WorkloadIdentityPool class
Represents a collection of external workload identities. You can define IAM policies to grant these identities access to Google Cloud resources.
To get more information about WorkloadIdentityPool, see:
- API documentation
- How-to Guides
- Configure managed workload identity authentication for Compute Engine
- Configure managed workload identity authentication for GKE
- Managing workload identity pools
Example Usage
Iam Workload Identity Pool Basic
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const example = new gcp.iam.WorkloadIdentityPool("example", {workloadIdentityPoolId: "example-pool"});
import pulumi
import pulumi_gcp as gcp
example = gcp.iam.WorkloadIdentityPool("example", workload_identity_pool_id="example-pool")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var example = new Gcp.Iam.WorkloadIdentityPool("example", new()
{
WorkloadIdentityPoolId = "example-pool",
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
WorkloadIdentityPoolId: pulumi.String("example-pool"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_iam_workloadidentitypool" "example" {
workload_identity_pool_id = "example-pool"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new WorkloadIdentityPool("example", WorkloadIdentityPoolArgs.builder()
.workloadIdentityPoolId("example-pool")
.build());
}
}
resources:
example:
type: gcp:iam:WorkloadIdentityPool
properties:
workloadIdentityPoolId: example-pool
Iam Workload Identity Pool Full Federation Only Mode
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const example = new gcp.iam.WorkloadIdentityPool("example", {
workloadIdentityPoolId: "example-pool",
displayName: "Name of the pool",
description: "Identity pool operates in FEDERATION_ONLY mode",
disabled: true,
mode: "FEDERATION_ONLY",
});
import pulumi
import pulumi_gcp as gcp
example = gcp.iam.WorkloadIdentityPool("example",
workload_identity_pool_id="example-pool",
display_name="Name of the pool",
description="Identity pool operates in FEDERATION_ONLY mode",
disabled=True,
mode="FEDERATION_ONLY")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var example = new Gcp.Iam.WorkloadIdentityPool("example", new()
{
WorkloadIdentityPoolId = "example-pool",
DisplayName = "Name of the pool",
Description = "Identity pool operates in FEDERATION_ONLY mode",
Disabled = true,
Mode = "FEDERATION_ONLY",
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
WorkloadIdentityPoolId: pulumi.String("example-pool"),
DisplayName: pulumi.String("Name of the pool"),
Description: pulumi.String("Identity pool operates in FEDERATION_ONLY mode"),
Disabled: pulumi.Bool(true),
Mode: pulumi.String("FEDERATION_ONLY"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_iam_workloadidentitypool" "example" {
workload_identity_pool_id = "example-pool"
display_name = "Name of the pool"
description = "Identity pool operates in FEDERATION_ONLY mode"
disabled = true
mode = "FEDERATION_ONLY"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new WorkloadIdentityPool("example", WorkloadIdentityPoolArgs.builder()
.workloadIdentityPoolId("example-pool")
.displayName("Name of the pool")
.description("Identity pool operates in FEDERATION_ONLY mode")
.disabled(true)
.mode("FEDERATION_ONLY")
.build());
}
}
resources:
example:
type: gcp:iam:WorkloadIdentityPool
properties:
workloadIdentityPoolId: example-pool
displayName: Name of the pool
description: Identity pool operates in FEDERATION_ONLY mode
disabled: true
mode: FEDERATION_ONLY
Iam Workload Identity Pool Full Trust Domain Mode
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as std from "@pulumi/std";
const example = new gcp.iam.WorkloadIdentityPool("example", {
workloadIdentityPoolId: "example-pool",
displayName: "Name of the pool",
description: "Identity pool operates in TRUST_DOMAIN mode",
disabled: true,
mode: "TRUST_DOMAIN",
inlineCertificateIssuanceConfig: {
caPools: {
"us-central1": "projects/project-bar/locations/us-central1/caPools/ca-pool-bar",
"asia-east2": "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo",
},
lifetime: "86400s",
