iam library

IAM service accounts, Workload Identity Federation pools (including trust-domain namespaces and managed identities), Workload Identity service-agent minting, Workforce Identity Federation pools / providers / keys / SCIM (apply-excluded; org parent), Workforce OAuth clients, OS Login SSH public keys, project deny policies, and per-resource IAM members live alongside their owning service barrel (e.g. pubsub.dart exports GooglePubsubTopicIamMember).

Classes

GoogleIamAccessBoundaryPolicy
Factory wrapper for google_iam_access_boundary_policy.
GoogleIamDenyPolicy
Factory wrapper for google_iam_deny_policy.
GoogleIamFoldersPolicyBinding
Factory wrapper for google_iam_folders_policy_binding.
GoogleIamOauthClient
Factory wrapper for google_iam_oauth_client.
GoogleIamOauthClientCredential
Factory wrapper for google_iam_oauth_client_credential.
GoogleIamOrganizationsPolicyBinding
Factory wrapper for google_iam_organizations_policy_binding.
GoogleIamPrincipalAccessBoundaryPolicy
Factory wrapper for google_iam_principal_access_boundary_policy.
GoogleIamProjectsPolicyBinding
Factory wrapper for google_iam_projects_policy_binding.
GoogleIamWorkforcePool
Factory wrapper for google_iam_workforce_pool.
GoogleIamWorkforcePoolIamBinding
Factory wrapper for google_iam_workforce_pool_iam_binding.
GoogleIamWorkforcePoolIamMember
Factory wrapper for google_iam_workforce_pool_iam_member.
GoogleIamWorkforcePoolIamPolicy
Factory wrapper for google_iam_workforce_pool_iam_policy.
GoogleIamWorkforcePoolProvider
Factory wrapper for google_iam_workforce_pool_provider.
GoogleIamWorkforcePoolProviderKey
Factory wrapper for google_iam_workforce_pool_provider_key.
GoogleIamWorkforcePoolProviderScimTenant
Factory wrapper for google_iam_workforce_pool_provider_scim_tenant.
GoogleIamWorkforcePoolProviderScimToken
Factory wrapper for google_iam_workforce_pool_provider_scim_token.
GoogleIamWorkloadIdentityPool
Factory wrapper for google_iam_workload_identity_pool.
GoogleIamWorkloadIdentityPoolIamBinding
Factory wrapper for google_iam_workload_identity_pool_iam_binding.
GoogleIamWorkloadIdentityPoolIamMember
Factory wrapper for google_iam_workload_identity_pool_iam_member.
GoogleIamWorkloadIdentityPoolIamPolicy
Factory wrapper for google_iam_workload_identity_pool_iam_policy.
GoogleIamWorkloadIdentityPoolManagedIdentity
Factory wrapper for google_iam_workload_identity_pool_managed_identity.
GoogleIamWorkloadIdentityPoolNamespace
Factory wrapper for google_iam_workload_identity_pool_namespace.
GoogleIamWorkloadIdentityPoolProvider
Factory wrapper for google_iam_workload_identity_pool_provider.
GoogleOsLoginSshPublicKey
Factory wrapper for google_os_login_ssh_public_key.
GoogleProjectIamAuditConfig
Factory wrapper for google_project_iam_audit_config.
GoogleProjectIamBinding
Factory wrapper for google_project_iam_binding.
GoogleProjectIamCustomRole
Factory wrapper for google_project_iam_custom_role.
GoogleProjectIamMember
Factory wrapper for google_project_iam_member.
GoogleProjectIamMemberRemove
Factory wrapper for google_project_iam_member_remove.
GoogleProjectIamPolicy
Factory wrapper for google_project_iam_policy.
GoogleServiceAccount
Factory wrapper for google_service_account.
GoogleServiceAccountIamBinding
Factory wrapper for google_service_account_iam_binding.
GoogleServiceAccountIamMember
Factory wrapper for google_service_account_iam_member.
GoogleServiceAccountIamPolicy
Factory wrapper for google_service_account_iam_policy.
GoogleServiceAccountKey
Factory wrapper for google_service_account_key.
GoogleWorkloadIdentityServiceAgent
Factory wrapper for google_workload_identity_service_agent.
IamAccessBoundaryPolicyRules
Typed helper for the rules block of google_iam_access_boundary_policy (derived from provider schema).
IamAccessBoundaryPolicyRulesAccessBoundaryRule
Typed helper for the rules.access_boundary_rule block of google_iam_access_boundary_policy (derived from provider schema).
IamAccessBoundaryPolicyRulesAccessBoundaryRuleAvailabilityCondition
Typed helper for the rules.access_boundary_rule.availability_condition block of google_iam_access_boundary_policy (derived from provider schema).
IamDenyPolicyRules
Typed helper for the rules block of google_iam_deny_policy (derived from provider schema).
IamDenyPolicyRulesDenyRule
Typed helper for the rules.deny_rule block of google_iam_deny_policy (derived from provider schema).
IamDenyPolicyRulesDenyRuleDenialCondition
Typed helper for the rules.deny_rule.denial_condition block of google_iam_deny_policy (derived from provider schema).
IamFoldersPolicyBindingCondition
Typed helper for the condition block of google_iam_folders_policy_binding (derived from provider schema).
IamFoldersPolicyBindingTarget
