@atensec/pulumi-thoth 0.1.12 → 0.1.13

package/governance/policyChangeArtifactApply.ts

@@ -0,0 +1,269 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyChangeArtifactApply extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyChangeArtifactApply resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyChangeArtifactApplyState, opts?: pulumi.CustomResourceOptions): PolicyChangeArtifactApply {
+        return new PolicyChangeArtifactApply(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyChangeArtifactApply:PolicyChangeArtifactApply';
+
+    /**
+     * Returns true if the given object is an instance of PolicyChangeArtifactApply.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyChangeArtifactApply {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyChangeArtifactApply.__pulumiType;
+    }
+
+    /**
+     * Apply execution timestamp.
+     */
+    declare public /*out*/ readonly appliedAt: pulumi.Output<string>;
+    /**
+     * Actor applying the artifact.
+     */
+    declare public readonly appliedBy: pulumi.Output<string>;
+    /**
+     * Apply channel to use. Defaults to govapi.
+     */
+    declare public readonly applyChannel: pulumi.Output<string | undefined>;
+    /**
+     * Artifact ID used for apply.
+     */
+    declare public /*out*/ readonly artifactId: pulumi.Output<string>;
+    /**
+     * Optional assignment targets for govapi policy bundle apply.
+     */
+    declare public readonly assignments: pulumi.Output<string[] | undefined>;
+    /**
+     * Optional bundle description for govapi apply.
+     */
+    declare public readonly bundleDescription: pulumi.Output<string | undefined>;
+    /**
+     * Optional override bundle name for govapi apply.
+     */
+    declare public readonly bundleName: pulumi.Output<string | undefined>;
+    /**
+     * Optional enforcement mode override (enforce or observe).
+     */
+    declare public readonly enforcementMode: pulumi.Output<string | undefined>;
+    /**
+     * GovAPI resource returned by apply operation as JSON.
+     */
+    declare public /*out*/ readonly govapiResourceJson: pulumi.Output<string>;
+    /**
+     * Whether a temporary runtime override was revoked after apply.
+     */
+    declare public /*out*/ readonly overrideRevoked: pulumi.Output<boolean>;
+    /**
+     * Preferred policy format for apply payload (cedar, rego, yaml).
+     */
+    declare public readonly policyFormat: pulumi.Output<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    declare public readonly requestId: pulumi.Output<string>;
+    /**
+     * Full apply response as JSON.
+     */
+    declare public /*out*/ readonly responseJson: pulumi.Output<string>;
+    /**
+     * Optional policy bundle status override (active, staged, paused, disabled).
+     */
+    declare public readonly status: pulumi.Output<string | undefined>;
+    /**
+     * Target environment for the apply operation.
+     */
+    declare public /*out*/ readonly targetEnvironment: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+
+    /**
+     * Create a PolicyChangeArtifactApply resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyChangeArtifactApplyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyChangeArtifactApplyArgs | PolicyChangeArtifactApplyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyChangeArtifactApplyState | undefined;
+            resourceInputs["appliedAt"] = state?.appliedAt;
+            resourceInputs["appliedBy"] = state?.appliedBy;
+            resourceInputs["applyChannel"] = state?.applyChannel;
+            resourceInputs["artifactId"] = state?.artifactId;
+            resourceInputs["assignments"] = state?.assignments;
+            resourceInputs["bundleDescription"] = state?.bundleDescription;
+            resourceInputs["bundleName"] = state?.bundleName;
+            resourceInputs["enforcementMode"] = state?.enforcementMode;
+            resourceInputs["govapiResourceJson"] = state?.govapiResourceJson;
+            resourceInputs["overrideRevoked"] = state?.overrideRevoked;
+            resourceInputs["policyFormat"] = state?.policyFormat;
+            resourceInputs["requestId"] = state?.requestId;
+            resourceInputs["responseJson"] = state?.responseJson;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["targetEnvironment"] = state?.targetEnvironment;
+            resourceInputs["tenantId"] = state?.tenantId;
+        } else {
+            const args = argsOrState as PolicyChangeArtifactApplyArgs | undefined;
+            if (args?.appliedBy === undefined && !opts.urn) {
+                throw new Error("Missing required property 'appliedBy'");
+            }
+            if (args?.requestId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'requestId'");
+            }
+            resourceInputs["appliedBy"] = args?.appliedBy;
+            resourceInputs["applyChannel"] = args?.applyChannel;
+            resourceInputs["assignments"] = args?.assignments;
+            resourceInputs["bundleDescription"] = args?.bundleDescription;
+            resourceInputs["bundleName"] = args?.bundleName;
+            resourceInputs["enforcementMode"] = args?.enforcementMode;
+            resourceInputs["policyFormat"] = args?.policyFormat;
+            resourceInputs["requestId"] = args?.requestId;
+            resourceInputs["status"] = args?.status;
+            resourceInputs["appliedAt"] = undefined /*out*/;
+            resourceInputs["artifactId"] = undefined /*out*/;
+            resourceInputs["govapiResourceJson"] = undefined /*out*/;
+            resourceInputs["overrideRevoked"] = undefined /*out*/;
+            resourceInputs["responseJson"] = undefined /*out*/;
+            resourceInputs["targetEnvironment"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PolicyChangeArtifactApply.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyChangeArtifactApply resources.
+ */
+export interface PolicyChangeArtifactApplyState {
+    /**
+     * Apply execution timestamp.
+     */
+    appliedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Actor applying the artifact.
+     */
+    appliedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Apply channel to use. Defaults to govapi.
+     */
+    applyChannel?: pulumi.Input<string | undefined>;
+    /**
+     * Artifact ID used for apply.
+     */
+    artifactId?: pulumi.Input<string | undefined>;
+    /**
+     * Optional assignment targets for govapi policy bundle apply.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional bundle description for govapi apply.
+     */
+    bundleDescription?: pulumi.Input<string | undefined>;
+    /**
+     * Optional override bundle name for govapi apply.
+     */
+    bundleName?: pulumi.Input<string | undefined>;
+    /**
+     * Optional enforcement mode override (enforce or observe).
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * GovAPI resource returned by apply operation as JSON.
+     */
+    govapiResourceJson?: pulumi.Input<string | undefined>;
+    /**
+     * Whether a temporary runtime override was revoked after apply.
+     */
+    overrideRevoked?: pulumi.Input<boolean | undefined>;
+    /**
+     * Preferred policy format for apply payload (cedar, rego, yaml).
+     */
+    policyFormat?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Full apply response as JSON.
+     */
+    responseJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy bundle status override (active, staged, paused, disabled).
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Target environment for the apply operation.
+     */
+    targetEnvironment?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyChangeArtifactApply resource.
+ */
+export interface PolicyChangeArtifactApplyArgs {
+    /**
+     * Actor applying the artifact.
+     */
+    appliedBy: pulumi.Input<string>;
+    /**
+     * Apply channel to use. Defaults to govapi.
+     */
+    applyChannel?: pulumi.Input<string | undefined>;
+    /**
+     * Optional assignment targets for govapi policy bundle apply.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional bundle description for govapi apply.
+     */
+    bundleDescription?: pulumi.Input<string | undefined>;
+    /**
+     * Optional override bundle name for govapi apply.
+     */
+    bundleName?: pulumi.Input<string | undefined>;
+    /**
+     * Optional enforcement mode override (enforce or observe).
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Preferred policy format for apply payload (cedar, rego, yaml).
+     */
+    policyFormat?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId: pulumi.Input<string>;
+    /**
+     * Optional policy bundle status override (active, staged, paused, disabled).
+     */
+    status?: pulumi.Input<string | undefined>;
+}