rotationWindowPercentage: 50,
keyAlgorithm: "ECDSA_P256",
},
inlineTrustConfig: {
additionalTrustBundles: [
{
trustDomain: "example.com",
trustDefaultSharedCa: false,
trustAnchors: [
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_1.pem",
}).then(invoke => invoke.result),
},
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_2.pem",
}).then(invoke => invoke.result),
},
],
},
{
trustDomain: "example.net",
trustDefaultSharedCa: false,
trustAnchors: [
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_3.pem",
}).then(invoke => invoke.result),
},
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_4.pem",
}).then(invoke => invoke.result),
},
],
},
],
},
attestationRules: [{
googleCloudResource: "//run.googleapis.com/projects/1111111111111/type/Service/*",
}],
});
import pulumi
import pulumi_gcp as gcp
import pulumi_std as std
example = gcp.iam.WorkloadIdentityPool("example",
workload_identity_pool_id="example-pool",
display_name="Name of the pool",
description="Identity pool operates in TRUST_DOMAIN mode",
disabled=True,
mode="TRUST_DOMAIN",
inline_certificate_issuance_config={
"ca_pools": {
"us-central1": "projects/project-bar/locations/us-central1/caPools/ca-pool-bar",
"asia-east2": "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo",
},
"lifetime": "86400s",
"rotation_window_percentage": 50,
"key_algorithm": "ECDSA_P256",
},
inline_trust_config={
"additional_trust_bundles": [
{
"trust_domain": "example.com",
"trust_default_shared_ca": False,
"trust_anchors": [
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_1.pem").result,
},
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_2.pem").result,
},
],
},
{
"trust_domain": "example.net",
"trust_default_shared_ca": False,
"trust_anchors": [
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_3.pem").result,
},
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_4.pem").result,
},
],
},
],
},
attestation_rules=[{
"google_cloud_resource": "//run.googleapis.com/projects/1111111111111/type/Service/*",
}])
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Std = Pulumi.Std;
return await Deployment.RunAsync(() =>
{
var example = new Gcp.Iam.WorkloadIdentityPool("example", new()
{
WorkloadIdentityPoolId = "example-pool",
DisplayName = "Name of the pool",
Description = "Identity pool operates in TRUST_DOMAIN mode",
Disabled = true,
Mode = "TRUST_DOMAIN",
InlineCertificateIssuanceConfig = new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs
{
CaPools =
{
{ "us-central1", "projects/project-bar/locations/us-central1/caPools/ca-pool-bar" },
{ "asia-east2", "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo" },
},
Lifetime = "86400s",
RotationWindowPercentage = 50,
KeyAlgorithm = "ECDSA_P256",
},
InlineTrustConfig = new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigArgs
{
AdditionalTrustBundles = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs
{
TrustDomain = "example.com",
TrustDefaultSharedCa = false,
TrustAnchors = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_1.pem",
}).Apply(invoke => invoke.Result),
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_2.pem",
}).Apply(invoke => invoke.Result),
},
},
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs
{
TrustDomain = "example.net",
TrustDefaultSharedCa = false,
TrustAnchors = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_3.pem",
}).Apply(invoke => invoke.Result),
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_4.pem",
}).Apply(invoke => invoke.Result),
},
},
},
},
},
AttestationRules = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolAttestationRuleArgs
{
GoogleCloudResource = "//run.googleapis.com/projects/1111111111111/type/Service/*",
},
},
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
"github.com/pulumi/pulumi-std/sdk/go/std"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
invokeFile, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_1.pem",
}, nil)
if err != nil {
return err
}
invokeFile1, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_2.pem",
}, nil)
if err != nil {
return err
}
invokeFile2, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_3.pem",