Typed helper for the target block of google_iam_folders_policy_binding (derived from provider schema).
IamOrganizationsPolicyBindingCondition
Typed helper for the condition block of google_iam_organizations_policy_binding (derived from provider schema).
IamOrganizationsPolicyBindingTarget
Typed helper for the target block of google_iam_organizations_policy_binding (derived from provider schema).
IamPrincipalAccessBoundaryPolicyDetails
Typed helper for the details block of google_iam_principal_access_boundary_policy (derived from provider schema).
IamPrincipalAccessBoundaryPolicyDetailsRules
Typed helper for the details.rules block of google_iam_principal_access_boundary_policy (derived from provider schema).
IamProjectsPolicyBindingCondition
Typed helper for the condition block of google_iam_projects_policy_binding (derived from provider schema).
IamProjectsPolicyBindingTarget
Typed helper for the target block of google_iam_projects_policy_binding (derived from provider schema).
IamWorkforcePoolAccessRestrictions
Typed helper for the access_restrictions block of google_iam_workforce_pool (derived from provider schema).
IamWorkforcePoolAccessRestrictionsAllowedServices
Typed helper for the access_restrictions.allowed_services block of google_iam_workforce_pool (derived from provider schema).
IamWorkforcePoolProviderExtendedAttributesOauth2Client
Typed helper for the extended_attributes_oauth2_client block of google_iam_workforce_pool_provider (derived from provider schema).
IamWorkforcePoolProviderExtendedAttributesOauth2ClientClientSecret
Typed helper for the extended_attributes_oauth2_client.client_secret block of google_iam_workforce_pool_provider (derived from provider schema).
IamWorkforcePoolProviderExtendedAttributesOauth2ClientClientSecretValue
Typed helper for the extended_attributes_oauth2_client.client_secret.value block of google_iam_workforce_pool_provider (derived from provider schema).
IamWorkforcePoolProviderExtendedAttributesOauth2ClientQueryParameters
Typed helper for the extended_attributes_oauth2_client.query_parameters block of google_iam_workforce_pool_provider (derived from provider schema).
IamWorkforcePoolProviderKeyKeyData
Typed helper for the key_data block of google_iam_workforce_pool_provider_key (derived from provider schema).
IamWorkforcePoolProviderOidcTrust
OIDC identity provider.
IamWorkforcePoolProviderSaml
Typed helper for the saml block of google_iam_workforce_pool_provider (derived from provider schema).
IamWorkforcePoolProviderSamlTrust
SAML 2.0 identity provider.
IamWorkforcePoolProviderTrustSource
Trust binding for GoogleIamWorkforcePoolProvider. Sealed so the provider's exactly_one_of across oidc / saml is exhaustive.
IamWorkloadIdentityPoolProviderAwsTrust
AWS trust configuration.
IamWorkloadIdentityPoolProviderOidcTrust
OIDC trust configuration (generic OIDC / GitHub Actions).
IamWorkloadIdentityPoolProviderSamlTrust
SAML 2.0 trust configuration.
IamWorkloadIdentityPoolProviderTrustSource
Trust binding for GoogleIamWorkloadIdentityPoolProvider. Sealed so the provider's exactly_one_of across oidc / aws / saml / x509 is exhaustive at the type level.
IamWorkloadIdentityPoolProviderX509PemCertificate
PEM certificate entry for X.509 federation trust stores.
IamWorkloadIdentityPoolProviderX509Trust
X.509 certificate trust configuration.
IamWorkloadIdentityPoolProviderX509TrustStore
Trust store for IamWorkloadIdentityPoolProviderX509Trust.
ProjectIamAuditConfigAuditLogConfig
Typed helper for the audit_log_config block of google_project_iam_audit_config (derived from provider schema).

Enums

CustomRoleStage
Lifecycle stage for GoogleProjectIamCustomRole.stage. Mirrors the stage field exposed by the IAM API — alpha / beta / ga are grantable; deprecated / disabled keep the role visible but reject new bindings.
IamWorkforcePoolProviderKeyKeyDataKeySpec
key_spec — derived from the provider schema description.
KeyAlgorithm
Signing algorithm for GoogleServiceAccountKey.keyAlgorithm. GCP supports RSA-1024 (legacy) and RSA-2048 (default); unspecified lets the API pick.
PrivateKeyType
Output format for the emitted private key (GoogleServiceAccountKey.privateKeyType). googleCredentialsFile (the default) returns a JSON credentials file matching what gcloud iam service-accounts keys create emits; pkcs12File returns a PKCS#12 keystore for systems that consume that format.
ProjectIamAuditConfigAuditLogConfigLogType
Permission type for which IAM audit logging is configured.
PublicKeyType
Output format for the public key half (GoogleServiceAccountKey.publicKeyType). x509PemFile is the most portable choice; rawPublicKey returns just the key material.
WorkloadIdentityPoolMode
Operating mode for a workload identity pool.