Module projects

This page documents the language specification for the gcp package. If you're looking for help working with the inputs, outputs, or functions of gcp resources in a Pulumi program, please see the resource documentation for examples and API reference.

Resources

IAMAuditConfig
IAMBinding
IAMCustomRole
IAMMember
IAMPolicy
OrganizationPolicy
Service
UsageExportBucket

Others

Resources

Resource IAMAuditConfig

class IAMAuditConfig extends CustomResource

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:

gcp.projects.IAMPolicy: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.
gcp.projects.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
gcp.projects.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.
gcp.projects.IAMAuditConfig: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.

Note: gcp.projects.IAMPolicy cannot be used in conjunction with gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig or they will fight over what your policy should be.
Note: gcp.projects.IAMBinding resources can be used in conjunction with gcp.projects.IAMMember resources only if they do not grant privilege to the same role.

google_project_iam_policy

Be careful! You can accidentally lock yourself out of your project using this resource. Deleting a gcp.projects.IAMPolicy removes access from anyone without organization-level access to the project. Proceed with caution. It’s not recommended to use gcp.projects.IAMPolicy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to import the policy before applying the change.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    binding: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const project = new gcp.projects.IAMPolicy("project", {
    project: "your-project-id",
    policyData: admin.then(admin => admin.policyData),
});

With IAM Conditions):

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = pulumi.output(gcp.organizations.getIAMPolicy({
    bindings: [{
        condition: {
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            title: "expiresAfter20191231",
        },
        members: ["user:jane@example.com"],
        role: "roles/editor",
    }],
}, { async: true }));
const project = new gcp.projects.IAMPolicy("project", {
    policyData: admin.policyData,
    project: "your-project-id",
});

google_project_iam_binding

Note: If role is set to roles/owner and you don’t specify a user or service account you have access to in members, you can lock yourself out of your project.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_member

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_audit_config

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMAuditConfig("project", {
    auditLogConfigs: [
        {
            logType: "ADMIN_READ",
        },
        {
            exemptedMembers: ["user:joebloggs@hashicorp.com"],
            logType: "DATA_READ",
        },
    ],
    project: "your-project-id",
    service: "allServices",
});

constructor

new IAMAuditConfig(name: string, args: IAMAuditConfigArgs, opts?: pulumi.CustomResourceOptions)

Create a IAMAuditConfig resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: IAMAuditConfigState, opts?: pulumi.CustomResourceOptions): IAMAuditConfig

Get an existing IAMAuditConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is IAMAuditConfig

Returns true if the given object is an instance of IAMAuditConfig. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property auditLogConfigs

public auditLogConfigs: pulumi.Output<IAMAuditConfigAuditLogConfig[]>;

The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.

property etag

public etag: pulumi.Output<string>;

(Computed) The etag of the project’s IAM policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property project

public project: pulumi.Output<string>;

The project ID. If not specified for gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig, uses the ID of the project configured with the provider. Required for gcp.projects.IAMPolicy - you must explicitly set the project, and it will not be inferred from the provider.

property service

public service: pulumi.Output<string>;

Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_project_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the logTypes specified in each auditLogConfig are enabled, and the exemptedMembers in each auditLogConfig are exempted.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource IAMBinding

class IAMBinding extends CustomResource

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:

gcp.projects.IAMPolicy: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.
gcp.projects.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
gcp.projects.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.
gcp.projects.IAMAuditConfig: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.

Note: gcp.projects.IAMPolicy cannot be used in conjunction with gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig or they will fight over what your policy should be.
Note: gcp.projects.IAMBinding resources can be used in conjunction with gcp.projects.IAMMember resources only if they do not grant privilege to the same role.

google_project_iam_policy

Be careful! You can accidentally lock yourself out of your project using this resource. Deleting a gcp.projects.IAMPolicy removes access from anyone without organization-level access to the project. Proceed with caution. It’s not recommended to use gcp.projects.IAMPolicy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to import the policy before applying the change.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    binding: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const project = new gcp.projects.IAMPolicy("project", {
    project: "your-project-id",
    policyData: admin.then(admin => admin.policyData),
});

With IAM Conditions):

