1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. iam
  5. getWorkloadIdentityPoolProvider
Google Cloud Classic v7.29.0 published on Wednesday, Jun 26, 2024 by Pulumi

gcp.iam.getWorkloadIdentityPoolProvider

Explore with Pulumi AI

gcp logo
Google Cloud Classic v7.29.0 published on Wednesday, Jun 26, 2024 by Pulumi

    Get a IAM workload identity provider from Google Cloud by its id.

    Example Usage

    data "google_iam_workload_identity_pool_provider" "foo" {
      workload_identity_pool_id          = "foo-pool"
      workload_identity_pool_provider_id = "bar-provider"
    }
    

    Using getWorkloadIdentityPoolProvider

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getWorkloadIdentityPoolProvider(args: GetWorkloadIdentityPoolProviderArgs, opts?: InvokeOptions): Promise<GetWorkloadIdentityPoolProviderResult>
    function getWorkloadIdentityPoolProviderOutput(args: GetWorkloadIdentityPoolProviderOutputArgs, opts?: InvokeOptions): Output<GetWorkloadIdentityPoolProviderResult>
    def get_workload_identity_pool_provider(project: Optional[str] = None,
                                            workload_identity_pool_id: Optional[str] = None,
                                            workload_identity_pool_provider_id: Optional[str] = None,
                                            opts: Optional[InvokeOptions] = None) -> GetWorkloadIdentityPoolProviderResult
    def get_workload_identity_pool_provider_output(project: Optional[pulumi.Input[str]] = None,
                                            workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
                                            workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
                                            opts: Optional[InvokeOptions] = None) -> Output[GetWorkloadIdentityPoolProviderResult]
    func LookupWorkloadIdentityPoolProvider(ctx *Context, args *LookupWorkloadIdentityPoolProviderArgs, opts ...InvokeOption) (*LookupWorkloadIdentityPoolProviderResult, error)
    func LookupWorkloadIdentityPoolProviderOutput(ctx *Context, args *LookupWorkloadIdentityPoolProviderOutputArgs, opts ...InvokeOption) LookupWorkloadIdentityPoolProviderResultOutput

    > Note: This function is named LookupWorkloadIdentityPoolProvider in the Go SDK.

    public static class GetWorkloadIdentityPoolProvider 
    {
        public static Task<GetWorkloadIdentityPoolProviderResult> InvokeAsync(GetWorkloadIdentityPoolProviderArgs args, InvokeOptions? opts = null)
        public static Output<GetWorkloadIdentityPoolProviderResult> Invoke(GetWorkloadIdentityPoolProviderInvokeArgs args, InvokeOptions? opts = null)
    }
    public static CompletableFuture<GetWorkloadIdentityPoolProviderResult> getWorkloadIdentityPoolProvider(GetWorkloadIdentityPoolProviderArgs args, InvokeOptions options)
    // Output-based functions aren't available in Java yet
    
    fn::invoke:
      function: gcp:iam/getWorkloadIdentityPoolProvider:getWorkloadIdentityPoolProvider
      arguments:
        # arguments dictionary

    The following arguments are supported:

    WorkloadIdentityPoolId string
    The id of the pool which is the final component of the pool resource name.
    WorkloadIdentityPoolProviderId string
    The id of the provider which is the final component of the resource name.


    Project string
    The project in which the resource belongs. If it is not provided, the provider project is used.
    WorkloadIdentityPoolId string
    The id of the pool which is the final component of the pool resource name.
    WorkloadIdentityPoolProviderId string
    The id of the provider which is the final component of the resource name.


    Project string
    The project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId String
    The id of the pool which is the final component of the pool resource name.
    workloadIdentityPoolProviderId String
    The id of the provider which is the final component of the resource name.


    project String
    The project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId string
    The id of the pool which is the final component of the pool resource name.
    workloadIdentityPoolProviderId string
    The id of the provider which is the final component of the resource name.


    project string
    The project in which the resource belongs. If it is not provided, the provider project is used.
    workload_identity_pool_id str
    The id of the pool which is the final component of the pool resource name.
    workload_identity_pool_provider_id str
    The id of the provider which is the final component of the resource name.


    project str
    The project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId String
    The id of the pool which is the final component of the pool resource name.
    workloadIdentityPoolProviderId String
    The id of the provider which is the final component of the resource name.


    project String
    The project in which the resource belongs. If it is not provided, the provider project is used.

    getWorkloadIdentityPoolProvider Result

    The following output properties are available:

    attributeCondition String
    attributeMapping Map<String>
    aws List<Property Map>
    description String
    disabled Boolean
    displayName String
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    oidcs List<Property Map>
    samls List<Property Map>
    state String
    workloadIdentityPoolId String
    workloadIdentityPoolProviderId String
    project String

    Supporting Types

    GetWorkloadIdentityPoolProviderAw

    AccountId string
    The AWS account ID.
    AccountId string
    The AWS account ID.
    accountId String
    The AWS account ID.
    accountId string
    The AWS account ID.
    account_id str
    The AWS account ID.
    accountId String
    The AWS account ID.

    GetWorkloadIdentityPoolProviderOidc

    AllowedAudiences List<string>

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    IssuerUri string
    The OIDC issuer URL.
    JwksJson string
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''
    AllowedAudiences []string

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    IssuerUri string
    The OIDC issuer URL.
    JwksJson string
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''
    allowedAudiences List<String>

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    issuerUri String
    The OIDC issuer URL.
    jwksJson String
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''
    allowedAudiences string[]

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    issuerUri string
    The OIDC issuer URL.
    jwksJson string
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''
    allowed_audiences Sequence[str]

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    issuer_uri str
    The OIDC issuer URL.
    jwks_json str
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''
    allowedAudiences List<String>

    Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

    If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

    issuerUri String
    The OIDC issuer URL.
    jwksJson String
    OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''

    GetWorkloadIdentityPoolProviderSaml

    IdpMetadataXml string
    SAML Identity provider configuration metadata xml doc.
    IdpMetadataXml string
    SAML Identity provider configuration metadata xml doc.
    idpMetadataXml String
    SAML Identity provider configuration metadata xml doc.
    idpMetadataXml string
    SAML Identity provider configuration metadata xml doc.
    idp_metadata_xml str
    SAML Identity provider configuration metadata xml doc.
    idpMetadataXml String
    SAML Identity provider configuration metadata xml doc.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Google Cloud Classic v7.29.0 published on Wednesday, Jun 26, 2024 by Pulumi