@atensec/pulumi-thoth 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/.gitattributes +1 -0
  2. package/Pulumi.yaml +3 -0
  3. package/README.md +4 -0
  4. package/access/apiKey.ts +239 -0
  5. package/access/getApiKeyMetrics.ts +31 -0
  6. package/access/index.ts +30 -0
  7. package/browser/enrollment.ts +218 -0
  8. package/browser/index.ts +41 -0
  9. package/browser/policy.ts +256 -0
  10. package/browser/provider.ts +186 -0
  11. package/config/index.ts +5 -0
  12. package/config/vars.ts +119 -0
  13. package/governance/approvalDecision.ts +141 -0
  14. package/governance/getFeed.ts +102 -0
  15. package/governance/getTenantSettings.ts +33 -0
  16. package/governance/getTools.ts +52 -0
  17. package/governance/index.ts +72 -0
  18. package/governance/packAssignment.ts +213 -0
  19. package/governance/policySync.ts +233 -0
  20. package/governance/tenantSettings.ts +579 -0
  21. package/governance/webhookTest.ts +131 -0
  22. package/index.ts +34 -0
  23. package/mdm/getSyncJob.ts +53 -0
  24. package/mdm/index.ts +38 -0
  25. package/mdm/provider.ts +218 -0
  26. package/mdm/sync.ts +230 -0
  27. package/package.json +29 -0
  28. package/provider.ts +144 -0
  29. package/tsconfig.json +48 -0
  30. package/utilities.ts +96 -0
package/governance/tenantSettings.ts ADDED
@@ -0,0 +1,579 @@
1
+ // *** WARNING: this file was generated by pulumi-language-nodejs. ***
2
+ // *** Do not edit by hand unless you're certain you know what you are doing! ***
3
+
4
+ import * as pulumi from "@pulumi/pulumi";
5
+ import * as utilities from "../utilities";
6
+
7
+ export class TenantSettings extends pulumi.CustomResource {
8
+ /**
9
+ * Get an existing TenantSettings resource's state with the given name, ID, and optional extra
10
+ * properties used to qualify the lookup.
11
+ *
12
+ * @param name The _unique_ name of the resulting resource.
13
+ * @param id The _unique_ provider ID of the resource to lookup.
14
+ * @param state Any extra arguments used during the lookup.
15
+ * @param opts Optional settings to control the behavior of the CustomResource.
16
+ */
17
+ public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: TenantSettingsState, opts?: pulumi.CustomResourceOptions): TenantSettings {
18
+ return new TenantSettings(name, <any>state, { ...opts, id: id });
19
+ }
20
+
21
+ /** @internal */
22
+ public static readonly __pulumiType = 'thoth:governance/tenantSettings:TenantSettings';
23
+
24
+ /**
25
+ * Returns true if the given object is an instance of TenantSettings. This is designed to work even
26
+ * when multiple copies of the Pulumi SDK have been loaded into the same process.
27
+ */
28
+ public static isInstance(obj: any): obj is TenantSettings {
29
+ if (obj === undefined || obj === null) {
30
+ return false;
31
+ }
32
+ return obj['__pulumiType'] === TenantSettings.__pulumiType;
33
+ }
34
+
35
+ /**
36
+ * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
37
+ */
38
+ declare public readonly complianceProfile: pulumi.Output<string | undefined>;
39
+ /**
40
+ * Additional JSON object merged into the outgoing settings payload for forward compatibility.
41
+ */
42
+ declare public readonly extraSettingsJson: pulumi.Output<string | undefined>;
43
+ /**
44
+ * Allowed model names allowlist.
45
+ */
46
+ declare public readonly modelRouterAllowedModels: pulumi.Output<string[] | undefined>;
47
+ /**
48
+ * Allowed model providers allowlist.
49
+ */
50
+ declare public readonly modelRouterAllowedProviders: pulumi.Output<string[] | undefined>;
51
+ /**
52
+ * Default model name.
53
+ */
54
+ declare public readonly modelRouterDefaultModel: pulumi.Output<string | undefined>;
55
+ /**
56
+ * Default model provider.