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = pulumi.output(gcp.organizations.getIAMPolicy({
    bindings: [{
        condition: {
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            title: "expiresAfter20191231",
        },
        members: ["user:jane@example.com"],
        role: "roles/editor",
    }],
}, { async: true }));
const project = new gcp.projects.IAMPolicy("project", {
    policyData: admin.policyData,
    project: "your-project-id",
});

google_project_iam_binding

Note: If role is set to roles/owner and you don’t specify a user or service account you have access to in members, you can lock yourself out of your project.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_member

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_audit_config

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMAuditConfig("project", {
    auditLogConfigs: [
        {
            logType: "ADMIN_READ",
        },
        {
            exemptedMembers: ["user:joebloggs@hashicorp.com"],
            logType: "DATA_READ",
        },
    ],
    project: "your-project-id",
    service: "allServices",
});

constructor

new IAMBinding(name: string, args: IAMBindingArgs, opts?: pulumi.CustomResourceOptions)

Create a IAMBinding resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: IAMBindingState, opts?: pulumi.CustomResourceOptions): IAMBinding

Get an existing IAMBinding resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is IAMBinding

Returns true if the given object is an instance of IAMBinding. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property condition

public condition: pulumi.Output<IAMBindingCondition | undefined>;

An IAM Condition for a given binding. Structure is documented below.

property etag

public etag: pulumi.Output<string>;

(Computed) The etag of the project’s IAM policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property members

public members: pulumi.Output<string[]>;

property project

public project: pulumi.Output<string>;

property role

public role: pulumi.Output<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource IAMCustomRole

class IAMCustomRole extends CustomResource

Allows management of a customized Cloud IAM project role. For more information see the official documentation and API.

Warning: Note that custom roles in GCP have the concept of a soft-delete. There are two issues that may arise from this and how roles are propagated. 1) creating a role may involve undeleting and then updating a role with the same name, possibly causing confusing behavior between undelete and update. 2) A deleted role is permanently deleted after 7 days, but it can take up to 30 more days (i.e. between 7 and 37 days after deletion) before the role name is made available again. This means a deleted role that has been deleted for more than 7 days cannot be changed at all by the provider, and new roles cannot share that name.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const myCustomRole = new gcp.projects.IAMCustomRole("my-custom-role", {
    description: "A description",
    permissions: [
        "iam.roles.list",
        "iam.roles.create",
        "iam.roles.delete",
    ],
    roleId: "myCustomRole",
    title: "My Custom Role",
});

constructor

new IAMCustomRole(name: string, args: IAMCustomRoleArgs, opts?: pulumi.CustomResourceOptions)

Create a IAMCustomRole resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: IAMCustomRoleState, opts?: pulumi.CustomResourceOptions): IAMCustomRole

Get an existing IAMCustomRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is IAMCustomRole

Returns true if the given object is an instance of IAMCustomRole. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property deleted

public deleted: pulumi.Output<boolean>;

(Optional) The current deleted state of the role.

property description

public description: pulumi.Output<string | undefined>;

A human-readable description for the role.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The name of the role in the format projects/{{project}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.

property permissions

public permissions: pulumi.Output<string[]>;

The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.

property project

public project: pulumi.Output<string>;

The project that the service account will be created in. Defaults to the provider project configuration.

property roleId

public roleId: pulumi.Output<string>;

The camel case role id to use for this role. Cannot contain - characters.

property stage

public stage: pulumi.Output<string | undefined>;

The current launch stage of the role. Defaults to GA. List of possible stages is here.

property title

public title: pulumi.Output<string>;

A human-readable title for the role.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource IAMMember

class IAMMember extends CustomResource

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:

gcp.projects.IAMPolicy: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.
gcp.projects.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
gcp.projects.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.
gcp.projects.IAMAuditConfig: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.

Note: gcp.projects.IAMPolicy cannot be used in conjunction with gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig or they will fight over what your policy should be.
Note: gcp.projects.IAMBinding resources can be used in conjunction with gcp.projects.IAMMember resources only if they do not grant privilege to the same role.

google_project_iam_policy

Be careful! You can accidentally lock yourself out of your project using this resource. Deleting a gcp.projects.IAMPolicy removes access from anyone without organization-level access to the project. Proceed with caution. It’s not recommended to use gcp.projects.IAMPolicy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to import the policy before applying the change.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    binding: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const project = new gcp.projects.IAMPolicy("project", {
    project: "your-project-id",
    policyData: admin.then(admin => admin.policyData),
});

With IAM Conditions):

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = pulumi.output(gcp.organizations.getIAMPolicy({
    bindings: [{
        condition: {
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            title: "expiresAfter20191231",
        },
        members: ["user:jane@example.com"],
        role: "roles/editor",
    }],
}, { async: true }));
const project = new gcp.projects.IAMPolicy("project", {
    policyData: admin.policyData,
    project: "your-project-id",
});

google_project_iam_binding

Note: If role is set to roles/owner and you don’t specify a user or service account you have access to in members, you can lock yourself out of your project.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_member

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_audit_config

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMAuditConfig("project", {
    auditLogConfigs: [
        {
            logType: "ADMIN_READ",
        },
        {
            exemptedMembers: ["user:joebloggs@hashicorp.com"],
            logType: "DATA_READ",
        },
    ],
    project: "your-project-id",
    service: "allServices",
});

constructor

new IAMMember(name: string, args: IAMMemberArgs, opts?: pulumi.CustomResourceOptions)

Create a IAMMember resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: IAMMemberState, opts?: pulumi.CustomResourceOptions): IAMMember

Get an existing IAMMember resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is IAMMember

Returns true if the given object is an instance of IAMMember. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property condition

public condition: pulumi.Output<IAMMemberCondition | undefined>;

An IAM Condition for a given binding. Structure is documented below.

property etag

public etag: pulumi.Output<string>;

(Computed) The etag of the project’s IAM policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property member

public member: pulumi.Output<string>;

property project

public project: pulumi.Output<string>;

property role

public role: pulumi.Output<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource IAMPolicy

class IAMPolicy extends CustomResource

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:

gcp.projects.IAMPolicy: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.
gcp.projects.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
gcp.projects.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.
gcp.projects.IAMAuditConfig: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.

Note: gcp.projects.IAMPolicy cannot be used in conjunction with gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig or they will fight over what your policy should be.
Note: gcp.projects.IAMBinding resources can be used in conjunction with gcp.projects.IAMMember resources only if they do not grant privilege to the same role.

google_project_iam_policy

Be careful! You can accidentally lock yourself out of your project using this resource. Deleting a gcp.projects.IAMPolicy removes access from anyone without organization-level access to the project. Proceed with caution. It’s not recommended to use gcp.projects.IAMPolicy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to import the policy before applying the change.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    binding: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const project = new gcp.projects.IAMPolicy("project", {
    project: "your-project-id",
    policyData: admin.then(admin => admin.policyData),
});

With IAM Conditions):

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = pulumi.output(gcp.organizations.getIAMPolicy({
    bindings: [{
        condition: {
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            title: "expiresAfter20191231",
        },
        members: ["user:jane@example.com"],
        role: "roles/editor",
    }],
}, { async: true }));
const project = new gcp.projects.IAMPolicy("project", {
    policyData: admin.policyData,
    project: "your-project-id",
});

google_project_iam_binding

Note: If role is set to roles/owner and you don’t specify a user or service account you have access to in members, you can lock yourself out of your project.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMBinding("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    members: ["user:jane@example.com"],
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_member

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMMember("project", {
    condition: {
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        title: "expiresAfter20191231",
    },
    member: "user:jane@example.com",
    project: "your-project-id",
    role: "roles/editor",
});

google_project_iam_audit_config

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.IAMAuditConfig("project", {
    auditLogConfigs: [
        {
            logType: "ADMIN_READ",
        },
        {
            exemptedMembers: ["user:joebloggs@hashicorp.com"],
            logType: "DATA_READ",
        },
    ],
    project: "your-project-id",
    service: "allServices",
});

constructor

new IAMPolicy(name: string, args: IAMPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a IAMPolicy resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: IAMPolicyState, opts?: pulumi.CustomResourceOptions): IAMPolicy