}, nil)
if err != nil {
return err
}
invokeFile3, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_4.pem",
}, nil)
if err != nil {
return err
}
_, err = iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
WorkloadIdentityPoolId: pulumi.String("example-pool"),
DisplayName: pulumi.String("Name of the pool"),
Description: pulumi.String("Identity pool operates in TRUST_DOMAIN mode"),
Disabled: pulumi.Bool(true),
Mode: pulumi.String("TRUST_DOMAIN"),
InlineCertificateIssuanceConfig: &iam.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs{
CaPools: pulumi.StringMap{
"us-central1": pulumi.String("projects/project-bar/locations/us-central1/caPools/ca-pool-bar"),
"asia-east2": pulumi.String("projects/project-foo/locations/asia-east2/caPools/ca-pool-foo"),
},
Lifetime: pulumi.String("86400s"),
RotationWindowPercentage: pulumi.Int(50),
KeyAlgorithm: pulumi.String("ECDSA_P256"),
},
InlineTrustConfig: &iam.WorkloadIdentityPoolInlineTrustConfigArgs{
AdditionalTrustBundles: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs{
TrustDomain: pulumi.String("example.com"),
TrustDefaultSharedCa: pulumi.Bool(false),
TrustAnchors: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile.Result),
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile1.Result),
},
},
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs{
TrustDomain: pulumi.String("example.net"),
TrustDefaultSharedCa: pulumi.Bool(false),
TrustAnchors: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile2.Result),
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile3.Result),
},
},
},
},
},
AttestationRules: iam.WorkloadIdentityPoolAttestationRuleArray{
&iam.WorkloadIdentityPoolAttestationRuleArgs{
GoogleCloudResource: pulumi.String("//run.googleapis.com/projects/1111111111111/type/Service/*"),
},
},
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
std = {
source = "pulumi/std"
}
}
}
resource "gcp_iam_workloadidentitypool" "example" {
workload_identity_pool_id = "example-pool"
display_name = "Name of the pool"
description = "Identity pool operates in TRUST_DOMAIN mode"
disabled = true
mode = "TRUST_DOMAIN"
inline_certificate_issuance_config = {
ca_pools = {
"us-central1" = "projects/project-bar/locations/us-central1/caPools/ca-pool-bar"
"asia-east2" = "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo"
}
lifetime = "86400s"
rotation_window_percentage = 50
key_algorithm = "ECDSA_P256"
}
inline_trust_config = {
additional_trust_bundles = [{
"trustDomain" = "example.com"
"trustDefaultSharedCa" = false
"trustAnchors" = [{
"pemCertificate" = file("test-fixtures/trust_anchor_1.pem")
}, {
"pemCertificate" = file("test-fixtures/trust_anchor_2.pem")
}]
}, {
"trustDomain" = "example.net"
"trustDefaultSharedCa" = false
"trustAnchors" = [{
"pemCertificate" = file("test-fixtures/trust_anchor_3.pem")
}, {
"pemCertificate" = file("test-fixtures/trust_anchor_4.pem")
}]
}]
}
attestation_rules {
google_cloud_resource = "//run.googleapis.com/projects/1111111111111/type/Service/*"
}
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolAttestationRuleArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new WorkloadIdentityPool("example", WorkloadIdentityPoolArgs.builder()
.workloadIdentityPoolId("example-pool")
.displayName("Name of the pool")
.description("Identity pool operates in TRUST_DOMAIN mode")
.disabled(true)
.mode("TRUST_DOMAIN")
.inlineCertificateIssuanceConfig(WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs.builder()
.caPools(Map.ofEntries(
Map.entry("us-central1", "projects/project-bar/locations/us-central1/caPools/ca-pool-bar"),
Map.entry("asia-east2", "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo")
))
.lifetime("86400s")
.rotationWindowPercentage(50)
.keyAlgorithm("ECDSA_P256")
.build())
.inlineTrustConfig(WorkloadIdentityPoolInlineTrustConfigArgs.builder()
.additionalTrustBundles(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs.builder()
.trustDomain("example.com")
.trustDefaultSharedCa(false)
.trustAnchors(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_1.pem")
