AutokeyConfig class

AutokeyConfig is a singleton resource used to configure the auto-provisioning flow of CryptoKeys for CMEK.

> Note: AutokeyConfigs cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed AutokeyConfig will remove it from state but will not delete the resource from the project.

To get more information about AutokeyConfig, see:

• API documentation
• How-to Guides
• Cloud KMS with Autokey

Example Usage

Kms Autokey Config All

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as time from "@pulumiverse/time";

// Create Folder in GCP Organization
const autokmsFolder = new gcp.organizations.Folder("autokms_folder", {
    displayName: "folder-cfg",
    parent: "organizations/123456789",
    deletionProtection: false,
});
// Create the key project
const keyProject = new gcp.organizations.Project("key_project", {
    projectId: "key-proj",
    name: "key-proj",
    folderId: autokmsFolder.folderId,
    billingAccount: "000000-0000000-0000000-000000",
    deletionPolicy: "DELETE",
}, {
    dependsOn: [autokmsFolder],
});
// Enable the Cloud KMS API
const kmsApiService = new gcp.projects.Service("kms_api_service", {
    service: "cloudkms.googleapis.com",
    project: keyProject.projectId,
    disableDependentServices: true,
}, {
    dependsOn: [keyProject],
});
// Wait delay after enabling APIs
const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, {
    dependsOn: [kmsApiService],
});
//Create KMS Service Agent
const kmsServiceAgent = new gcp.projects.ServiceIdentity("kms_service_agent", {
    service: "cloudkms.googleapis.com",
    project: keyProject.number,
}, {
    dependsOn: [waitEnableServiceApi],
});
// Wait delay after creating service agent.
const waitServiceAgent = new time.Sleep("wait_service_agent", {createDuration: "10s"}, {
    dependsOn: [kmsServiceAgent],
});
//Grant the KMS Service Agent the Cloud KMS Admin role
const autokeyProjectAdmin = new gcp.projects.IAMMember("autokey_project_admin", {
    project: keyProject.projectId,
    role: "roles/cloudkms.admin",
    member: pulumi.interpolate`serviceAccount:service-${keyProject.number}@gcp-sa-cloudkms.iam.gserviceaccount.com`,
}, {
    dependsOn: [waitServiceAgent],
});
// Wait delay after granting IAM permissions
const waitSrvAccPermissions = new time.Sleep("wait_srv_acc_permissions", {createDuration: "10s"}, {
    dependsOn: [autokeyProjectAdmin],
});
const example_autokeyconfig = new gcp.kms.AutokeyConfig("example-autokeyconfig", {
    folder: autokmsFolder.id,
    keyProject: pulumi.interpolate`projects/${keyProject.projectId}`,
    keyProjectResolutionMode: "DEDICATED_KEY_PROJECT",
}, {
    dependsOn: [waitSrvAccPermissions],
});
// Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
// because setting the config takes a little to fully propagate.
const waitAutokeyPropagation = new time.Sleep("wait_autokey_propagation", {createDuration: "30s"}, {
    dependsOn: [example_autokeyconfig],
});

import pulumi
import pulumi_gcp as gcp
import pulumiverse_time as time

# Create Folder in GCP Organization
autokms_folder = gcp.organizations.Folder("autokms_folder",
    display_name="folder-cfg",
    parent="organizations/123456789",
    deletion_protection=False)
# Create the key project
key_project = gcp.organizations.Project("key_project",
    project_id="key-proj",
    name="key-proj",
    folder_id=autokms_folder.folder_id,
    billing_account="000000-0000000-0000000-000000",
    deletion_policy="DELETE",
    opts = pulumi.ResourceOptions(depends_on=[autokms_folder]))
# Enable the Cloud KMS API
kms_api_service = gcp.projects.Service("kms_api_service",
    service="cloudkms.googleapis.com",
    project=key_project.project_id,
    disable_dependent_services=True,
    opts = pulumi.ResourceOptions(depends_on=[key_project]))
# Wait delay after enabling APIs
wait_enable_service_api = time.Sleep("wait_enable_service_api", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[kms_api_service]))
#Create KMS Service Agent
kms_service_agent = gcp.projects.ServiceIdentity("kms_service_agent",
    service="cloudkms.googleapis.com",
    project=key_project.number,
    opts = pulumi.ResourceOptions(depends_on=[wait_enable_service_api]))
# Wait delay after creating service agent.
wait_service_agent = time.Sleep("wait_service_agent", create_duration="10s",
opts = pulumi.ResourceOptions(depends_on=[kms_service_agent]))
#Grant the KMS Service Agent the Cloud KMS Admin role
autokey_project_admin = gcp.projects.IAMMember("autokey_project_admin",
    project=key_project.project_id,
    role="roles/cloudkms.admin",
    member=key_project.number.apply(lambda number: f"serviceAccount:service-{number}@gcp-sa-cloudkms.iam.gserviceaccount.com"),
    opts = pulumi.ResourceOptions(depends_on=[wait_service_agent]))
# Wait delay after granting IAM permissions
wait_srv_acc_permissions = time.Sleep("wait_srv_acc_permissions", create_duration="10s",
opts = pulumi.ResourceOptions(depends_on=[autokey_project_admin]))
example_autokeyconfig = gcp.kms.AutokeyConfig("example-autokeyconfig",
    folder=autokms_folder.id,
    key_project=key_project.project_id.apply(lambda project_id: f"projects/{project_id}"),
    key_project_resolution_mode="DEDICATED_KEY_PROJECT",
    opts = pulumi.ResourceOptions(depends_on=[wait_srv_acc_permissions]))
# Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
# because setting the config takes a little to fully propagate.
wait_autokey_propagation = time.Sleep("wait_autokey_propagation", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[example_autokeyconfig]))