57
+ */
58
+ declare public readonly modelRouterDefaultProvider: pulumi.Output<string | undefined>;
59
+ /**
60
+ * Enable model routing policy controls.
61
+ */
62
+ declare public readonly modelRouterEnabled: pulumi.Output<boolean | undefined>;
63
+ /**
64
+ * Failover provider order.
65
+ */
66
+ declare public readonly modelRouterFailoverProviders: pulumi.Output<string[] | undefined>;
67
+ /**
68
+ * Shared secret for PAM callback validation.
69
+ */
70
+ declare public readonly pamCallbackSecret: pulumi.Output<string | undefined>;
71
+ /**
72
+ * Enable PAM step-up callback integration.
73
+ */
74
+ declare public readonly pamEnabled: pulumi.Output<boolean | undefined>;
75
+ /**
76
+ * PAM provider slug.
77
+ */
78
+ declare public readonly pamProvider: pulumi.Output<string | undefined>;
79
+ /**
80
+ * Outbound PAM auth token.
81
+ */
82
+ declare public readonly pamRequestAuthToken: pulumi.Output<string | undefined>;
83
+ /**
84
+ * Outbound PAM request secret.
85
+ */
86
+ declare public readonly pamRequestSecret: pulumi.Output<string | undefined>;
87
+ /**
88
+ * Outbound PAM request timeout in seconds.
89
+ */
90
+ declare public readonly pamRequestTimeoutSeconds: pulumi.Output<number | undefined>;
91
+ /**
92
+ * Outbound PAM request URL.
93
+ */
94
+ declare public readonly pamRequestUrl: pulumi.Output<string | undefined>;
95
+ /**
96
+ * Allowed host patterns for secret broker.
97
+ */
98
+ declare public readonly secretBrokerAllowedHosts: pulumi.Output<string[] | undefined>;
99
+ /**
100
+ * JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
101
+ */
102
+ declare public readonly secretBrokerAuthBindingsJson: pulumi.Output<string | undefined>;
103
+ /**
104
+ * Enable secret broker policy enforcement.
105
+ */
106
+ declare public readonly secretBrokerEnabled: pulumi.Output<boolean | undefined>;
107
+ /**
108
+ * Fail governed calls when referenced secret is unavailable.
109
+ */
110
+ declare public readonly secretBrokerFailOnMissingSecret: pulumi.Output<boolean | undefined>;
111
+ /**
112
+ * Secret broker provider slug.
113
+ */
114
+ declare public readonly secretBrokerProvider: pulumi.Output<string | undefined>;
115
+ /**
116
+ * Require endpoint registration for secret resolution.
117
+ */
118
+ declare public readonly secretBrokerStrictEndpointMode: pulumi.Output<boolean | undefined>;
119
+ /**
120
+ * Default action for critical risk events.
121
+ */
122
+ declare public readonly shadowCritical: pulumi.Output<string | undefined>;
123
+ /**
124
+ * Default action for high risk events.
125
+ */
126
+ declare public readonly shadowHigh: pulumi.Output<string | undefined>;
127
+ /**
128
+ * Default action for low risk events.
129
+ */
130
+ declare public readonly shadowLow: pulumi.Output<string | undefined>;
131
+ /**
132
+ * Default action for medium risk events.
133
+ */
134
+ declare public readonly shadowMedium: pulumi.Output<string | undefined>;
135
+ /**
136
+ * SIEM provider slug.
137
+ */
138
+ declare public readonly siemProvider: pulumi.Output<string | undefined>;
139
+ /**
140
+ * Enable SIEM webhook delivery.
141
+ */
142
+ declare public readonly siemWebhookEnabled: pulumi.Output<boolean | undefined>;
143
+ /**
144
+ * SIEM webhook provider slug.
145
+ */
146
+ declare public readonly siemWebhookProvider: pulumi.Output<string | undefined>;
147
+ /**
148
+ * SIEM webhook signing secret.
149
+ */
150
+ declare public readonly siemWebhookSecret: pulumi.Output<string | undefined>;
151
+ /**
152
+ * SIEM webhook URL.
153
+ */
154
+ declare public readonly siemWebhookUrl: pulumi.Output<string | undefined>;
155
+ /**
156
+ * Tenant ID resolved from provider configuration.
