Occurence class

An occurrence is an instance of a Note, or type of analysis that can be done for a resource.

To get more information about Occurrence, see:

• API documentation
• How-to Guides
• Official Documentation

Example Usage

Container Analysis Occurrence Kms

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as std from "@pulumi/std";

const note = new gcp.containeranalysis.Note("note", {
    name: "attestation-note",
    attestationAuthority: {
        hint: {
            humanReadableName: "Attestor Note",
        },
    },
});
const keyring = gcp.kms.getKMSKeyRing({
    name: "my-key-ring",
    location: "global",
});
const crypto_key = keyring.then(keyring => gcp.kms.getKMSCryptoKey({
    name: "my-key",
    keyRing: keyring.id,
}));
const version = crypto_key.then(crypto_key => gcp.kms.getKMSCryptoKeyVersion({
    cryptoKey: crypto_key.id,
}));
const attestor = new gcp.binaryauthorization.Attestor("attestor", {
    name: "attestor",
    attestationAuthorityNote: {
        noteReference: note.name,
        publicKeys: [{
            id: version.then(version => version.id),
            pkixPublicKey: {
                publicKeyPem: version.then(version => version.publicKeys?.[0]?.pem),
                signatureAlgorithm: version.then(version => version.publicKeys?.[0]?.algorithm),
            },
        }],
    },
});
const occurrence = new gcp.containeranalysis.Occurence("occurrence", {
    resourceUri: "gcr.io/my-project/my-image",
    noteName: note.id,
    attestation: {
        serializedPayload: std.filebase64({
            input: "path/to/my/payload.json",
        }).then(invoke => invoke.result),
        signatures: [{
            publicKeyId: version.then(version => version.id),
            serializedPayload: std.filebase64({
                input: "path/to/my/payload.json.sig",
            }).then(invoke => invoke.result),
        }],
    },
});

import pulumi
import pulumi_gcp as gcp
import pulumi_std as std

note = gcp.containeranalysis.Note("note",
    name="attestation-note",
    attestation_authority={
        "hint": {
            "human_readable_name": "Attestor Note",
        },
    })
keyring = gcp.kms.get_kms_key_ring(name="my-key-ring",
    location="global")
crypto_key = gcp.kms.get_kms_crypto_key(name="my-key",
    key_ring=keyring.id)
version = gcp.kms.get_kms_crypto_key_version(crypto_key=crypto_key.id)
attestor = gcp.binaryauthorization.Attestor("attestor",
    name="attestor",
    attestation_authority_note={
        "note_reference": note.name,
        "public_keys": [{
            "id": version.id,
            "pkix_public_key": {
                "public_key_pem": version.public_keys[0].pem,
                "signature_algorithm": version.public_keys[0].algorithm,
            },
        }],
    })
occurrence = gcp.containeranalysis.Occurence("occurrence",
    resource_uri="gcr.io/my-project/my-image",
    note_name=note.id,
    attestation={
        "serialized_payload": std.filebase64(input="path/to/my/payload.json").result,
        "signatures": [{
            "public_key_id": version.id,
            "serialized_payload": std.filebase64(input="path/to/my/payload.json.sig").result,
        }],
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() =>
{
    var note = new Gcp.ContainerAnalysis.Note("note", new()
    {
        Name = "attestation-note",
        AttestationAuthority = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityArgs
        {
            Hint = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityHintArgs
            {
                HumanReadableName = "Attestor Note",
            },
        },
    });

    var keyring = Gcp.Kms.GetKMSKeyRing.Invoke(new()
    {
        Name = "my-key-ring",
        Location = "global",
    });

    var crypto_key = Gcp.Kms.GetKMSCryptoKey.Invoke(new()
    {
        Name = "my-key",
        KeyRing = keyring.Apply(getKMSKeyRingResult => getKMSKeyRingResult.Id),
    });

    var version = Gcp.Kms.GetKMSCryptoKeyVersion.Invoke(new()
    {
        CryptoKey = crypto_key.Apply(getKMSCryptoKeyResult => getKMSCryptoKeyResult.Id),
    });

