ServiceIdentity class

Generate folder service identity for a service.

> Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider. See Provider Versions for more details on beta resources.

> Note: Once created, this resource cannot be updated or destroyed. These actions are a no-op.

> Note: This resource can be used to retrieve the emails of the Google-managed folder service accounts of the APIs that Google has configured with a Service Identity. You can run gcloud beta services identity create --service SERVICE_NAME.googleapis.com --folder FOLDER to verify if an API supports this.

To get more information about Service Identity, see:

• API documentation

Example Usage

Folder Service Identity Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const myFolder = new gcp.organizations.Folder("my_folder", {
    parent: "organizations/1234567",
    displayName: "my-folder",
});
const osconfigSa = new gcp.folder.ServiceIdentity("osconfig_sa", {
    folder: myFolder.folderId,
    service: "osconfig.googleapis.com",
});
const admin = new gcp.folder.IAMMember("admin", {
    folder: myFolder.name,
    role: "roles/osconfig.serviceAgent",
    member: osconfigSa.member,
});

import pulumi
import pulumi_gcp as gcp

my_folder = gcp.organizations.Folder("my_folder",
    parent="organizations/1234567",
    display_name="my-folder")
osconfig_sa = gcp.folder.ServiceIdentity("osconfig_sa",
    folder=my_folder.folder_id,
    service="osconfig.googleapis.com")
admin = gcp.folder.IAMMember("admin",
    folder=my_folder.name,
    role="roles/osconfig.serviceAgent",
    member=osconfig_sa.member)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var myFolder = new Gcp.Organizations.Folder("my_folder", new()
    {
        Parent = "organizations/1234567",
        DisplayName = "my-folder",
    });

    var osconfigSa = new Gcp.Folder.ServiceIdentity("osconfig_sa", new()
    {
        Folder = myFolder.FolderId,
        Service = "osconfig.googleapis.com",
    });

    var admin = new Gcp.Folder.IAMMember("admin", new()
    {
        Folder = myFolder.Name,
        Role = "roles/osconfig.serviceAgent",
        Member = osconfigSa.Member,
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/folder"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		myFolder, err := organizations.NewFolder(ctx, "my_folder", &organizations.FolderArgs{
			Parent:      pulumi.String("organizations/1234567"),
			DisplayName: pulumi.String("my-folder"),
		})
		if err != nil {
			return err
		}
		osconfigSa, err := folder.NewServiceIdentity(ctx, "osconfig_sa", &folder.ServiceIdentityArgs{
			Folder:  myFolder.FolderId,
			Service: pulumi.String("osconfig.googleapis.com"),
		})
		if err != nil {
			return err
		}
		_, err = folder.NewIAMMember(ctx, "admin", &folder.IAMMemberArgs{
			Folder: myFolder.Name,
			Role:   pulumi.String("roles/osconfig.serviceAgent"),
			Member: osconfigSa.Member,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_organizations_folder" "my_folder" {
  parent       = "organizations/1234567"
  display_name = "my-folder"
}
resource "gcp_folder_serviceidentity" "osconfig_sa" {
  folder  = gcp_organizations_folder.my_folder.folder_id
  service = "osconfig.googleapis.com"
}
resource "gcp_folder_iammember" "admin" {
  folder = gcp_organizations_folder.my_folder.name
  role   = "roles/osconfig.serviceAgent"
  member = gcp_folder_serviceidentity.osconfig_sa.member
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Folder;
import com.pulumi.gcp.organizations.FolderArgs;
import com.pulumi.gcp.folder.ServiceIdentity;
import com.pulumi.gcp.folder.ServiceIdentityArgs;
import com.pulumi.gcp.folder.IAMMember;
import com.pulumi.gcp.folder.IAMMemberArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var myFolder = new Folder("myFolder", FolderArgs.builder()
            .parent("organizations/1234567")
            .displayName("my-folder")
            .build());

        var osconfigSa = new ServiceIdentity("osconfigSa", ServiceIdentityArgs.builder()
            .folder(myFolder.folderId())
            .service("osconfig.googleapis.com")
            .build());

        var admin = new IAMMember("admin", IAMMemberArgs.builder()
            .folder(myFolder.name())
            .role("roles/osconfig.serviceAgent")
            .member(osconfigSa.member())
            .build());

    }
}

resources:
  myFolder:
    type: gcp:organizations:Folder
    name: my_folder
    properties:
      parent: organizations/1234567
      displayName: my-folder
  osconfigSa:
    type: gcp:folder:ServiceIdentity
    name: osconfig_sa
    properties:
      folder: ${myFolder.folderId}
      service: osconfig.googleapis.com
  admin:
    type: gcp:folder:IAMMember
    properties:
      folder: ${myFolder.name}
      role: roles/osconfig.serviceAgent
      member: ${osconfigSa.member}

Import

This resource does not support import.

Constructors

ServiceIdentity(String name, {ServiceIdentityArgs? args, CustomResourceOptions? options})

Creates a new ServiceIdentity. name The Pulumi resource name. args Arguments used to configure this ServiceIdentity. The set of arguments for ServiceIdentity. options Resource options controlling this resource's behavior.

ServiceIdentity.reference(String urn)

Creates a typed reference to an existing ServiceIdentity resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

email ↔ Output<String>

The email address of the Google managed service account.

late, final

folder ↔ Output<String>

The folder in which the resource belongs.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

member ↔ Output<String>

The Identity of the Google managed service account in the form 'serviceAccount:{email}'. This value is often used to refer to the service account in order to grant IAM permissions.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

service ↔ Output<String>

The service to generate identity for.

late, final

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {ServiceIdentityState? state, CustomResourceOptions? options}) → ServiceIdentity

Gets an existing ServiceIdentity resource's state with the given name and id.