157
+ */
158
+ declare public /*out*/ readonly tenantId: pulumi.Output<string>;
159
+ /**
160
+ * Run webhook test endpoint after applying settings.
161
+ */
162
+ declare public readonly testWebhookOnApply: pulumi.Output<boolean | undefined>;
163
+ /**
164
+ * Tool-specific risk tier overrides.
165
+ */
166
+ declare public readonly toolRiskOverrides: pulumi.Output<{[key: string]: string} | undefined>;
167
+ /**
168
+ * Last update timestamp returned by GovAPI.
169
+ */
170
+ declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
171
+ /**
172
+ * Enable outbound webhook delivery.
173
+ */
174
+ declare public readonly webhookEnabled: pulumi.Output<boolean | undefined>;
175
+ /**
176
+ * Webhook signing secret.
177
+ */
178
+ declare public readonly webhookSecret: pulumi.Output<string | undefined>;
179
+ /**
180
+ * Outbound webhook URL.
181
+ */
182
+ declare public readonly webhookUrl: pulumi.Output<string | undefined>;
183
+
184
+ /**
185
+ * Create a TenantSettings resource with the given unique name, arguments, and options.
186
+ *
187
+ * @param name The _unique_ name of the resource.
188
+ * @param args The arguments to use to populate this resource's properties.
189
+ * @param opts A bag of options that control this resource's behavior.
190
+ */
191
+ constructor(name: string, args?: TenantSettingsArgs, opts?: pulumi.CustomResourceOptions)
192
+ constructor(name: string, argsOrState?: TenantSettingsArgs | TenantSettingsState, opts?: pulumi.CustomResourceOptions) {
193
+ let resourceInputs: pulumi.Inputs = {};
194
+ opts = opts || {};
195
+ if (opts.id) {
196
+ const state = argsOrState as TenantSettingsState | undefined;
197
+ resourceInputs["complianceProfile"] = state?.complianceProfile;
198
+ resourceInputs["extraSettingsJson"] = state?.extraSettingsJson;
199
+ resourceInputs["modelRouterAllowedModels"] = state?.modelRouterAllowedModels;
200
+ resourceInputs["modelRouterAllowedProviders"] = state?.modelRouterAllowedProviders;
201
+ resourceInputs["modelRouterDefaultModel"] = state?.modelRouterDefaultModel;
202
+ resourceInputs["modelRouterDefaultProvider"] = state?.modelRouterDefaultProvider;
203
+ resourceInputs["modelRouterEnabled"] = state?.modelRouterEnabled;
204
+ resourceInputs["modelRouterFailoverProviders"] = state?.modelRouterFailoverProviders;
205
+ resourceInputs["pamCallbackSecret"] = state?.pamCallbackSecret;
206
+ resourceInputs["pamEnabled"] = state?.pamEnabled;
207
+ resourceInputs["pamProvider"] = state?.pamProvider;
208
+ resourceInputs["pamRequestAuthToken"] = state?.pamRequestAuthToken;
209
+ resourceInputs["pamRequestSecret"] = state?.pamRequestSecret;
210
+ resourceInputs["pamRequestTimeoutSeconds"] = state?.pamRequestTimeoutSeconds;
211
+ resourceInputs["pamRequestUrl"] = state?.pamRequestUrl;
212
+ resourceInputs["secretBrokerAllowedHosts"] = state?.secretBrokerAllowedHosts;
213
+ resourceInputs["secretBrokerAuthBindingsJson"] = state?.secretBrokerAuthBindingsJson;
214
+ resourceInputs["secretBrokerEnabled"] = state?.secretBrokerEnabled;
215
+ resourceInputs["secretBrokerFailOnMissingSecret"] = state?.secretBrokerFailOnMissingSecret;
216
+ resourceInputs["secretBrokerProvider"] = state?.secretBrokerProvider;
217
+ resourceInputs["secretBrokerStrictEndpointMode"] = state?.secretBrokerStrictEndpointMode;
218
+ resourceInputs["shadowCritical"] = state?.shadowCritical;
219
