OrganizationKajPolicyConfig class

OrganizationKajPolicyConfig is a organization-level singleton resource used to configure the default KAJ policy of newly created key.

> Note: OrganizationKajPolicyConfig cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed OrganizationKajPolicyConfig will remove it from state but will not delete the resource from Google Cloud Platform.

> Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider. See Provider Versions for more details on beta resources.

To get more information about OrganizationKajPolicyConfig, see:

• API documentation
• How-to Guides
• Set default Key Access Justifications policy

Example Usage

Kms Organization Kaj Policy Config Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.kms.OrganizationKajPolicyConfig("example", {
    organization: "123456789",
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
});

import pulumi
import pulumi_gcp as gcp

example = gcp.kms.OrganizationKajPolicyConfig("example",
    organization="123456789",
    default_key_access_justification_policy={
        "allowed_access_reasons": [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var example = new Gcp.Kms.OrganizationKajPolicyConfig("example", new()
    {
        Organization = "123456789",
        DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.OrganizationKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
        {
            AllowedAccessReasons = new[]
            {
                "CUSTOMER_INITIATED_ACCESS",
                "GOOGLE_INITIATED_SYSTEM_OPERATION",
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewOrganizationKajPolicyConfig(ctx, "example", &kms.OrganizationKajPolicyConfigArgs{
			Organization: pulumi.String("123456789"),
			DefaultKeyAccessJustificationPolicy: &kms.OrganizationKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
				AllowedAccessReasons: pulumi.StringArray{
					pulumi.String("CUSTOMER_INITIATED_ACCESS"),
					pulumi.String("GOOGLE_INITIATED_SYSTEM_OPERATION"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_kms_organizationkajpolicyconfig" "example" {
  organization = "123456789"
  default_key_access_justification_policy = {
    allowed_access_reasons = ["CUSTOMER_INITIATED_ACCESS", "GOOGLE_INITIATED_SYSTEM_OPERATION"]
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.OrganizationKajPolicyConfig;
import com.pulumi.gcp.kms.OrganizationKajPolicyConfigArgs;
import com.pulumi.gcp.kms.inputs.OrganizationKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new OrganizationKajPolicyConfig("example", OrganizationKajPolicyConfigArgs.builder()
            .organization("123456789")
            .defaultKeyAccessJustificationPolicy(OrganizationKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
                .allowedAccessReasons(
                    "CUSTOMER_INITIATED_ACCESS",
                    "GOOGLE_INITIATED_SYSTEM_OPERATION")
                .build())
            .build());

    }
}

resources:
  example:
    type: gcp:kms:OrganizationKajPolicyConfig
    properties:
      organization: '123456789'
      defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
          - CUSTOMER_INITIATED_ACCESS
          - GOOGLE_INITIATED_SYSTEM_OPERATION

Import

OrganizationKajPolicyConfig can be imported using any of these accepted formats:

• organizations/{{organization}}/kajPolicyConfig
• {{organization}}

When using the pulumi import command, OrganizationKajPolicyConfig can be imported using one of the formats above. For example:

$ pulumi import gcp:kms/organizationKajPolicyConfig:OrganizationKajPolicyConfig default organizations/{{organization}}/kajPolicyConfig
$ pulumi import gcp:kms/organizationKajPolicyConfig:OrganizationKajPolicyConfig default {{organization}}

Constructors

OrganizationKajPolicyConfig(String name, {OrganizationKajPolicyConfigArgs? args, CustomResourceOptions? options})

Creates a new OrganizationKajPolicyConfig. name The Pulumi resource name. args Arguments used to configure this OrganizationKajPolicyConfig. The set of arguments for OrganizationKajPolicyConfig. options Resource options controlling this resource's behavior.

OrganizationKajPolicyConfig.reference(String urn)

Creates a typed reference to an existing OrganizationKajPolicyConfig resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

defaultKeyAccessJustificationPolicy ↔ Output<OrganizationKajPolicyConfigDefaultKeyAccessJustificationPolicy?>

The default key access justification policy used when a CryptoKey is created in this organization. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

organization ↔ Output<String>

The organization number for which to retrieve config.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {OrganizationKajPolicyConfigState? state, CustomResourceOptions? options}) → OrganizationKajPolicyConfig

Gets an existing OrganizationKajPolicyConfig resource's state with the given name and id.