.build()).result())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_2.pem")
.build()).result())
.build())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs.builder()
.trustDomain("example.net")
.trustDefaultSharedCa(false)
.trustAnchors(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_3.pem")
.build()).result())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_4.pem")
.build()).result())
.build())
.build())
.build())
.attestationRules(WorkloadIdentityPoolAttestationRuleArgs.builder()
.googleCloudResource("//run.googleapis.com/projects/1111111111111/type/Service/*")
.build())
.build());
}
}
resources:
example:
type: gcp:iam:WorkloadIdentityPool
properties:
workloadIdentityPoolId: example-pool
displayName: Name of the pool
description: Identity pool operates in TRUST_DOMAIN mode
disabled: true
mode: TRUST_DOMAIN
inlineCertificateIssuanceConfig:
caPools:
us-central1: projects/project-bar/locations/us-central1/caPools/ca-pool-bar
asia-east2: projects/project-foo/locations/asia-east2/caPools/ca-pool-foo
lifetime: 86400s
rotationWindowPercentage: 50
keyAlgorithm: ECDSA_P256
inlineTrustConfig:
additionalTrustBundles:
- trustDomain: example.com
trustDefaultSharedCa: false
trustAnchors:
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_1.pem
return: result
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_2.pem
return: result
- trustDomain: example.net
trustDefaultSharedCa: false
trustAnchors:
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_3.pem
return: result
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_4.pem
return: result
attestationRules:
- googleCloudResource: //run.googleapis.com/projects/1111111111111/type/Service/*
Iam Workload Identity Pool Full Trust Domain Mode With Default Shared Ca
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as std from "@pulumi/std";
const example = new gcp.iam.WorkloadIdentityPool("example", {
workloadIdentityPoolId: "example-pool",
displayName: "Name of the pool",
description: "Identity pool operates in TRUST_DOMAIN mode",
disabled: true,
mode: "TRUST_DOMAIN",
inlineCertificateIssuanceConfig: {
useDefaultSharedCa: true,
lifetime: "86400s",
rotationWindowPercentage: 50,
keyAlgorithm: "ECDSA_P256",
},
inlineTrustConfig: {
additionalTrustBundles: [
{
trustDomain: "example.com",
trustDefaultSharedCa: true,
trustAnchors: [
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_1.pem",
}).then(invoke => invoke.result),
},
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_2.pem",
}).then(invoke => invoke.result),
},
],
},
{
trustDomain: "example.net",
trustDefaultSharedCa: true,
trustAnchors: [
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_3.pem",
}).then(invoke => invoke.result),
},
{
pemCertificate: std.file({
input: "test-fixtures/trust_anchor_4.pem",
}).then(invoke => invoke.result),
},
],
},
],
},
});
import pulumi
import pulumi_gcp as gcp
import pulumi_std as std
example = gcp.iam.WorkloadIdentityPool("example",
workload_identity_pool_id="example-pool",
display_name="Name of the pool",
description="Identity pool operates in TRUST_DOMAIN mode",
disabled=True,
mode="TRUST_DOMAIN",
inline_certificate_issuance_config={
"use_default_shared_ca": True,
"lifetime": "86400s",
"rotation_window_percentage": 50,
"key_algorithm": "ECDSA_P256",
},
inline_trust_config={
"additional_trust_bundles": [
{
"trust_domain": "example.com",
"trust_default_shared_ca": True,
"trust_anchors": [
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_1.pem").result,
},
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_2.pem").result,
},
],
},
{
"trust_domain": "example.net",
"trust_default_shared_ca": True,
"trust_anchors": [
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_3.pem").result,
},
{
"pem_certificate": std.file(input="test-fixtures/trust_anchor_4.pem").result,
},
],
},
],
})
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Std = Pulumi.Std;
return await Deployment.RunAsync(() =>
{
var example = new Gcp.Iam.WorkloadIdentityPool("example", new()
{
WorkloadIdentityPoolId = "example-pool",
DisplayName = "Name of the pool",