+ resourceInputs["shadowHigh"] = state?.shadowHigh;
220
+ resourceInputs["shadowLow"] = state?.shadowLow;
221
+ resourceInputs["shadowMedium"] = state?.shadowMedium;
222
+ resourceInputs["siemProvider"] = state?.siemProvider;
223
+ resourceInputs["siemWebhookEnabled"] = state?.siemWebhookEnabled;
224
+ resourceInputs["siemWebhookProvider"] = state?.siemWebhookProvider;
225
+ resourceInputs["siemWebhookSecret"] = state?.siemWebhookSecret;
226
+ resourceInputs["siemWebhookUrl"] = state?.siemWebhookUrl;
227
+ resourceInputs["tenantId"] = state?.tenantId;
228
+ resourceInputs["testWebhookOnApply"] = state?.testWebhookOnApply;
229
+ resourceInputs["toolRiskOverrides"] = state?.toolRiskOverrides;
230
+ resourceInputs["updatedAt"] = state?.updatedAt;
231
+ resourceInputs["webhookEnabled"] = state?.webhookEnabled;
232
+ resourceInputs["webhookSecret"] = state?.webhookSecret;
233
+ resourceInputs["webhookUrl"] = state?.webhookUrl;
234
+ } else {
235
+ const args = argsOrState as TenantSettingsArgs | undefined;
236
+ resourceInputs["complianceProfile"] = args?.complianceProfile;
237
+ resourceInputs["extraSettingsJson"] = args?.extraSettingsJson;
238
+ resourceInputs["modelRouterAllowedModels"] = args?.modelRouterAllowedModels;
239
+ resourceInputs["modelRouterAllowedProviders"] = args?.modelRouterAllowedProviders;
240
+ resourceInputs["modelRouterDefaultModel"] = args?.modelRouterDefaultModel;
241
+ resourceInputs["modelRouterDefaultProvider"] = args?.modelRouterDefaultProvider;
242
+ resourceInputs["modelRouterEnabled"] = args?.modelRouterEnabled;
243
+ resourceInputs["modelRouterFailoverProviders"] = args?.modelRouterFailoverProviders;
244
+ resourceInputs["pamCallbackSecret"] = args?.pamCallbackSecret ? pulumi.secret(args.pamCallbackSecret) : undefined;
245
+ resourceInputs["pamEnabled"] = args?.pamEnabled;
246
+ resourceInputs["pamProvider"] = args?.pamProvider;
247
+ resourceInputs["pamRequestAuthToken"] = args?.pamRequestAuthToken ? pulumi.secret(args.pamRequestAuthToken) : undefined;
248
+ resourceInputs["pamRequestSecret"] = args?.pamRequestSecret ? pulumi.secret(args.pamRequestSecret) : undefined;
249
+ resourceInputs["pamRequestTimeoutSeconds"] = args?.pamRequestTimeoutSeconds;
250
+ resourceInputs["pamRequestUrl"] = args?.pamRequestUrl;
251
+ resourceInputs["secretBrokerAllowedHosts"] = args?.secretBrokerAllowedHosts;
252
+ resourceInputs["secretBrokerAuthBindingsJson"] = args?.secretBrokerAuthBindingsJson;
253
+ resourceInputs["secretBrokerEnabled"] = args?.secretBrokerEnabled;
254
+ resourceInputs["secretBrokerFailOnMissingSecret"] = args?.secretBrokerFailOnMissingSecret;
255
+ resourceInputs["secretBrokerProvider"] = args?.secretBrokerProvider;
256
+ resourceInputs["secretBrokerStrictEndpointMode"] = args?.secretBrokerStrictEndpointMode;
257
+ resourceInputs["shadowCritical"] = args?.shadowCritical;
258
+ resourceInputs["shadowHigh"] = args?.shadowHigh;
259
+ resourceInputs["shadowLow"] = args?.shadowLow;
260
+ resourceInputs["shadowMedium"] = args?.shadowMedium;
261
+ resourceInputs["siemProvider"] = args?.siemProvider;
262
+ resourceInputs["siemWebhookEnabled"] = args?.siemWebhookEnabled;
263
+ resourceInputs["siemWebhookProvider"] = args?.siemWebhookProvider;
264
+ resourceInputs["siemWebhookSecret"] = args?.siemWebhookSecret ? pulumi.secret(args.siemWebhookSecret) : undefined;
265
+ resourceInputs["siemWebhookUrl"] = args?.siemWebhookUrl;
266