    var attestor = new Gcp.BinaryAuthorization.Attestor("attestor", new()
    {
        Name = "attestor",
        AttestationAuthorityNote = new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNoteArgs
        {
            NoteReference = note.Name,
            PublicKeys = new[]
            {
                new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNotePublicKeyArgs
                {
                    Id = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.Id),
                    PkixPublicKey = new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs
                    {
                        PublicKeyPem = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.PublicKeys[0]?.Pem),
                        SignatureAlgorithm = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.PublicKeys[0]?.Algorithm),
                    },
                },
            },
        },
    });

    var occurrence = new Gcp.ContainerAnalysis.Occurence("occurrence", new()
    {
        ResourceUri = "gcr.io/my-project/my-image",
        NoteName = note.Id,
        Attestation = new Gcp.ContainerAnalysis.Inputs.OccurenceAttestationArgs
        {
            SerializedPayload = Std.Filebase64.Invoke(new()
            {
                Input = "path/to/my/payload.json",
            }).Apply(invoke => invoke.Result),
            Signatures = new[]
            {
                new Gcp.ContainerAnalysis.Inputs.OccurenceAttestationSignatureArgs
                {
                    PublicKeyId = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.Id),
                    SerializedPayload = Std.Filebase64.Invoke(new()
                    {
                        Input = "path/to/my/payload.json.sig",
                    }).Apply(invoke => invoke.Result),
                },
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/binaryauthorization"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/containeranalysis"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		note, err := containeranalysis.NewNote(ctx, "note", &containeranalysis.NoteArgs{
			Name: pulumi.String("attestation-note"),
			AttestationAuthority: &containeranalysis.NoteAttestationAuthorityArgs{
				Hint: &containeranalysis.NoteAttestationAuthorityHintArgs{
					HumanReadableName: pulumi.String("Attestor Note"),
				},
			},
		})
		if err != nil {
			return err
		}
		keyring, err := kms.GetKMSKeyRing(ctx, &kms.GetKMSKeyRingArgs{
			Name:     "my-key-ring",
			Location: "global",
		}, nil)
		if err != nil {
			return err
		}
		crypto_key, err := kms.GetKMSCryptoKey(ctx, &kms.GetKMSCryptoKeyArgs{
			Name:    "my-key",
			KeyRing: keyring.Id,
		}, nil)
		if err != nil {
			return err
		}
		version, err := kms.GetKMSCryptoKeyVersion(ctx, &kms.GetKMSCryptoKeyVersionArgs{
			CryptoKey: crypto_key.Id,
		}, nil)
		if err != nil {
			return err
		}
		_, err = binaryauthorization.NewAttestor(ctx, "attestor", &binaryauthorization.AttestorArgs{
			Name: pulumi.String("attestor"),
			AttestationAuthorityNote: &binaryauthorization.AttestorAttestationAuthorityNoteArgs{
				NoteReference: note.Name,
				PublicKeys: binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArray{
					&binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArgs{
						Id: pulumi.String(version.Id),
						PkixPublicKey: &binaryauthorization.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs{
							PublicKeyPem:       pulumi.String(version.PublicKeys[0].Pem),
							SignatureAlgorithm: pulumi.String(version.PublicKeys[0].Algorithm),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "path/to/my/payload.json",
		}, nil)
		if err != nil {
			return err
		}
		invokeFilebase641, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "path/to/my/payload.json.sig",
		}, nil)
		if err != nil {
			return err
		}
		_, err = containeranalysis.NewOccurence(ctx, "occurrence", &containeranalysis.OccurenceArgs{
			ResourceUri: pulumi.String("gcr.io/my-project/my-image"),
			NoteName:    note.ID().ToIDOutput().ToStringOutput(),
			Attestation: &containeranalysis.OccurenceAttestationArgs{
				SerializedPayload: pulumi.String(invokeFilebase64.Result),
				Signatures: containeranalysis.OccurenceAttestationSignatureArray{
					&containeranalysis.OccurenceAttestationSignatureArgs{
						PublicKeyId:       pulumi.String(version.Id),
						SerializedPayload: invokeFilebase641.Result,
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
    std = {
      source = "pulumi/std"
    }
  }
}

