Class KeyRingIAMMember

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

  • gcp.kms.KeyRingIAMPolicy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
  • gcp.kms.KeyRingIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
  • gcp.kms.KeyRingIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: gcp.kms.KeyRingIAMPolicy cannot be used in conjunction with gcp.kms.KeyRingIAMBinding and gcp.kms.KeyRingIAMMember or they will fight over what your policy should be.

Note: gcp.kms.KeyRingIAMBinding resources can be used in conjunction with gcp.kms.KeyRingIAMMember resources only if they do not grant privilege to the same role.

google_kms_key_ring_iam_policy

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new Gcp.Kms.KeyRingArgs
    {
        Location = "global",
    });
    var admin = Output.Create(Gcp.Organizations.GetIAMPolicy.InvokeAsync(new Gcp.Organizations.GetIAMPolicyArgs
    {
        Binding = 
        {

            {
                { "role", "roles/editor" },
                { "members", 
                {
                    "user:jane@example.com",
                } },
            },
        },
    }));
    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("keyRing", new Gcp.Kms.KeyRingIAMPolicyArgs
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(admin => admin.PolicyData),
    });
}

}

With IAM Conditions:

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new Gcp.Kms.KeyRingArgs
    {
        Location = "global",
    });
    var admin = Output.Create(Gcp.Organizations.GetIAMPolicy.InvokeAsync(new Gcp.Organizations.GetIAMPolicyArgs
    {
        Binding = 
        {

            {
                { "role", "roles/editor" },
                { "members", 
                {
                    "user:jane@example.com",
                } },
                { "condition", 
                {
                    { "title", "expires_after_2019_12_31" },
                    { "description", "Expiring at midnight of 2019-12-31" },
                    { "expression", "request.time < timestamp(\"2020-01-01T00:00:00Z\")" },
                } },
            },
        },
    }));
    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("keyRing", new Gcp.Kms.KeyRingIAMPolicyArgs
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(admin => admin.PolicyData),
    });
}

}

google_kms_key_ring_iam_binding

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("keyRing", new Gcp.Kms.KeyRingIAMBindingArgs
    {
        KeyRingId = "your-key-ring-id",
        Members = 
        {
            "user:jane@example.com",
        },
        Role = "roles/editor",
    });
}

}

With IAM Conditions:

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("keyRing", new Gcp.Kms.KeyRingIAMBindingArgs
    {
        Condition = new Gcp.Kms.Inputs.KeyRingIAMBindingConditionArgs
        {
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            Title = "expires_after_2019_12_31",
        },
        KeyRingId = "your-key-ring-id",
        Members = 
        {
            "user:jane@example.com",
        },
        Role = "roles/editor",
    });
}

}

google_kms_key_ring_iam_member

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("keyRing", new Gcp.Kms.KeyRingIAMMemberArgs
    {
        KeyRingId = "your-key-ring-id",
        Member = "user:jane@example.com",
        Role = "roles/editor",
    });
}

}

With IAM Conditions:

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("keyRing", new Gcp.Kms.KeyRingIAMMemberArgs
    {
        Condition = new Gcp.Kms.Inputs.KeyRingIAMMemberConditionArgs
        {
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            Title = "expires_after_2019_12_31",
        },
        KeyRingId = "your-key-ring-id",
        Member = "user:jane@example.com",
        Role = "roles/editor",
    });
}

}
Inheritance
System.Object
Resource
CustomResource
KeyRingIAMMember
Inherited Members
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.ToString()
Namespace: Pulumi.Gcp.Kms
Assembly: Pulumi.Gcp.dll
Syntax
public class KeyRingIAMMember : CustomResource

Constructors

View Source

KeyRingIAMMember(String, KeyRingIAMMemberArgs, CustomResourceOptions)

Create a KeyRingIAMMember resource with the given unique name, arguments, and options.

Declaration
public KeyRingIAMMember(string name, KeyRingIAMMemberArgs args, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resource
KeyRingIAMMemberArgs args

The arguments used to populate this resource's properties
CustomResourceOptions options

A bag of options that control this resource's behavior

Properties

View Source

Condition

An IAM Condition for a given binding. Structure is documented below.

Declaration
public Output<KeyRingIAMMemberCondition> Condition { get; }
Property Value
Type Description
Output<KeyRingIAMMemberCondition>
View Source

Etag

(Computed) The etag of the key ring's IAM policy.

Declaration
public Output<string> Etag { get; }
Property Value
Type Description
Output<System.String>
View Source

KeyRingId

The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider's project setting will be used as a fallback.

Declaration
public Output<string> KeyRingId { get; }
Property Value
Type Description
Output<System.String>
View Source

Member

Declaration
public Output<string> Member { get; }
Property Value
Type Description
Output<System.String>
View Source

Role

The role that should be applied. Only one gcp.kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

Declaration
public Output<string> Role { get; }
Property Value
Type Description
Output<System.String>

Methods

View Source

Get(String, Input<String>, KeyRingIAMMemberState, CustomResourceOptions)

Get an existing KeyRingIAMMember resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Declaration
public static KeyRingIAMMember Get(string name, Input<string> id, KeyRingIAMMemberState state = null, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resulting resource.
Input<System.String> id

The unique provider ID of the resource to lookup.
KeyRingIAMMemberState state

Any extra arguments used during the lookup.
CustomResourceOptions options

A bag of options that control this resource's behavior
Returns
Type Description
KeyRingIAMMember