+ resourceInputs["testWebhookOnApply"] = args?.testWebhookOnApply;
267
+ resourceInputs["toolRiskOverrides"] = args?.toolRiskOverrides;
268
+ resourceInputs["webhookEnabled"] = args?.webhookEnabled;
269
+ resourceInputs["webhookSecret"] = args?.webhookSecret ? pulumi.secret(args.webhookSecret) : undefined;
270
+ resourceInputs["webhookUrl"] = args?.webhookUrl;
271
+ resourceInputs["tenantId"] = undefined /*out*/;
272
+ resourceInputs["updatedAt"] = undefined /*out*/;
273
+ }
274
+ opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
275
+ const secretOpts = { additionalSecretOutputs: ["pamCallbackSecret", "pamRequestAuthToken", "pamRequestSecret", "siemWebhookSecret", "webhookSecret"] };
276
+ opts = pulumi.mergeOptions(opts, secretOpts);
277
+ super(TenantSettings.__pulumiType, name, resourceInputs, opts);
278
+ }
279
+ }
280
+
281
+ /**
282
+ * Input properties used for looking up and filtering TenantSettings resources.
283
+ */
284
+ export interface TenantSettingsState {
285
+ /**
286
+ * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
287
+ */
288
+ complianceProfile?: pulumi.Input<string | undefined>;
289
+ /**
290
+ * Additional JSON object merged into the outgoing settings payload for forward compatibility.
291
+ */
292
+ extraSettingsJson?: pulumi.Input<string | undefined>;
293
+ /**
294
+ * Allowed model names allowlist.
295
+ */
296
+ modelRouterAllowedModels?: pulumi.Input<pulumi.Input<string>[] | undefined>;
297
+ /**
298
+ * Allowed model providers allowlist.
299
+ */
300
+ modelRouterAllowedProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
301
+ /**
302
+ * Default model name.
303
+ */
304
+ modelRouterDefaultModel?: pulumi.Input<string | undefined>;
305
+ /**
306
+ * Default model provider.
307
+ */
308
+ modelRouterDefaultProvider?: pulumi.Input<string | undefined>;
309
+ /**
310
+ * Enable model routing policy controls.
311
+ */
312
+ modelRouterEnabled?: pulumi.Input<boolean | undefined>;
313
+ /**
314
+ * Failover provider order.
315
+ */
316
+ modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
317
+ /**
318
+ * Shared secret for PAM callback validation.
319
+ */
320
+ pamCallbackSecret?: pulumi.Input<string | undefined>;
321
+ /**
322
+ * Enable PAM step-up callback integration.
323
+ */
324
+ pamEnabled?: pulumi.Input<boolean | undefined>;
325
+ /**
326
+ * PAM provider slug.
327
+ */
328
+ pamProvider?: pulumi.Input<string | undefined>;
329
+ /**
330
+ * Outbound PAM auth token.
331
+ */
332
+ pamRequestAuthToken?: pulumi.Input<string | undefined>;
333
+ /**
334
+ * Outbound PAM request secret.
335
+ */
336
+ pamRequestSecret?: pulumi.Input<string | undefined>;
337
+ /**
338
+ * Outbound PAM request timeout in seconds.
339
+ */
340
+ pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
341
+ /**
342
+ * Outbound PAM request URL.
343
+ */
344
+ pamRequestUrl?: pulumi.Input<string | undefined>;
345
+ /**
346
+ * Allowed host patterns for secret broker.
347
+ */
348
+ secretBrokerAllowedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
349
+ /**
350
+ * JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
351
+ */
352
+ secretBrokerAuthBindingsJson?: pulumi.Input<string | undefined>;
353
+ /**
354
+ * Enable secret broker policy enforcement.
355
+ */
356
+ secretBrokerEnabled?: pulumi.Input<boolean | undefined>;
357
+ /**
358
+ * Fail governed calls when referenced secret is unavailable.