Get an existing IAMPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is IAMPolicy

Returns true if the given object is an instance of IAMPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property etag

public etag: pulumi.Output<string>;

(Computed) The etag of the project’s IAM policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property policyData

public policyData: pulumi.Output<string>;

The gcp.organizations.getIAMPolicy data source that represents the IAM policy that will be applied to the project. The policy will be merged with any existing policy applied to the project.

property project

public project: pulumi.Output<string>;

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource OrganizationPolicy

class OrganizationPolicy extends CustomResource

Allows management of Organization policies for a Google Project. For more information see the official documentation and API.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const serialPortPolicy = new gcp.projects.OrganizationPolicy("serialPortPolicy", {
    booleanPolicy: {
        enforced: true,
    },
    constraint: "compute.disableSerialPortAccess",
    project: "your-project-id",
});

constructor

new OrganizationPolicy(name: string, args: OrganizationPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a OrganizationPolicy resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OrganizationPolicyState, opts?: pulumi.CustomResourceOptions): OrganizationPolicy

Get an existing OrganizationPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is OrganizationPolicy

Returns true if the given object is an instance of OrganizationPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property booleanPolicy

public booleanPolicy: pulumi.Output<OrganizationPolicyBooleanPolicy | undefined>;

A boolean policy is a constraint that is either enforced or not. Structure is documented below.

property constraint

public constraint: pulumi.Output<string>;

The name of the Constraint the Policy is configuring, for example, serviceuser.services. Check out the complete list of available constraints.

property etag

public etag: pulumi.Output<string>;

(Computed) The etag of the organization policy. etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property listPolicy

public listPolicy: pulumi.Output<OrganizationPolicyListPolicy | undefined>;

A policy that can define specific values that are allowed or denied for the given constraint. It can also be used to allow or deny all values. Structure is documented below.

property project

public project: pulumi.Output<string>;

The project id of the project to set the policy for.

property restorePolicy

public restorePolicy: pulumi.Output<OrganizationPolicyRestorePolicy | undefined>;

A restore policy is a constraint to restore the default policy. Structure is documented below.

property updateTime

public updateTime: pulumi.Output<string>;

(Computed) The timestamp in RFC3339 UTC “Zulu” format, accurate to nanoseconds, representing when the variable was last updated. Example: “2016-10-09T12:33:37.578138407Z”.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

property version

public version: pulumi.Output<number>;

Version of the Policy. Default version is 0.

Resource Service

class Service extends CustomResource

Allows management of a single API service for an existing Google Cloud Platform project.

For a list of services available, visit the API library page or run gcloud services list.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = new gcp.projects.Service("project", {
    disableDependentServices: true,
    project: "your-project-id",
    service: "iam.googleapis.com",
});

constructor

new Service(name: string, args: ServiceArgs, opts?: pulumi.CustomResourceOptions)

Create a Service resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServiceState, opts?: pulumi.CustomResourceOptions): Service

Get an existing Service resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is Service

Returns true if the given object is an instance of Service. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property disableDependentServices

public disableDependentServices: pulumi.Output<boolean | undefined>;

If true, services that are enabled and which depend on this service should also be disabled when this service is destroyed. If false or unset, an error will be generated if any enabled services depend on this service when destroying it.

property disableOnDestroy

public disableOnDestroy: pulumi.Output<boolean | undefined>;

If true, disable the service when the resource is destroyed. Defaults to true. May be useful in the event that a project is long-lived but the infrastructure running in that project changes frequently.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property project

public project: pulumi.Output<string>;

The project ID. If not provided, the provider project is used.

property service

public service: pulumi.Output<string>;

The service to enable.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource UsageExportBucket

class UsageExportBucket extends CustomResource

Allows creation and management of a Google Cloud Platform project.

Projects created with this resource must be associated with an Organization. See the Organization documentation for more details.