Description = "Identity pool operates in TRUST_DOMAIN mode",
Disabled = true,
Mode = "TRUST_DOMAIN",
InlineCertificateIssuanceConfig = new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs
{
UseDefaultSharedCa = true,
Lifetime = "86400s",
RotationWindowPercentage = 50,
KeyAlgorithm = "ECDSA_P256",
},
InlineTrustConfig = new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigArgs
{
AdditionalTrustBundles = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs
{
TrustDomain = "example.com",
TrustDefaultSharedCa = true,
TrustAnchors = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_1.pem",
}).Apply(invoke => invoke.Result),
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_2.pem",
}).Apply(invoke => invoke.Result),
},
},
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs
{
TrustDomain = "example.net",
TrustDefaultSharedCa = true,
TrustAnchors = new[]
{
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_3.pem",
}).Apply(invoke => invoke.Result),
},
new Gcp.Iam.Inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/trust_anchor_4.pem",
}).Apply(invoke => invoke.Result),
},
},
},
},
},
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
"github.com/pulumi/pulumi-std/sdk/go/std"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
invokeFile, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_1.pem",
}, nil)
if err != nil {
return err
}
invokeFile1, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_2.pem",
}, nil)
if err != nil {
return err
}
invokeFile2, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_3.pem",
}, nil)
if err != nil {
return err
}
invokeFile3, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/trust_anchor_4.pem",
}, nil)
if err != nil {
return err
}
_, err = iam.NewWorkloadIdentityPool(ctx, "example", &iam.WorkloadIdentityPoolArgs{
WorkloadIdentityPoolId: pulumi.String("example-pool"),
DisplayName: pulumi.String("Name of the pool"),
Description: pulumi.String("Identity pool operates in TRUST_DOMAIN mode"),
Disabled: pulumi.Bool(true),
Mode: pulumi.String("TRUST_DOMAIN"),
InlineCertificateIssuanceConfig: &iam.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs{
UseDefaultSharedCa: pulumi.Bool(true),
Lifetime: pulumi.String("86400s"),
RotationWindowPercentage: pulumi.Int(50),
KeyAlgorithm: pulumi.String("ECDSA_P256"),
},
InlineTrustConfig: &iam.WorkloadIdentityPoolInlineTrustConfigArgs{
AdditionalTrustBundles: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs{
TrustDomain: pulumi.String("example.com"),
TrustDefaultSharedCa: pulumi.Bool(true),
TrustAnchors: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile.Result),
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile1.Result),
},
},
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs{
TrustDomain: pulumi.String("example.net"),
TrustDefaultSharedCa: pulumi.Bool(true),
TrustAnchors: iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArray{
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile2.Result),
},
&iam.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs{
PemCertificate: pulumi.String(invokeFile3.Result),
},
},
},
},
},
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
std = {
source = "pulumi/std"
}
}
}
resource "gcp_iam_workloadidentitypool" "example" {
workload_identity_pool_id = "example-pool"
display_name = "Name of the pool"
description = "Identity pool operates in TRUST_DOMAIN mode"
disabled = true
mode = "TRUST_DOMAIN"
inline_certificate_issuance_config = {
use_default_shared_ca = true
lifetime = "86400s"
rotation_window_percentage = 50
key_algorithm = "ECDSA_P256"
}
inline_trust_config = {
additional_trust_bundles = [{
"trustDomain" = "example.com"
"trustDefaultSharedCa" = true
"trustAnchors" = [{
"pemCertificate" = file("test-fixtures/trust_anchor_1.pem")
}, {
"pemCertificate" = file("test-fixtures/trust_anchor_2.pem")
}]
}, {
"trustDomain" = "example.net"
"trustDefaultSharedCa" = true
"trustAnchors" = [{
"pemCertificate" = file("test-fixtures/trust_anchor_3.pem")
}, {
"pemCertificate" = file("test-fixtures/trust_anchor_4.pem")
}]
}]
}