359
+ */
360
+ secretBrokerFailOnMissingSecret?: pulumi.Input<boolean | undefined>;
361
+ /**
362
+ * Secret broker provider slug.
363
+ */
364
+ secretBrokerProvider?: pulumi.Input<string | undefined>;
365
+ /**
366
+ * Require endpoint registration for secret resolution.
367
+ */
368
+ secretBrokerStrictEndpointMode?: pulumi.Input<boolean | undefined>;
369
+ /**
370
+ * Default action for critical risk events.
371
+ */
372
+ shadowCritical?: pulumi.Input<string | undefined>;
373
+ /**
374
+ * Default action for high risk events.
375
+ */
376
+ shadowHigh?: pulumi.Input<string | undefined>;
377
+ /**
378
+ * Default action for low risk events.
379
+ */
380
+ shadowLow?: pulumi.Input<string | undefined>;
381
+ /**
382
+ * Default action for medium risk events.
383
+ */
384
+ shadowMedium?: pulumi.Input<string | undefined>;
385
+ /**
386
+ * SIEM provider slug.
387
+ */
388
+ siemProvider?: pulumi.Input<string | undefined>;
389
+ /**
390
+ * Enable SIEM webhook delivery.
391
+ */
392
+ siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
393
+ /**
394
+ * SIEM webhook provider slug.
395
+ */
396
+ siemWebhookProvider?: pulumi.Input<string | undefined>;
397
+ /**
398
+ * SIEM webhook signing secret.
399
+ */
400
+ siemWebhookSecret?: pulumi.Input<string | undefined>;
401
+ /**
402
+ * SIEM webhook URL.
403
+ */
404
+ siemWebhookUrl?: pulumi.Input<string | undefined>;
405
+ /**
406
+ * Tenant ID resolved from provider configuration.
407
+ */
408
+ tenantId?: pulumi.Input<string | undefined>;
409
+ /**
410
+ * Run webhook test endpoint after applying settings.
411
+ */
412
+ testWebhookOnApply?: pulumi.Input<boolean | undefined>;
413
+ /**
414
+ * Tool-specific risk tier overrides.
415
+ */
416
+ toolRiskOverrides?: pulumi.Input<{[key: string]: pulumi.Input<string>} | undefined>;
417
+ /**
418
+ * Last update timestamp returned by GovAPI.
419
+ */
420
+ updatedAt?: pulumi.Input<string | undefined>;
421
+ /**
422
+ * Enable outbound webhook delivery.
423
+ */
424
+ webhookEnabled?: pulumi.Input<boolean | undefined>;
425
+ /**
426
+ * Webhook signing secret.
427
+ */
428
+ webhookSecret?: pulumi.Input<string | undefined>;
429
+ /**
430
+ * Outbound webhook URL.
431
+ */
432
+ webhookUrl?: pulumi.Input<string | undefined>;
433
+ }
434
+
435
+ /**
436
+ * The set of arguments for constructing a TenantSettings resource.
437
+ */
438
+ export interface TenantSettingsArgs {
439
+ /**
440
+ * Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
441
+ */
442
+ complianceProfile?: pulumi.Input<string | undefined>;
443
+ /**
444
+ * Additional JSON object merged into the outgoing settings payload for forward compatibility.
445
+ */
446
+ extraSettingsJson?: pulumi.Input<string | undefined>;
447
+ /**
448
+ * Allowed model names allowlist.
449
+ */
450
+ modelRouterAllowedModels?: pulumi.Input<pulumi.Input<string>[] | undefined>;
451
+ /**
452
+ * Allowed model providers allowlist.
453
+ */
454
+ modelRouterAllowedProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
455
+ /**
456
+ * Default model name.
457
+ */
458
+ modelRouterDefaultModel?: pulumi.Input<string | undefined>;
459
+ /**
460
+ * Default model provider.
461
+ */
462
+ modelRouterDefaultProvider?: pulumi.Input<string | undefined>;
463
+ /**
464
+ * Enable model routing policy controls.
465
+ */
466
+ modelRouterEnabled?: pulumi.Input<boolean | undefined>;
467
+ /**
468
+ * Failover provider order.