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() =>
{
    // Create Folder in GCP Organization
    var autokmsFolder = new Gcp.Organizations.Folder("autokms_folder", new()
    {
        DisplayName = "folder-cfg",
        Parent = "organizations/123456789",
        DeletionProtection = false,
    });

    // Create the key project
    var keyProject = new Gcp.Organizations.Project("key_project", new()
    {
        ProjectId = "key-proj",
        Name = "key-proj",
        FolderId = autokmsFolder.FolderId,
        BillingAccount = "000000-0000000-0000000-000000",
        DeletionPolicy = "DELETE",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            autokmsFolder,
        },
    });

    // Enable the Cloud KMS API
    var kmsApiService = new Gcp.Projects.Service("kms_api_service", new()
    {
        ServiceName = "cloudkms.googleapis.com",
        Project = keyProject.ProjectId,
        DisableDependentServices = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            keyProject,
        },
    });

    // Wait delay after enabling APIs
    var waitEnableServiceApi = new Time.Sleep("wait_enable_service_api", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsApiService,
        },
    });

    //Create KMS Service Agent
    var kmsServiceAgent = new Gcp.Projects.ServiceIdentity("kms_service_agent", new()
    {
        Service = "cloudkms.googleapis.com",
        Project = keyProject.Number,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitEnableServiceApi,
        },
    });

    // Wait delay after creating service agent.
    var waitServiceAgent = new Time.Sleep("wait_service_agent", new()
    {
        CreateDuration = "10s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsServiceAgent,
        },
    });

    //Grant the KMS Service Agent the Cloud KMS Admin role
    var autokeyProjectAdmin = new Gcp.Projects.IAMMember("autokey_project_admin", new()
    {
        Project = keyProject.ProjectId,
        Role = "roles/cloudkms.admin",
        Member = keyProject.Number.Apply(number => $"serviceAccount:service-{number}@gcp-sa-cloudkms.iam.gserviceaccount.com"),
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitServiceAgent,
        },
    });

    // Wait delay after granting IAM permissions
    var waitSrvAccPermissions = new Time.Sleep("wait_srv_acc_permissions", new()
    {
        CreateDuration = "10s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            autokeyProjectAdmin,
        },
    });

    var example_autokeyconfig = new Gcp.Kms.AutokeyConfig("example-autokeyconfig", new()
    {
        Folder = autokmsFolder.Id,
        KeyProject = keyProject.ProjectId.Apply(projectId => $"projects/{projectId}"),
        KeyProjectResolutionMode = "DEDICATED_KEY_PROJECT",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitSrvAccPermissions,
        },
    });

    // Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
    // because setting the config takes a little to fully propagate.
    var waitAutokeyPropagation = new Time.Sleep("wait_autokey_propagation", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            example_autokeyconfig,
        },
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create Folder in GCP Organization
		autokmsFolder, err := organizations.NewFolder(ctx, "autokms_folder", &organizations.FolderArgs{
			DisplayName:        pulumi.String("folder-cfg"),
			Parent:             pulumi.String("organizations/123456789"),
			DeletionProtection: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		// Create the key project
		keyProject, err := organizations.NewProject(ctx, "key_project", &organizations.ProjectArgs{
			ProjectId:      pulumi.String("key-proj"),
			Name:           pulumi.String("key-proj"),
			FolderId:       autokmsFolder.FolderId,
			BillingAccount: pulumi.String("000000-0000000-0000000-000000"),
			DeletionPolicy: pulumi.String("DELETE"),
		}, pulumi.DependsOn([]pulumi.Resource{
			autokmsFolder,
		}))
		if err != nil {
			return err
		}
		// Enable the Cloud KMS API
		kmsApiService, err := projects.NewService(ctx, "kms_api_service", &projects.ServiceArgs{
			Service:                  pulumi.String("cloudkms.googleapis.com"),
			Project:                  keyProject.ProjectId,
			DisableDependentServices: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			keyProject,
		}))
		if err != nil {
			return err
		}
		// Wait delay after enabling APIs
		waitEnableServiceApi, err := time.NewSleep(ctx, "wait_enable_service_api", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsApiService,
		}))
		if err != nil {
			return err
		}
		// Create KMS Service Agent
		kmsServiceAgent, err := projects.NewServiceIdentity(ctx, "kms_service_agent", &projects.ServiceIdentityArgs{
			Service: pulumi.String("cloudkms.googleapis.com"),
			Project: keyProject.Number,
		}, pulumi.DependsOn([]pulumi.Resource{
			waitEnableServiceApi,
		}))
		if err != nil {
			return err
		}
		// Wait delay after creating service agent.
		waitServiceAgent, err := time.NewSleep(ctx, "wait_service_agent", &time.SleepArgs{
			CreateDuration: pulumi.String("10s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsServiceAgent,
		}))
		if err != nil {
			return err
		}
		// Grant the KMS Service Agent the Cloud KMS Admin role
		autokeyProjectAdmin, err := projects.NewIAMMember(ctx, "autokey_project_admin", &projects.IAMMemberArgs{
			Project: keyProject.ProjectId,
			Role:    pulumi.String("roles/cloudkms.admin"),
			Member: keyProject.Number.ApplyT(func(number string) (string, error) {
				return fmt.Sprintf("serviceAccount:[e-mail]", number), nil
			}).(pulumi.StringOutput),
		}, pulumi.DependsOn([]pulumi.Resource{
			waitServiceAgent,
		}))
		if err != nil {
			return err
		}
		// Wait delay after granting IAM permissions
		waitSrvAccPermissions, err := time.NewSleep(ctx, "wait_srv_acc_permissions", &time.SleepArgs{
			CreateDuration: pulumi.String("10s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			autokeyProjectAdmin,
		}))
		if err != nil {
			return err
		}
		example_autokeyconfig, err := kms.NewAutokeyConfig(ctx, "example-autokeyconfig", &kms.AutokeyConfigArgs{
			Folder: autokmsFolder.ID().ToIDOutput().ToStringOutput(),
			KeyProject: keyProject.ProjectId.ApplyT(func(projectId string) (string, error) {
				return fmt.Sprintf("projects/%v", projectId), nil
			}).(pulumi.StringOutput),
			KeyProjectResolutionMode: pulumi.String("DEDICATED_KEY_PROJECT"),
		}, pulumi.DependsOn([]pulumi.Resource{
			waitSrvAccPermissions,
		}))
		if err != nil {
			return err
		}
		// Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
		// because setting the config takes a little to fully propagate.
		_, err = time.NewSleep(ctx, "wait_autokey_propagation", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			example_autokeyconfig,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
    time = {
      source = "pulumi/time"
    }
  }
}

