IamAuditConfig

Allows management of audit logging config for a given service for a Google Cloud Platform Organization.

Create a IamAuditConfig Resource

new IamAuditConfig(name: string, args: IamAuditConfigArgs, opts?: CustomResourceOptions);

def IamAuditConfig(resource_name, opts=None, audit_log_configs=None, org_id=None, service=None, __props__=None);

func NewIamAuditConfig(ctx *Context, name string, args IamAuditConfigArgs, opts ...ResourceOption) (*IamAuditConfig, error)

public IamAuditConfig(string name, IamAuditConfigArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args IamAuditConfigArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args IamAuditConfigArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IamAuditConfigArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

IamAuditConfig Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IamAuditConfig resource accepts the following input properties:

AuditLogConfigs List<IamAuditConfigAuditLogConfigArgs>: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
OrgId string: The numeric ID of the organization in which you want to manage the audit logging config.
Service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

AuditLogConfigs []IamAuditConfigAuditLogConfig: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
OrgId string: The numeric ID of the organization in which you want to manage the audit logging config.
Service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

auditLogConfigs IamAuditConfigAuditLogConfig[]: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
orgId string: The numeric ID of the organization in which you want to manage the audit logging config.
service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

audit_log_configs List[IamAuditConfigAuditLogConfig]: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
org_id str: The numeric ID of the organization in which you want to manage the audit logging config.
service str: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

Outputs

All input properties are implicitly available as output properties. Additionally, the IamAuditConfig resource produces the following output properties:

Etag string: The etag of iam policy
Id string: The provider-assigned unique ID for this managed resource.

Etag string: The etag of iam policy
Id string: The provider-assigned unique ID for this managed resource.

etag string: The etag of iam policy
id string: The provider-assigned unique ID for this managed resource.

etag str: The etag of iam policy
id str: The provider-assigned unique ID for this managed resource.

Look up an Existing IamAuditConfig Resource

Get an existing IamAuditConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IamAuditConfigState, opts?: CustomResourceOptions): IamAuditConfig

static get(resource_name, id, opts=None, audit_log_configs=None, etag=None, org_id=None, service=None, __props__=None);

func GetIamAuditConfig(ctx *Context, name string, id IDInput, state *IamAuditConfigState, opts ...ResourceOption) (*IamAuditConfig, error)

public static IamAuditConfig Get(string name, Input<string> id, IamAuditConfigState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AuditLogConfigs List<IamAuditConfigAuditLogConfigArgs>: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
Etag string: The etag of iam policy
OrgId string: The numeric ID of the organization in which you want to manage the audit logging config.
Service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

AuditLogConfigs []IamAuditConfigAuditLogConfig: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
Etag string: The etag of iam policy
OrgId string: The numeric ID of the organization in which you want to manage the audit logging config.
Service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

auditLogConfigs IamAuditConfigAuditLogConfig[]: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
etag string: The etag of iam policy
orgId string: The numeric ID of the organization in which you want to manage the audit logging config.
service string: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

audit_log_configs List[IamAuditConfigAuditLogConfig]: The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
etag str: The etag of iam policy
org_id str: The numeric ID of the organization in which you want to manage the audit logging config.
service str: Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

Supporting Types

IamAuditConfigAuditLogConfig

See the input and output API doc for this type.

LogType string: Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
ExemptedMembers List<string>: Identities that do not cause logging for this type of permission. Each entry can have one of the following values: * user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com. * serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. * group:{emailid}: An email address that represents a Google group. For example, admins@example.com. * domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.

LogType string: Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
ExemptedMembers []string: Identities that do not cause logging for this type of permission. Each entry can have one of the following values: * user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com. * serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. * group:{emailid}: An email address that represents a Google group. For example, admins@example.com. * domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.

logType string: Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
exemptedMembers string[]: Identities that do not cause logging for this type of permission. Each entry can have one of the following values: * user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com. * serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. * group:{emailid}: An email address that represents a Google group. For example, admins@example.com. * domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.

logType str: Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
exemptedMembers List[str]: Identities that do not cause logging for this type of permission. Each entry can have one of the following values: * user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com. * serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. * group:{emailid}: An email address that represents a Google group. For example, admins@example.com. * domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.

Package Details

Repository: https://github.com/pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud