OrganizationSettings class

Default resource settings control whether CMEK is required for new log buckets. These settings also determine the storage location for the _Default and _Required log buckets, and whether the _Default sink is enabled or disabled.

To get more information about OrganizationSettings, see:

• API documentation
• How-to Guides
• Configure default settings for organizations and folders

Example Usage

Logging Organization Settings All

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const settings = gcp.logging.getOrganizationSettings({
    organization: "123456789",
});
const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
    cryptoKeyId: "kms-key",
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    member: settings.then(settings => `serviceAccount:${settings.kmsServiceAccountId}`),
});
const example = new gcp.logging.OrganizationSettings("example", {
    disableDefaultSink: true,
    kmsKeyName: "kms-key",
    organization: "123456789",
    storageLocation: "us-central1",
}, {
    dependsOn: [iam],
});

import pulumi
import pulumi_gcp as gcp

settings = gcp.logging.get_organization_settings(organization="123456789")
iam = gcp.kms.CryptoKeyIAMMember("iam",
    crypto_key_id="kms-key",
    role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
    member=f"serviceAccount:{settings.kms_service_account_id}")
example = gcp.logging.OrganizationSettings("example",
    disable_default_sink=True,
    kms_key_name="kms-key",
    organization="123456789",
    storage_location="us-central1",
    opts = pulumi.ResourceOptions(depends_on=[iam]))

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var settings = Gcp.Logging.GetOrganizationSettings.Invoke(new()
    {
        Organization = "123456789",
    });

    var iam = new Gcp.Kms.CryptoKeyIAMMember("iam", new()
    {
        CryptoKeyId = "kms-key",
        Role = "roles/cloudkms.cryptoKeyEncrypterDecrypter",
        Member = $"serviceAccount:{settings.Apply(getOrganizationSettingsResult => getOrganizationSettingsResult.KmsServiceAccountId)}",
    });

    var example = new Gcp.Logging.OrganizationSettings("example", new()
    {
        DisableDefaultSink = true,
        KmsKeyName = "kms-key",
        Organization = "123456789",
        StorageLocation = "us-central1",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            iam,
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/logging"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		settings, err := logging.LookupOrganizationSettings(ctx, &logging.LookupOrganizationSettingsArgs{
			Organization: "123456789",
		}, nil)
		if err != nil {
			return err
		}
		iam, err := kms.NewCryptoKeyIAMMember(ctx, "iam", &kms.CryptoKeyIAMMemberArgs{
			CryptoKeyId: pulumi.String("kms-key"),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypterDecrypter"),
			Member:      pulumi.Sprintf("serviceAccount:%v", settings.KmsServiceAccountId),
		})
		if err != nil {
			return err
		}
		_, err = logging.NewOrganizationSettings(ctx, "example", &logging.OrganizationSettingsArgs{
			DisableDefaultSink: pulumi.Bool(true),
			KmsKeyName:         pulumi.String("kms-key"),
			Organization:       pulumi.String("123456789"),
			StorageLocation:    pulumi.String("us-central1"),
		}, pulumi.DependsOn([]pulumi.Resource{
			iam,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_logging_getorganizationsettings" "settings" {
  organization = "123456789"
}

resource "gcp_logging_organizationsettings" "example" {
  depends_on           = [gcp_kms_cryptokeyiammember.iam]
  disable_default_sink = true
  kms_key_name         = "kms-key"
  organization         = "123456789"
  storage_location     = "us-central1"
}
resource "gcp_kms_cryptokeyiammember" "iam" {
  crypto_key_id = "kms-key"
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        ="serviceAccount:${data.gcp_logging_getorganizationsettings.settings.kms_service_account_id}"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.logging.LoggingFunctions;
import com.pulumi.gcp.logging.inputs.GetOrganizationSettingsArgs;
import com.pulumi.gcp.kms.CryptoKeyIAMMember;
import com.pulumi.gcp.kms.CryptoKeyIAMMemberArgs;
import com.pulumi.gcp.logging.OrganizationSettings;
import com.pulumi.gcp.logging.OrganizationSettingsArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var settings = LoggingFunctions.getOrganizationSettings(GetOrganizationSettingsArgs.builder()
            .organization("123456789")
            .build());

        var iam = new CryptoKeyIAMMember("iam", CryptoKeyIAMMemberArgs.builder()
            .cryptoKeyId("kms-key")
            .role("roles/cloudkms.cryptoKeyEncrypterDecrypter")
            .member(String.format("serviceAccount:%s", settings.kmsServiceAccountId()))
            .build());

        var example = new OrganizationSettings("example", OrganizationSettingsArgs.builder()
            .disableDefaultSink(true)
            .kmsKeyName("kms-key")
            .organization("123456789")
            .storageLocation("us-central1")
            .build(), CustomResourceOptions.builder()
                .dependsOn(iam)
                .build());

    }
}

resources:
  example:
    type: gcp:logging:OrganizationSettings
    properties:
      disableDefaultSink: true
      kmsKeyName: kms-key
      organization: '123456789'
      storageLocation: us-central1
    options:
      dependsOn:
        - ${iam}
  iam:
    type: gcp:kms:CryptoKeyIAMMember
    properties:
      cryptoKeyId: kms-key
      role: roles/cloudkms.cryptoKeyEncrypterDecrypter
      member: serviceAccount:${settings.kmsServiceAccountId}
variables:
  settings:
    fn::invoke:
      function: gcp:logging:getOrganizationSettings
      arguments:
        organization: '123456789'

Import

OrganizationSettings can be imported using any of these accepted formats:

• organizations/{{organization}}/settings
• {{organization}}

When using the pulumi import command, OrganizationSettings can be imported using one of the formats above. For example:

$ pulumi import gcp:logging/organizationSettings:OrganizationSettings default organizations/{{organization}}/settings
$ pulumi import gcp:logging/organizationSettings:OrganizationSettings default {{organization}}

Constructors

OrganizationSettings(String name, {OrganizationSettingsArgs? args, CustomResourceOptions? options})

Creates a new OrganizationSettings. name The Pulumi resource name. args Arguments used to configure this OrganizationSettings. The set of arguments for OrganizationSettings. options Resource options controlling this resource's behavior.

OrganizationSettings.reference(String urn)

Creates a typed reference to an existing OrganizationSettings resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

disableDefaultSink ↔ Output<bool>

If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

kmsKeyName ↔ Output<String>

The resource name for the configured Cloud KMS key.

late, final

kmsServiceAccountId ↔ Output<String>

The service account that will be used by the Log Router to access your Cloud KMS key.

late, final

loggingServiceAccountId ↔ Output<String>

The service account for the given container. Sinks use this service account as their writerIdentity if no custom service account is provided.

late, final

name ↔ Output<String>

The resource name of the settings.

late, final

organization ↔ Output<String>

The organization for which to retrieve or configure settings.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

storageLocation ↔ Output<String>

The storage location that Cloud Logging will use to create new resources when a location is needed but not explicitly provided.

late, final

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {OrganizationSettingsState? state, CustomResourceOptions? options}) → OrganizationSettings

Gets an existing OrganizationSettings resource's state with the given name and id.