# Create Folder in GCP Organization
resource "gcp_organizations_folder" "autokms_folder" {
  display_name        = "folder-cfg"
  parent              = "organizations/123456789"
  deletion_protection = false
}
# Create the key project
resource "gcp_organizations_project" "key_project" {
  depends_on      = [gcp_organizations_folder.autokms_folder]
  project_id      = "key-proj"
  name            = "key-proj"
  folder_id       = gcp_organizations_folder.autokms_folder.folder_id
  billing_account = "000000-0000000-0000000-000000"
  deletion_policy = "DELETE"
}
# Enable the Cloud KMS API
resource "gcp_projects_service" "kms_api_service" {
  depends_on                 = [gcp_organizations_project.key_project]
  service                    = "cloudkms.googleapis.com"
  project                    = gcp_organizations_project.key_project.project_id
  disable_dependent_services = true
}
# Wait delay after enabling APIs
resource "time_sleep" "wait_enable_service_api" {
  depends_on      = [gcp_projects_service.kms_api_service]
  create_duration = "30s"
}
#Create KMS Service Agent
resource "gcp_projects_serviceidentity" "kms_service_agent" {
  depends_on = [time_sleep.wait_enable_service_api]
  service    = "cloudkms.googleapis.com"
  project    = gcp_organizations_project.key_project.number
}
# Wait delay after creating service agent.
resource "time_sleep" "wait_service_agent" {
  depends_on      = [gcp_projects_serviceidentity.kms_service_agent]
  create_duration = "10s"
}
#Grant the KMS Service Agent the Cloud KMS Admin role
resource "gcp_projects_iammember" "autokey_project_admin" {
  depends_on = [time_sleep.wait_service_agent]
  project    = gcp_organizations_project.key_project.project_id
  role       = "roles/cloudkms.admin"
  member     ="serviceAccount:service-${gcp_organizations_project.key_project.number}@gcp-sa-cloudkms.iam.gserviceaccount.com"
}
# Wait delay after granting IAM permissions
resource "time_sleep" "wait_srv_acc_permissions" {
  depends_on      = [gcp_projects_iammember.autokey_project_admin]
  create_duration = "10s"
}
resource "gcp_kms_autokeyconfig" "example-autokeyconfig" {
  depends_on                  = [time_sleep.wait_srv_acc_permissions]
  folder                      = gcp_organizations_folder.autokms_folder.id
  key_project                 ="projects/${gcp_organizations_project.key_project.project_id}"
  key_project_resolution_mode = "DEDICATED_KEY_PROJECT"
}
# Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
# because setting the config takes a little to fully propagate.
resource "time_sleep" "wait_autokey_propagation" {
  depends_on      = [gcp_kms_autokeyconfig.example-autokeyconfig]
  create_duration = "30s"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Folder;
import com.pulumi.gcp.organizations.FolderArgs;
import com.pulumi.gcp.organizations.Project;
import com.pulumi.gcp.organizations.ProjectArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumiverse.time.Sleep;
import com.pulumiverse.time.SleepArgs;
import com.pulumi.gcp.projects.ServiceIdentity;
import com.pulumi.gcp.projects.ServiceIdentityArgs;
import com.pulumi.gcp.projects.IAMMember;
import com.pulumi.gcp.projects.IAMMemberArgs;
import com.pulumi.gcp.kms.AutokeyConfig;
import com.pulumi.gcp.kms.AutokeyConfigArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create Folder in GCP Organization
        var autokmsFolder = new Folder("autokmsFolder", FolderArgs.builder()
            .displayName("folder-cfg")
            .parent("organizations/123456789")
            .deletionProtection(false)
            .build());

        // Create the key project
        var keyProject = new Project("keyProject", ProjectArgs.builder()
            .projectId("key-proj")
            .name("key-proj")
            .folderId(autokmsFolder.folderId())
            .billingAccount("000000-0000000-0000000-000000")
            .deletionPolicy("DELETE")
            .build(), CustomResourceOptions.builder()
                .dependsOn(autokmsFolder)
                .build());

        // Enable the Cloud KMS API
        var kmsApiService = new Service("kmsApiService", ServiceArgs.builder()
            .service("cloudkms.googleapis.com")
            .project(keyProject.projectId())
            .disableDependentServices(true)
            .build(), CustomResourceOptions.builder()
                .dependsOn(keyProject)
                .build());

        // Wait delay after enabling APIs
        var waitEnableServiceApi = new Sleep("waitEnableServiceApi", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsApiService)
                .build());

        //Create KMS Service Agent
        var kmsServiceAgent = new ServiceIdentity("kmsServiceAgent", ServiceIdentityArgs.builder()
            .service("cloudkms.googleapis.com")
            .project(keyProject.number())
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitEnableServiceApi)
                .build());

        // Wait delay after creating service agent.
        var waitServiceAgent = new Sleep("waitServiceAgent", SleepArgs.builder()
            .createDuration("10s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsServiceAgent)
                .build());

        //Grant the KMS Service Agent the Cloud KMS Admin role
        var autokeyProjectAdmin = new IAMMember("autokeyProjectAdmin", IAMMemberArgs.builder()
            .project(keyProject.projectId())
            .role("roles/cloudkms.admin")
            .member(keyProject.number().applyValue(_number -> String.format("serviceAccount:[e-mail]", _number)))
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitServiceAgent)
                .build());

        // Wait delay after granting IAM permissions
        var waitSrvAccPermissions = new Sleep("waitSrvAccPermissions", SleepArgs.builder()
            .createDuration("10s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(autokeyProjectAdmin)
                .build());

        var example_autokeyconfig = new AutokeyConfig("example-autokeyconfig", AutokeyConfigArgs.builder()
            .folder(autokmsFolder.id())
            .keyProject(keyProject.projectId().applyValue(_projectId -> String.format("projects/%s", _projectId)))
            .keyProjectResolutionMode("DEDICATED_KEY_PROJECT")
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitSrvAccPermissions)
                .build());

        // Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
        // because setting the config takes a little to fully propagate.
        var waitAutokeyPropagation = new Sleep("waitAutokeyPropagation", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(example_autokeyconfig)
                .build());

    }
}

resources:
  # Create Folder in GCP Organization
  autokmsFolder:
    type: gcp:organizations:Folder
    name: autokms_folder
    properties:
      displayName: folder-cfg
      parent: organizations/123456789
      deletionProtection: false
  # Create the key project
  keyProject:
    type: gcp:organizations:Project
    name: key_project
    properties:
      projectId: key-proj
      name: key-proj
      folderId: ${autokmsFolder.folderId}
      billingAccount: 000000-0000000-0000000-000000
      deletionPolicy: DELETE
    options:
      dependsOn:
        - ${autokmsFolder}
  # Enable the Cloud KMS API
  kmsApiService:
    type: gcp:projects:Service
    name: kms_api_service
    properties:
      service: cloudkms.googleapis.com
      project: ${keyProject.projectId}
      disableDependentServices: true
    options:
      dependsOn:
        - ${keyProject}
  # Wait delay after enabling APIs
  waitEnableServiceApi:
    type: time:Sleep
    name: wait_enable_service_api
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${kmsApiService}
  #Create KMS Service Agent
  kmsServiceAgent:
    type: gcp:projects:ServiceIdentity
    name: kms_service_agent
    properties:
      service: cloudkms.googleapis.com
      project: ${keyProject.number}
    options:
      dependsOn:
        - ${waitEnableServiceApi}
  # Wait delay after creating service agent.
  waitServiceAgent:
    type: time:Sleep
    name: wait_service_agent
    properties:
      createDuration: 10s
    options:
      dependsOn:
        - ${kmsServiceAgent}
  #Grant the KMS Service Agent the Cloud KMS Admin role
  autokeyProjectAdmin:
    type: gcp:projects:IAMMember
    name: autokey_project_admin
    properties:
      project: ${keyProject.projectId}
      role: roles/cloudkms.admin
      member: serviceAccount:service-${keyProject.number}@gcp-sa-cloudkms.iam.gserviceaccount.com
    options:
      dependsOn:
        - ${waitServiceAgent}
  # Wait delay after granting IAM permissions
  waitSrvAccPermissions:
    type: time:Sleep
    name: wait_srv_acc_permissions
    properties:
      createDuration: 10s
    options:
      dependsOn:
        - ${autokeyProjectAdmin}
  example-autokeyconfig:
    type: gcp:kms:AutokeyConfig
    properties:
      folder: ${autokmsFolder.id}
      keyProject: projects/${keyProject.projectId}
      keyProjectResolutionMode: DEDICATED_KEY_PROJECT
    options:
      dependsOn:
        - ${waitSrvAccPermissions}
  # Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
  # because setting the config takes a little to fully propagate.
  waitAutokeyPropagation:
    type: time:Sleep
    name: wait_autokey_propagation
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${["example-autokeyconfig"]}

Import

AutokeyConfig can be imported using any of these accepted formats:

• folders/{{folder}}/autokeyConfig
• {{folder}}

When using the pulumi import command, AutokeyConfig can be imported using one of the formats above. For example:

$ pulumi import gcp:kms/autokeyConfig:AutokeyConfig default folders/{{folder}}/autokeyConfig
$ pulumi import gcp:kms/autokeyConfig:AutokeyConfig default {{folder}}

Constructors

AutokeyConfig(String name, {AutokeyConfigArgs? args, CustomResourceOptions? options})

Creates a new AutokeyConfig. name The Pulumi resource name. args Arguments used to configure this AutokeyConfig. The set of arguments for AutokeyConfig. options Resource options controlling this resource's behavior.

AutokeyConfig.reference(String urn)

Creates a typed reference to an existing AutokeyConfig resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

deletionPolicy ↔ Output<String>

Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.

late, final

etag ↔ Output<String>

The etag of the AutokeyConfig for optimistic concurrency control.

late, final

folder ↔ Output<String>

The folder for which to retrieve config.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

keyProject ↔ Output<String?>

The target key project for a given folder where KMS Autokey will provision a CryptoKey for any new KeyHandle the Developer creates. Should have the form projects/<project_id_or_number>.

late, final

keyProjectResolutionMode ↔ Output<String?>

How Autokey determines which project to use when provisioning CMEK keys. Possible values are: DEDICATED_KEY_PROJECT, RESOURCE_PROJECT, DISABLED.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {AutokeyConfigState? state, CustomResourceOptions? options}) → AutokeyConfig

Gets an existing AutokeyConfig resource's state with the given name and id.