data "gcp_kms_getkmskeyring" "keyring" {
  name     = "my-key-ring"
  location = "global"
}
data "gcp_kms_getkmscryptokey" "crypto-key" {
  name     = "my-key"
  key_ring = data.gcp_kms_getkmskeyring.keyring.id
}
data "gcp_kms_getkmscryptokeyversion" "version" {
  crypto_key = data.gcp_kms_getkmscryptokey.crypto-key.id
}

resource "gcp_binaryauthorization_attestor" "attestor" {
  name = "attestor"
  attestation_authority_note = {
    note_reference = gcp_containeranalysis_note.note.name
    public_keys = [{
      "id" = data.gcp_kms_getkmscryptokeyversion.version.id
      "pkixPublicKey" = {
        "publicKeyPem"       = data.gcp_kms_getkmscryptokeyversion.version.public_keys[0].pem
        "signatureAlgorithm" = data.gcp_kms_getkmscryptokeyversion.version.public_keys[0].algorithm
      }
    }]
  }
}
resource "gcp_containeranalysis_note" "note" {
  name = "attestation-note"
  attestation_authority = {
    hint = {
      human_readable_name = "Attestor Note"
    }
  }
}
resource "gcp_containeranalysis_occurence" "occurrence" {
  resource_uri = "gcr.io/my-project/my-image"
  note_name    = gcp_containeranalysis_note.note.id
  attestation = {
    serialized_payload = filebase64("path/to/my/payload.json")
    signatures = [{
      "publicKeyId"       = data.gcp_kms_getkmscryptokeyversion.version.id
      "serializedPayload" = filebase64("path/to/my/payload.json.sig")
    }]
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.containeranalysis.Note;
import com.pulumi.gcp.containeranalysis.NoteArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityHintArgs;
import com.pulumi.gcp.kms.KmsFunctions;
import com.pulumi.gcp.kms.inputs.GetKMSKeyRingArgs;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyArgs;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyVersionArgs;
import com.pulumi.gcp.binaryauthorization.Attestor;
import com.pulumi.gcp.binaryauthorization.AttestorArgs;
import com.pulumi.gcp.binaryauthorization.inputs.AttestorAttestationAuthorityNoteArgs;
import com.pulumi.gcp.binaryauthorization.inputs.AttestorAttestationAuthorityNotePublicKeyArgs;
import com.pulumi.gcp.binaryauthorization.inputs.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs;
import com.pulumi.gcp.containeranalysis.Occurence;
import com.pulumi.gcp.containeranalysis.OccurenceArgs;
import com.pulumi.gcp.containeranalysis.inputs.OccurenceAttestationArgs;
import com.pulumi.gcp.containeranalysis.inputs.OccurenceAttestationSignatureArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var note = new Note("note", NoteArgs.builder()
            .name("attestation-note")
            .attestationAuthority(NoteAttestationAuthorityArgs.builder()
                .hint(NoteAttestationAuthorityHintArgs.builder()
                    .humanReadableName("Attestor Note")
                    .build())
                .build())
            .build());

        final var keyring = KmsFunctions.getKMSKeyRing(GetKMSKeyRingArgs.builder()
            .name("my-key-ring")
            .location("global")
            .build());

        final var crypto-key = KmsFunctions.getKMSCryptoKey(GetKMSCryptoKeyArgs.builder()
            .name("my-key")
            .keyRing(keyring.id())
            .build());

        final var version = KmsFunctions.getKMSCryptoKeyVersion(GetKMSCryptoKeyVersionArgs.builder()
            .cryptoKey(crypto_key.id())
            .build());

        var attestor = new Attestor("attestor", AttestorArgs.builder()
            .name("attestor")
            .attestationAuthorityNote(AttestorAttestationAuthorityNoteArgs.builder()
                .noteReference(note.name())
                .publicKeys(AttestorAttestationAuthorityNotePublicKeyArgs.builder()
                    .id(version.id())
                    .pkixPublicKey(AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs.builder()
                        .publicKeyPem(version.publicKeys()[0].pem())
                        .signatureAlgorithm(version.publicKeys()[0].algorithm())
                        .build())
                    .build())
                .build())
            .build());

        var occurrence = new Occurence("occurrence", OccurenceArgs.builder()
            .resourceUri("gcr.io/my-project/my-image")
            .noteName(note.id())
            .attestation(OccurenceAttestationArgs.builder()
                .serializedPayload(StdFunctions.filebase64(Filebase64Args.builder()
                    .input("path/to/my/payload.json")
                    .build()).result())
                .signatures(OccurenceAttestationSignatureArgs.builder()
                    .publicKeyId(version.id())
                    .serializedPayload(StdFunctions.filebase64(Filebase64Args.builder()
                        .input("path/to/my/payload.json.sig")
                        .build()).result())
                    .build())
                .build())
            .build());