The service account used to run this provider when creating a gcp.organizations.Project resource must have roles/resourcemanager.projectCreator. See the Access Control for Organizations Using IAM doc for more information.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const myProject = new gcp.organizations.Project("myProject", {
    orgId: "1234567",
    projectId: "your-project-id",
});

constructor

new UsageExportBucket(name: string, args: UsageExportBucketArgs, opts?: pulumi.CustomResourceOptions)

Create a UsageExportBucket resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: UsageExportBucketState, opts?: pulumi.CustomResourceOptions): UsageExportBucket

Get an existing UsageExportBucket resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is UsageExportBucket

Returns true if the given object is an instance of UsageExportBucket. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property bucketName

public bucketName: pulumi.Output<string>;

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property prefix

public prefix: pulumi.Output<string | undefined>;

property project

public project: pulumi.Output<string>;

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Functions

Function getOrganizationPolicy

getOrganizationPolicy(args: GetOrganizationPolicyArgs, opts?: pulumi.InvokeOptions): Promise<GetOrganizationPolicyResult>

Allows management of Organization policies for a Google Project. For more information see the official documentation

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const policy = gcp.projects.getOrganizationPolicy({
    project: "project-id",
    constraint: "constraints/serviceuser.services",
});
export const version = policy.then(policy => policy.version);

Function getProject

getProject(args: GetProjectArgs, opts?: pulumi.InvokeOptions): Promise<GetProjectResult>

Retrieve information about a set of projects based on a filter. See the REST API for more details.

Example Usage - searching for projects about to be deleted in an org

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const my-org-projects = gcp.projects.getProject({
    filter: "parent.id:012345678910 lifecycleState:DELETE_REQUESTED",
});
const deletion-candidate = my_org_projects.then(my_org_projects => gcp.organizations.getProject({
    projectId: my_org_projects.projects[0].projectId,
}));

Others

interface GetOrganizationPolicyArgs

interface GetOrganizationPolicyArgs

A collection of arguments for invoking getOrganizationPolicy.

property constraint

constraint: string;

(Required) The name of the Constraint the Policy is configuring, for example, serviceuser.services. Check out the complete list of available constraints.

property project

project: string;

The project ID.

interface GetOrganizationPolicyResult

interface GetOrganizationPolicyResult

A collection of values returned by getOrganizationPolicy.

property booleanPolicies

booleanPolicies: GetOrganizationPolicyBooleanPolicy[];

property constraint

constraint: string;

property etag

etag: string;

property id

id: string;

The provider-assigned unique ID for this managed resource.

property listPolicies

listPolicies: GetOrganizationPolicyListPolicy[];

property project

project: string;

property restorePolicies

restorePolicies: GetOrganizationPolicyRestorePolicy[];

property updateTime

updateTime: string;

property version

version: number;

interface GetProjectArgs

interface GetProjectArgs

A collection of arguments for invoking getProject.

property filter

filter: string;

A string filter as defined in the REST API.

interface GetProjectResult

interface GetProjectResult

A collection of values returned by getProject.

property filter

filter: string;

property id

id: string;

The provider-assigned unique ID for this managed resource.

property projects

projects: GetProjectProject[];

A list of projects matching the provided filter. Structure is defined below.

interface IAMAuditConfigArgs

interface IAMAuditConfigArgs

The set of arguments for constructing a IAMAuditConfig resource.

property auditLogConfigs

auditLogConfigs: pulumi.Input<pulumi.Input<IAMAuditConfigAuditLogConfig>[]>;

The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.

property project

project?: pulumi.Input<string>;

property service

service: pulumi.Input<string>;

interface IAMAuditConfigState

interface IAMAuditConfigState

Input properties used for looking up and filtering IAMAuditConfig resources.

property auditLogConfigs

auditLogConfigs?: pulumi.Input<pulumi.Input<IAMAuditConfigAuditLogConfig>[]>;

The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.

property etag

etag?: pulumi.Input<string>;

(Computed) The etag of the project’s IAM policy.

property project

project?: pulumi.Input<string>;

property service

service?: pulumi.Input<string>;

interface IAMBindingArgs

interface IAMBindingArgs

The set of arguments for constructing a IAMBinding resource.

property condition

condition?: pulumi.Input<IAMBindingCondition>;

An IAM Condition for a given binding. Structure is documented below.