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new WorkloadIdentityPool("example", WorkloadIdentityPoolArgs.builder()
.workloadIdentityPoolId("example-pool")
.displayName("Name of the pool")
.description("Identity pool operates in TRUST_DOMAIN mode")
.disabled(true)
.mode("TRUST_DOMAIN")
.inlineCertificateIssuanceConfig(WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs.builder()
.useDefaultSharedCa(true)
.lifetime("86400s")
.rotationWindowPercentage(50)
.keyAlgorithm("ECDSA_P256")
.build())
.inlineTrustConfig(WorkloadIdentityPoolInlineTrustConfigArgs.builder()
.additionalTrustBundles(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs.builder()
.trustDomain("example.com")
.trustDefaultSharedCa(true)
.trustAnchors(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_1.pem")
.build()).result())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_2.pem")
.build()).result())
.build())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleArgs.builder()
.trustDomain("example.net")
.trustDefaultSharedCa(true)
.trustAnchors(
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_3.pem")
.build()).result())
.build(),
WorkloadIdentityPoolInlineTrustConfigAdditionalTrustBundleTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/trust_anchor_4.pem")
.build()).result())
.build())
.build())
.build())
.build());
}
}
resources:
example:
type: gcp:iam:WorkloadIdentityPool
properties:
workloadIdentityPoolId: example-pool
displayName: Name of the pool
description: Identity pool operates in TRUST_DOMAIN mode
disabled: true
mode: TRUST_DOMAIN
inlineCertificateIssuanceConfig:
useDefaultSharedCa: true
lifetime: 86400s
rotationWindowPercentage: 50
keyAlgorithm: ECDSA_P256
inlineTrustConfig:
additionalTrustBundles:
- trustDomain: example.com
trustDefaultSharedCa: true
trustAnchors:
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_1.pem
return: result
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_2.pem
return: result
- trustDomain: example.net
trustDefaultSharedCa: true
trustAnchors:
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_3.pem
return: result
- pemCertificate:
fn::invoke:
function: std:file
arguments:
input: test-fixtures/trust_anchor_4.pem
return: result
Import
WorkloadIdentityPool can be imported using any of these accepted formats:
projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}{{project}}/{{workload_identity_pool_id}}{{workload_identity_pool_id}}
When using the pulumi import command, WorkloadIdentityPool can be imported using one of the formats above. For example:
$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}
$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default {{project}}/{{workload_identity_pool_id}}
$ pulumi import gcp:iam/workloadIdentityPool:WorkloadIdentityPool default {{workload_identity_pool_id}}
Constructors
- WorkloadIdentityPool(String name, {WorkloadIdentityPoolArgs? args, CustomResourceOptions? options})
-
Creates a new WorkloadIdentityPool.
nameThe Pulumi resource name.argsArguments used to configure this WorkloadIdentityPool. The set of arguments for WorkloadIdentityPool.optionsResource options controlling this resource's behavior. - WorkloadIdentityPool.reference(String urn)
- Creates a typed reference to an existing WorkloadIdentityPool resource.
Properties
-
attestationRules
↔ Output<
List< WorkloadIdentityPoolAttestationRule> ?> -
Defines which workloads can receive an identity within a pool. When an AttestationRule is
defined under a managed identity, matching workloads may receive that identity. A maximum of
50 AttestationRules can be set.
Structure is documented below.
latefinal
-
childResources
→ Set<
Resource> -
finalinherited
-
completionSources
↔ Map<
String, IOutputCompletionSource> -
latefinalinherited
-
deletionPolicy
↔ Output<
String> -
Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
When a 'terraform destroy' or 'pulumi up' would delete the resource,
the command will fail if this field is set to "PREVENT" in Terraform state.
When set to "ABANDON", the command will remove the resource from Terraform
management without updating or deleting the resource in the API.
