The executor context defines information about the executor where the deployment is executed. If unspecified, the default 'pulumi/pulumi' image is used.
Register an OIDC Provider to establish a trust relationship between third-party systems like GitHub Actions and Pulumi Cloud, obviating the need to store a hard-coded Pulumi Cloud token in systems that need to run Pulumi commands or consume Pulumi Cloud APIs. Instead of a hard-coded, static token that must be manually rotated, trusted systems are granted temporary Pulumi Cloud tokens on an as-needed basis, which is more secure than static tokens.
Manages a user's membership in a Pulumi Cloud organization and their assigned role. The user must already have a Pulumi Cloud account before they can be added. Custom (fine-grained) roles are assigned by setting roleId; built-in roles are assigned by setting role. When both are set, roleId takes precedence.
A custom (fine-grained) role defined on a Pulumi Cloud organization. Custom roles allow precise permission control beyond the built-in admin / member / billing-manager roles. Assign them to members via the OrganizationMember.roleId field or to teams via TeamRoleAssignment.
A Policy Pack published to Pulumi Cloud. The source directory is tarballed and uploaded on Create; changing source content publishes a new version (replace).
The Pulumi Cloud offers role-based access control (RBAC) using teams. Teams allow organization admins to assign a set of stack permissions to a group of users.
Assigns a custom (fine-grained) role to a Pulumi Cloud team. The Pulumi Cloud API currently supports one role per team; creating a second assignment replaces the first. The team's organization must already have the custom-roles feature enabled.
Pulumi Webhooks allow you to notify external services of events happening within your Pulumi organization or stack. For example, you can trigger a notification whenever a stack is updated. Whenever an event occurs, Pulumi will send an HTTP POST request to all registered webhooks. The webhook can then be used to emit some notification, start running integration tests, or even update additional stacks.
Builds an OrganizationRole.permissions descriptor that grants the supplied scopes globally — i.e. on every entity of the matching resource type. This is the simplest descriptor: a flat PermissionDescriptorAllow. Use this helper instead of hand-authoring the descriptor literal so the wire-format __type discriminator stays an implementation detail. For grants scoped to a specific entity, see buildEnvironmentScopedPermissions, buildStackScopedPermissions, or buildInsightsAccountScopedPermissions. The result is directly assignable to OrganizationRole.permissions. To grant scopes on more than one entity in a single role, hand-roll a PermissionDescriptorGroup whose entries list pulls the output of each helper.
args Arguments passed to this invoke. Arguments for buildAllowPermissions.
options Invoke options controlling this call.
Builds an OrganizationRole.permissions descriptor that grants the supplied scopes only on the named environment. Pair with Environment.environmentId (or the getEnvironment data source) to avoid hand-rolling the PermissionDescriptorCondition tree yourself. The result is directly assignable to OrganizationRole.permissions. To grant scopes on more than one entity in a single role, hand-roll a PermissionDescriptorGroup whose entries list pulls the output of each helper.
args Arguments passed to this invoke. Arguments for buildEnvironmentScopedPermissions.
options Invoke options controlling this call.
Builds an OrganizationRole.permissions descriptor that grants the supplied scopes only on the named insights account. Pair with InsightsAccount.insightsAccountId (or the getInsightsAccount data source). The result is directly assignable to OrganizationRole.permissions. To grant scopes on more than one entity in a single role, hand-roll a PermissionDescriptorGroup whose entries list pulls the output of each helper.
args Arguments passed to this invoke. Arguments for buildInsightsAccountScopedPermissions.
options Invoke options controlling this call.
Builds an OrganizationRole.permissions descriptor that grants the supplied scopes only on the named stack. The stackId is the stack's opaque Pulumi Cloud identifier — distinct from the organization/project/stack triple. The result is directly assignable to OrganizationRole.permissions. To grant scopes on more than one entity in a single role, hand-roll a PermissionDescriptorGroup whose entries list pulls the output of each helper.
args Arguments passed to this invoke. Arguments for buildStackScopedPermissions.
options Invoke options controlling this call.
Returns the Pulumi Cloud user that the provider's access token belongs to. Useful for seeding a newly-created Team with the creator as a member, since Pulumi Cloud auto-adds the creator. Omitting this user from the team will result in a refresh drift.
options Invoke options controlling this call.
Looks up an existing ESC environment by name and returns its UUID. Use this to scope a custom RBAC role to a specific environment — pass the returned UUID into buildEnvironmentScopedPermissions, or use it as the identity field of a hand-rolled PermissionLiteralExpressionEnvironment in OrganizationRole.permissions. Errors when the environment is not found.
args Arguments passed to this invoke. Arguments for getEnvironment.
options Invoke options controlling this call.
Get details about a specific Insights account.
args Arguments passed to this invoke. Arguments for getInsightsAccount.
options Invoke options controlling this call.
Get a list of all Insights accounts for an organization.
args Arguments passed to this invoke. Arguments for getInsightsAccounts.
options Invoke options controlling this call.
Looks up a single member of a Pulumi Cloud organization by username (the backing identity-provider login, e.g. GitHub login). Returns an error when the member is not found.
args Arguments passed to this invoke. Arguments for getOrganizationMember.
options Invoke options controlling this call.
Lists all members of a Pulumi Cloud organization, including their role assignments. Merges Pulumi Cloud's identity-provider roster (paginated; includes users who haven't signed in to Pulumi yet) with the seat-count roster, deduped by username, so SAML- and non-SAML-provisioned members both appear regardless of which roster they're tracked in.
args Arguments passed to this invoke. Arguments for getOrganizationMembers.
options Invoke options controlling this call.
Lists the permission scopes available for custom roles in an organization. Use this to discover valid scope names before setting OrganizationRole.permissions. The catalogue is flattened into a single list with resource type and group context, sorted deterministically.
args Arguments passed to this invoke. Arguments for getOrganizationRoleScopes.
options Invoke options controlling this call.
Get details about a specific version of a policy pack.
args Arguments passed to this invoke. Arguments for getPolicyPack.
options Invoke options controlling this call.
Get a list of all policy packs for an organization.
args Arguments passed to this invoke. Arguments for getPolicyPacks.
options Invoke options controlling this call.