property members

members: pulumi.Input<pulumi.Input<string>[]>;

property project

project?: pulumi.Input<string>;

property role

role: pulumi.Input<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

interface IAMBindingState

interface IAMBindingState

Input properties used for looking up and filtering IAMBinding resources.

property condition

condition?: pulumi.Input<IAMBindingCondition>;

An IAM Condition for a given binding. Structure is documented below.

property etag

etag?: pulumi.Input<string>;

(Computed) The etag of the project’s IAM policy.

property members

members?: pulumi.Input<pulumi.Input<string>[]>;

property project

project?: pulumi.Input<string>;

property role

role?: pulumi.Input<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

interface IAMCustomRoleArgs

interface IAMCustomRoleArgs

The set of arguments for constructing a IAMCustomRole resource.

property description

description?: pulumi.Input<string>;

A human-readable description for the role.

property permissions

permissions: pulumi.Input<pulumi.Input<string>[]>;

The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.

property project

project?: pulumi.Input<string>;

The project that the service account will be created in. Defaults to the provider project configuration.

property roleId

roleId: pulumi.Input<string>;

The camel case role id to use for this role. Cannot contain - characters.

property stage

stage?: pulumi.Input<string>;

The current launch stage of the role. Defaults to GA. List of possible stages is here.

property title

title: pulumi.Input<string>;

A human-readable title for the role.

interface IAMCustomRoleState

interface IAMCustomRoleState

Input properties used for looking up and filtering IAMCustomRole resources.

property deleted

deleted?: pulumi.Input<boolean>;

(Optional) The current deleted state of the role.

property description

description?: pulumi.Input<string>;

A human-readable description for the role.

property name

name?: pulumi.Input<string>;

The name of the role in the format projects/{{project}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.

property permissions

permissions?: pulumi.Input<pulumi.Input<string>[]>;

The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.

property project

project?: pulumi.Input<string>;

The project that the service account will be created in. Defaults to the provider project configuration.

property roleId

roleId?: pulumi.Input<string>;

The camel case role id to use for this role. Cannot contain - characters.

property stage

stage?: pulumi.Input<string>;

The current launch stage of the role. Defaults to GA. List of possible stages is here.

property title

title?: pulumi.Input<string>;

A human-readable title for the role.

interface IAMMemberArgs

interface IAMMemberArgs

The set of arguments for constructing a IAMMember resource.

property condition

condition?: pulumi.Input<IAMMemberCondition>;

An IAM Condition for a given binding. Structure is documented below.

property member

member: pulumi.Input<string>;

property project

project?: pulumi.Input<string>;

property role

role: pulumi.Input<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

interface IAMMemberState

interface IAMMemberState

Input properties used for looking up and filtering IAMMember resources.

property condition

condition?: pulumi.Input<IAMMemberCondition>;

An IAM Condition for a given binding. Structure is documented below.

property etag

etag?: pulumi.Input<string>;

(Computed) The etag of the project’s IAM policy.

property member

member?: pulumi.Input<string>;

property project

project?: pulumi.Input<string>;

property role

role?: pulumi.Input<string>;

The role that should be applied. Only one gcp.projects.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

interface IAMPolicyArgs

interface IAMPolicyArgs

The set of arguments for constructing a IAMPolicy resource.

property policyData

policyData: pulumi.Input<string>;

The gcp.organizations.getIAMPolicy data source that represents the IAM policy that will be applied to the project. The policy will be merged with any existing policy applied to the project.

property project

project: pulumi.Input<string>;

interface IAMPolicyState

interface IAMPolicyState

Input properties used for looking up and filtering IAMPolicy resources.

property etag

etag?: pulumi.Input<string>;

(Computed) The etag of the project’s IAM policy.

property policyData

policyData?: pulumi.Input<string>;

The gcp.organizations.getIAMPolicy data source that represents the IAM policy that will be applied to the project. The policy will be merged with any existing policy applied to the project.

property project

project?: pulumi.Input<string>;

interface OrganizationPolicyArgs

interface OrganizationPolicyArgs

The set of arguments for constructing a OrganizationPolicy resource.

property booleanPolicy

booleanPolicy?: pulumi.Input<OrganizationPolicyBooleanPolicy>;

A boolean policy is a constraint that is either enforced or not. Structure is documented below.

