverResponse {
		return vs[0].([]ServiceResolverResponse)[vs[1].(int)]
	}).(ServiceResolverResponseOutput)
}

// The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.
type WrappingPublicKeyResponse struct {
	// The public key, encoded in PEM format. For more information, see the [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13).
	Pem string `pulumi:"pem"`
}

// The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.
type WrappingPublicKeyResponseOutput struct{ *pulumi.OutputState }

func (WrappingPublicKeyResponseOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*WrappingPublicKeyResponse)(nil)).Elem()
}

func (o WrappingPublicKeyResponseOutput) ToWrappingPublicKeyResponseOutput() WrappingPublicKeyResponseOutput {
	return o
}

func (o WrappingPublicKeyResponseOutput) ToWrappingPublicKeyResponseOutputWithContext(ctx context.Context) WrappingPublicKeyResponseOutput {
	return o
}

// The public key, encoded in PEM format. For more information, see the [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13).
func (o WrappingPublicKeyResponseOutput) Pem() pulumi.StringOutput {
	return o.ApplyT(func(v WrappingPublicKeyResponse) string { return v.Pem }).(pulumi.StringOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*AuditConfigInput)(nil)).Elem(), AuditConfigArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*AuditConfigArrayInput)(nil)).Elem(), AuditConfigArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*AuditLogConfigInput)(nil)).Elem(), AuditLogConfigArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*AuditLogConfigArrayInput)(nil)).Elem(), AuditLogConfigArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*BindingInput)(nil)).Elem(), BindingArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*BindingArrayInput)(nil)).Elem(), BindingArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*CertificateInput)(nil)).Elem(), CertificateArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*CertificateArrayInput)(nil)).Elem(), CertificateArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*CryptoKeyVersionTemplateInput)(nil)).Elem(), CryptoKeyVersionTemplateArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*CryptoKeyVersionTemplatePtrInput)(nil)).Elem(), CryptoKeyVersionTemplateArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ExprInput)(nil)).Elem(), ExprArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ExprPtrInput)(nil)).Elem(), ExprArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ExternalProtectionLevelOptionsInput)(nil)).Elem(), ExternalProtectionLevelOptionsArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ExternalProtectionLevelOptionsPtrInput)(nil)).Elem(), ExternalProtectionLevelOptionsArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ServiceResolverInput)(nil)).Elem(), ServiceResolverArgs{})
	pulumi.RegisterInputType(reflect.TypeOf((*ServiceResolverArrayInput)(nil)).Elem(), ServiceResolverArray{})
	pulumi.RegisterOutputType(AuditConfigOutput{})
	pulumi.RegisterOutputType(AuditConfigArrayOutput{})
	pulumi.RegisterOutputType(AuditConfigResponseOutput{})
	pulumi.RegisterOutputType(AuditConfigResponseArrayOutput{})
	pulumi.RegisterOutputType(AuditLogConfigOutput{})
	pulumi.RegisterOutputType(AuditLogConfigArrayOutput{})
	pulumi.RegisterOutputType(AuditLogConfigResponseOutput{})
	pulumi.RegisterOutputType(AuditLogConfigResponseArrayOutput{})
	pulumi.RegisterOutputType(BindingOutput{})
	pulumi.RegisterOutputType(BindingArrayOutput{})
	pulumi.RegisterOutputType(BindingResponseOutput{})
	pulumi.RegisterOutputType(BindingResponseArrayOutput{})
	pulumi.RegisterOutputType(CertificateOutput{})
	pulumi.RegisterOutputType(CertificateArrayOutput{})
	pulumi.RegisterOutputType(CertificateChainsResponseOutput{})
	pulumi.RegisterOutputType(CertificateResponseOutput{})
	pulumi.RegisterOutputType(CertificateResponseArrayOutput{})
	pulumi.RegisterOutputType(CryptoKeyVersionResponseOutput{})
	pulumi.RegisterOutputType(CryptoKeyVersionTemplateOutput{})
	pulumi.RegisterOutputType(CryptoKeyVersionTemplatePtrOutput{})
	pulumi.RegisterOutputType(CryptoKeyVersionTemplateResponseOutput{})
	pulumi.RegisterOutputType(ExprOutput{})
	pulumi.RegisterOutputType(ExprPtrOutput{})
	pulumi.RegisterOutputType(ExprResponseOutput{})
	pulumi.RegisterOutputType(ExternalProtectionLevelOptionsOutput{})
	pulumi.RegisterOutputType(ExternalProtectionLevelOptionsPtrOutput{})
	pulumi.RegisterOutputType(ExternalProtectionLevelOptionsResponseOutput{})
	pulumi.RegisterOutputType(KeyOperationAttestationResponseOutput{})
	pulumi.RegisterOutputType(ServiceResolverOutput{})
	pulumi.RegisterOutputType(ServiceResolverArrayOutput{})
	pulumi.RegisterOutputType(ServiceResolverResponseOutput{})
	pulumi.RegisterOutputType(ServiceResolverResponseArrayOutput{})
	pulumi.RegisterOutputType(WrappingPublicKeyResponseOutput{})
}