    }
}

resources:
  attestor:
    type: gcp:binaryauthorization:Attestor
    properties:
      name: attestor
      attestationAuthorityNote:
        noteReference: ${note.name}
        publicKeys:
          - id: ${version.id}
            pkixPublicKey:
              publicKeyPem: ${version.publicKeys[0].pem}
              signatureAlgorithm: ${version.publicKeys[0].algorithm}
  note:
    type: gcp:containeranalysis:Note
    properties:
      name: attestation-note
      attestationAuthority:
        hint:
          humanReadableName: Attestor Note
  occurrence:
    type: gcp:containeranalysis:Occurence
    properties:
      resourceUri: gcr.io/my-project/my-image
      noteName: ${note.id}
      attestation:
        serializedPayload:
          fn::invoke:
            function: std:filebase64
            arguments:
              input: path/to/my/payload.json
            return: result
        signatures:
          - publicKeyId: ${version.id}
            serializedPayload:
              fn::invoke:
                function: std:filebase64
                arguments:
                  input: path/to/my/payload.json.sig
                return: result
variables:
  keyring:
    fn::invoke:
      function: gcp:kms:getKMSKeyRing
      arguments:
        name: my-key-ring
        location: global
  crypto-key:
    fn::invoke:
      function: gcp:kms:getKMSCryptoKey
      arguments:
        name: my-key
        keyRing: ${keyring.id}
  version:
    fn::invoke:
      function: gcp:kms:getKMSCryptoKeyVersion
      arguments:
        cryptoKey: ${["crypto-key"].id}

Import

Occurrence can be imported using any of these accepted formats:

• projects/{{project}}/occurrences/{{name}}
• {{project}}/{{name}}
• {{name}}

When using the pulumi import command, Occurrence can be imported using one of the formats above. For example:

$ pulumi import gcp:containeranalysis/occurence:Occurence default projects/{{project}}/occurrences/{{name}}
$ pulumi import gcp:containeranalysis/occurence:Occurence default {{project}}/{{name}}
$ pulumi import gcp:containeranalysis/occurence:Occurence default {{name}}

Constructors

Occurence(String name, {OccurenceArgs? args, CustomResourceOptions? options})

Creates a new Occurence. name The Pulumi resource name. args Arguments used to configure this Occurence. The set of arguments for Occurence. options Resource options controlling this resource's behavior.

Occurence.reference(String urn)

Creates a typed reference to an existing Occurence resource.

Properties

attestation ↔ Output<OccurenceAttestation>

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for lookup (how to find this attestation if you already know the authority and artifact to be verified) and intent (for which authority this attestation was intended to sign. Structure is documented below.

late, final

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

createTime ↔ Output<String>

The time when the repository was created.

late, final

deletionPolicy ↔ Output<String>

Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

kind ↔ Output<String>

The note kind which explicitly denotes which of the occurrence details are specified. This field can be used as a filter in list requests.

late, final

name ↔ Output<String>

The name of the occurrence.

late, final

noteName ↔ Output<String>

The analysis note associated with this occurrence, in the form of projects/PROJECT/notes/NOTE_ID. This field can be used as a filter in list requests.

late, final

project ↔ Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

late, final

remediation ↔ Output<String?>

A description of actions that can be taken to remedy the note.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

resourceUri ↔ Output<String>

Required. Immutable. A URI that represents the resource for which the occurrence applies. For example, https://gcr.io/project/image@sha256:123abc for a Docker image.

late, final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

updateTime ↔ Output<String>

The time when the repository was last updated.

late, final

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {OccurenceState? state, CustomResourceOptions? options}) → Occurence

Gets an existing Occurence resource's state with the given name and id.