property constraint

constraint: pulumi.Input<string>;

The name of the Constraint the Policy is configuring, for example, serviceuser.services. Check out the complete list of available constraints.

property listPolicy

listPolicy?: pulumi.Input<OrganizationPolicyListPolicy>;

A policy that can define specific values that are allowed or denied for the given constraint. It can also be used to allow or deny all values. Structure is documented below.

property project

project: pulumi.Input<string>;

The project id of the project to set the policy for.

property restorePolicy

restorePolicy?: pulumi.Input<OrganizationPolicyRestorePolicy>;

A restore policy is a constraint to restore the default policy. Structure is documented below.

property version

version?: pulumi.Input<number>;

Version of the Policy. Default version is 0.

interface OrganizationPolicyState

interface OrganizationPolicyState

Input properties used for looking up and filtering OrganizationPolicy resources.

property booleanPolicy

booleanPolicy?: pulumi.Input<OrganizationPolicyBooleanPolicy>;

A boolean policy is a constraint that is either enforced or not. Structure is documented below.

property constraint

constraint?: pulumi.Input<string>;

The name of the Constraint the Policy is configuring, for example, serviceuser.services. Check out the complete list of available constraints.

property etag

etag?: pulumi.Input<string>;

(Computed) The etag of the organization policy. etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other.

property listPolicy

listPolicy?: pulumi.Input<OrganizationPolicyListPolicy>;

A policy that can define specific values that are allowed or denied for the given constraint. It can also be used to allow or deny all values. Structure is documented below.

property project

project?: pulumi.Input<string>;

The project id of the project to set the policy for.

property restorePolicy

restorePolicy?: pulumi.Input<OrganizationPolicyRestorePolicy>;

A restore policy is a constraint to restore the default policy. Structure is documented below.

property updateTime

updateTime?: pulumi.Input<string>;

(Computed) The timestamp in RFC3339 UTC “Zulu” format, accurate to nanoseconds, representing when the variable was last updated. Example: “2016-10-09T12:33:37.578138407Z”.

property version

version?: pulumi.Input<number>;

Version of the Policy. Default version is 0.

interface ServiceArgs

interface ServiceArgs

The set of arguments for constructing a Service resource.

property disableDependentServices

disableDependentServices?: pulumi.Input<boolean>;

property disableOnDestroy

disableOnDestroy?: pulumi.Input<boolean>;

property project

project?: pulumi.Input<string>;

The project ID. If not provided, the provider project is used.

property service

service: pulumi.Input<string>;

The service to enable.

interface ServiceState

interface ServiceState

Input properties used for looking up and filtering Service resources.

property disableDependentServices

disableDependentServices?: pulumi.Input<boolean>;

property disableOnDestroy

disableOnDestroy?: pulumi.Input<boolean>;

property project

project?: pulumi.Input<string>;

The project ID. If not provided, the provider project is used.

property service

service?: pulumi.Input<string>;

The service to enable.

interface UsageExportBucketArgs

interface UsageExportBucketArgs

The set of arguments for constructing a UsageExportBucket resource.

property bucketName

bucketName: pulumi.Input<string>;

property prefix

prefix?: pulumi.Input<string>;

property project

project?: pulumi.Input<string>;

interface UsageExportBucketState

interface UsageExportBucketState

Input properties used for looking up and filtering UsageExportBucket resources.

property bucketName

bucketName?: pulumi.Input<string>;

property prefix

prefix?: pulumi.Input<string>;

property project

project?: pulumi.Input<string>;

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

Module projects

Resources

Functions

Others

Resources

google_project_iam_policy

google_project_iam_binding

google_project_iam_member

google_project_iam_audit_config

google_project_iam_policy

google_project_iam_binding

google_project_iam_member

google_project_iam_audit_config

Example Usage

google_project_iam_policy

google_project_iam_binding

google_project_iam_member

google_project_iam_audit_config

google_project_iam_policy

google_project_iam_binding

google_project_iam_member

google_project_iam_audit_config

Example Usage

Example Usage

Example Usage

Functions

Example Usage

Example Usage - searching for projects about to be deleted in an org

Others