When set to "DELETE", deleting the resource is allowed.
latefinal
-
description
↔ Output<
String?> -
A description of the pool. Cannot exceed 256 characters.
latefinal
-
disabled
↔ Output<
bool?> -
Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use
existing tokens to access resources. If the pool is re-enabled, existing tokens grant
access again.
latefinal
-
displayName
↔ Output<
String?> -
A display name for the pool. Cannot exceed 32 characters.
latefinal
- hashCode → int
-
The hash code for this object.
no setterinherited
-
id
↔ Output<
String> -
getter/setter pairinherited
-
inlineCertificateIssuanceConfig
↔ Output<
WorkloadIdentityPoolInlineCertificateIssuanceConfig?> -
Represents configuration for generating mutual TLS (mTLS) certificates for the identities
within this pool. Defines the Certificate Authority (CA) pool resources and configurations
required for issuance and rotation of mTLS workload certificates.
Structure is documented below.
latefinal
-
inlineTrustConfig
↔ Output<
WorkloadIdentityPoolInlineTrustConfig?> -
Represents config to add additional trusted trust domains. Defines configuration for extending
trust to additional trust domains. By establishing trust with another domain, the current
domain will recognize and accept certificates issued by entities within the trusted domains.
Note that a trust domain automatically trusts itself, eliminating the need for explicit
configuration.
Structure is documented below.
latefinal
- isCustom → bool
-
Returns whether this resource is provider-managed.
no setterinherited
- isProtected → bool
-
Returns whether this resource is protected from deletion.
no setterinherited
- isRemote → bool
-
Whether this resource is registered as remote.
no setterinherited
- isResourceReference → bool
-
Whether this instance represents a resource value returned over RPC.
finalinherited
-
mode
↔ Output<
String> -
The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
are in
FEDERATION_ONLYmode. > Note This field cannot be changed after the Workload Identity Pool is created. Whilepulumi previewmay show an update if you change this field's value,pulumi upwill fail with an API error (such asError 400: Attempted to update an immutable field.). To specify a differentmode, please create a new Workload Identity Pool resource.latefinal -
name
↔ Output<
String> -
The resource name of the pool as
projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}.latefinal -
project
↔ Output<
String> -
The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.
latefinal
-
resourceTransforms
→ List<
ResourceTransform> -
Inherited/explicit async transforms.
no setterinherited
- runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
-
state
↔ Output<
String> -
The state of the pool.
latefinal
-
transformations
→ List<
ResourceTransformation> -
Inherited/explicit legacy transformations.
no setterinherited
-
urn
↔ Output<
String> -
latefinalinherited
-
workloadIdentityPoolId
↔ Output<
String> -
The ID to use for the pool, which becomes the final component of the resource name. This
value should be 4-32 characters, and may contain the characters
a-z0-9-. The prefixgcp-is reserved for use by Google, and may not be specified.latefinal
Methods
-
failId(
Object error) → void -
Completes this resource ID with an error when registration fails.
inherited
-
failOutputs(
Object error) → void -
Completes all output properties with
error.inherited -
failUrn(
Object error) → void -
Completes this resource URN with an error when registration fails.
inherited
-
getProvider(
String moduleMember) → ProviderResource? -
Returns provider for
moduleMember's package, if configured.inherited -
getResourceName(
) → String -
Returns this resource's logical name.
inherited
-
getResourceType(
) → String -
Returns this resource's Pulumi type token.
inherited
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
registerOutput<
T> (String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output< T> -
Registers a dynamic output property for this resource.
inherited
-
resolveId(
String? value, {required bool isKnown}) → void -
Resolves the provider-assigned ID for this resource.
inherited
-
resolveOutputs(
Struct outputs) → void -
Resolves all output properties from a monitor response payload.
inherited
-
resolveUrn(
String value) → void -
Resolves this resource's URN once assigned by the engine.
inherited
-
serializeProperties(
Map< String, dynamic> properties) → Future<Struct> -
Serializes resource properties for RPC transmission.
inherited
-
toString(
) → String -
A string representation of this object.
inherited
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited
Static Methods
-
get(
String name, Input< String> id, {WorkloadIdentityPoolState? state, CustomResourceOptions? options}) → WorkloadIdentityPool -
Gets an existing WorkloadIdentityPool resource's state with the given
nameandid.