469
+ */
470
+ modelRouterFailoverProviders?: pulumi.Input<pulumi.Input<string>[] | undefined>;
471
+ /**
472
+ * Shared secret for PAM callback validation.
473
+ */
474
+ pamCallbackSecret?: pulumi.Input<string | undefined>;
475
+ /**
476
+ * Enable PAM step-up callback integration.
477
+ */
478
+ pamEnabled?: pulumi.Input<boolean | undefined>;
479
+ /**
480
+ * PAM provider slug.
481
+ */
482
+ pamProvider?: pulumi.Input<string | undefined>;
483
+ /**
484
+ * Outbound PAM auth token.
485
+ */
486
+ pamRequestAuthToken?: pulumi.Input<string | undefined>;
487
+ /**
488
+ * Outbound PAM request secret.
489
+ */
490
+ pamRequestSecret?: pulumi.Input<string | undefined>;
491
+ /**
492
+ * Outbound PAM request timeout in seconds.
493
+ */
494
+ pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
495
+ /**
496
+ * Outbound PAM request URL.
497
+ */
498
+ pamRequestUrl?: pulumi.Input<string | undefined>;
499
+ /**
500
+ * Allowed host patterns for secret broker.
501
+ */
502
+ secretBrokerAllowedHosts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
503
+ /**
504
+ * JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
505
+ */
506
+ secretBrokerAuthBindingsJson?: pulumi.Input<string | undefined>;
507
+ /**
508
+ * Enable secret broker policy enforcement.
509
+ */
510
+ secretBrokerEnabled?: pulumi.Input<boolean | undefined>;
511
+ /**
512
+ * Fail governed calls when referenced secret is unavailable.
513
+ */
514
+ secretBrokerFailOnMissingSecret?: pulumi.Input<boolean | undefined>;
515
+ /**
516
+ * Secret broker provider slug.
517
+ */
518
+ secretBrokerProvider?: pulumi.Input<string | undefined>;
519
+ /**
520
+ * Require endpoint registration for secret resolution.
521
+ */
522
+ secretBrokerStrictEndpointMode?: pulumi.Input<boolean | undefined>;
523
+ /**
524
+ * Default action for critical risk events.
525
+ */
526
+ shadowCritical?: pulumi.Input<string | undefined>;
527
+ /**
528
+ * Default action for high risk events.
529
+ */
530
+ shadowHigh?: pulumi.Input<string | undefined>;
531
+ /**
532
+ * Default action for low risk events.
533
+ */
534
+ shadowLow?: pulumi.Input<string | undefined>;
535
+ /**
536
+ * Default action for medium risk events.
537
+ */
538
+ shadowMedium?: pulumi.Input<string | undefined>;
539
+ /**
540
+ * SIEM provider slug.
541
+ */
542
+ siemProvider?: pulumi.Input<string | undefined>;
543
+ /**
544
+ * Enable SIEM webhook delivery.
545
+ */
546
+ siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
547
+ /**
548
+ * SIEM webhook provider slug.
549
+ */
550
+ siemWebhookProvider?: pulumi.Input<string | undefined>;
551
+ /**
552
+ * SIEM webhook signing secret.
553
+ */
554
+ siemWebhookSecret?: pulumi.Input<string | undefined>;
555
+ /**
556
+ * SIEM webhook URL.
557
+ */
558
+ siemWebhookUrl?: pulumi.Input<string | undefined>;
559
+ /**
560
+ * Run webhook test endpoint after applying settings.
561
+ */
562
+ testWebhookOnApply?: pulumi.Input<boolean | undefined>;
563
+ /**
564
+ * Tool-specific risk tier overrides.
565
+ */
566
+ toolRiskOverrides?: pulumi.Input<{[key: string]: pulumi.Input<string>} | undefined>;
567
+ /**
568
+ * Enable outbound webhook delivery.
569
+ */
570
+ webhookEnabled?: pulumi.Input<boolean | undefined>;
571
+ /**
572
+ * Webhook signing secret.
573
+ */
574
+ webhookSecret?: pulumi.Input<string | undefined>;
575
+ /**
576
+ * Outbound webhook URL.
577
+ */
578
+ webhookUrl?: pulumi.Input<string | undefined>;
579
+ }