package/governance/policyException.ts

@@ -0,0 +1,302 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyException extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyException resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyExceptionState, opts?: pulumi.CustomResourceOptions): PolicyException {
+        return new PolicyException(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyException:PolicyException';
+
+    /**
+     * Returns true if the given object is an instance of PolicyException.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyException {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyException.__pulumiType;
+    }
+
+    /**
+     * Agent ID associated with the request.
+     */
+    declare public readonly agentId: pulumi.Output<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    declare public readonly alternativesConsidered: pulumi.Output<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    declare public readonly businessJustification: pulumi.Output<string>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    declare public readonly dataSensitivity: pulumi.Output<string>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    declare public readonly frequencyEstimate: pulumi.Output<string>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    declare public readonly holdToken: pulumi.Output<string | undefined>;
+    /**
+     * Policy change metadata returned by the review flow.
+     */
+    declare public /*out*/ readonly policyChangeJson: pulumi.Output<string>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    declare public readonly requestId: pulumi.Output<string>;
+    /**
+     * Requester identity.
+     */
+    declare public readonly requestedBy: pulumi.Output<string>;
+    /**
+     * Review decision when present.
+     */
+    declare public /*out*/ readonly reviewDecision: pulumi.Output<string>;
+    /**
+     * Review notes when present.
+     */
+    declare public /*out*/ readonly reviewNotes: pulumi.Output<string>;
+    /**
+     * Reviewer identity when present.
+     */
+    declare public /*out*/ readonly reviewedBy: pulumi.Output<string>;
+    /**
+     * Current policy exception status.
+     */
+    declare public /*out*/ readonly status: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    declare public readonly toolName: pulumi.Output<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    declare public readonly violationId: pulumi.Output<string>;
+
+    /**
+     * Create a PolicyException resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyExceptionArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyExceptionArgs | PolicyExceptionState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyExceptionState | undefined;
+            resourceInputs["agentId"] = state?.agentId;
+            resourceInputs["alternativesConsidered"] = state?.alternativesConsidered;
+            resourceInputs["businessJustification"] = state?.businessJustification;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["dataSensitivity"] = state?.dataSensitivity;
+            resourceInputs["frequencyEstimate"] = state?.frequencyEstimate;
+            resourceInputs["holdToken"] = state?.holdToken;
+            resourceInputs["policyChangeJson"] = state?.policyChangeJson;
+            resourceInputs["requestId"] = state?.requestId;
+            resourceInputs["requestedBy"] = state?.requestedBy;
+            resourceInputs["reviewDecision"] = state?.reviewDecision;
+            resourceInputs["reviewNotes"] = state?.reviewNotes;
+            resourceInputs["reviewedBy"] = state?.reviewedBy;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["toolName"] = state?.toolName;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["violationId"] = state?.violationId;
+        } else {
+            const args = argsOrState as PolicyExceptionArgs | undefined;
+            if (args?.businessJustification === undefined && !opts.urn) {
+                throw new Error("Missing required property 'businessJustification'");
+            }
+            if (args?.dataSensitivity === undefined && !opts.urn) {
+                throw new Error("Missing required property 'dataSensitivity'");
+            }
+            if (args?.frequencyEstimate === undefined && !opts.urn) {
+                throw new Error("Missing required property 'frequencyEstimate'");
+            }
+            if (args?.requestedBy === undefined && !opts.urn) {
+                throw new Error("Missing required property 'requestedBy'");
+            }
+            if (args?.violationId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'violationId'");
+            }
+            resourceInputs["agentId"] = args?.agentId;
+            resourceInputs["alternativesConsidered"] = args?.alternativesConsidered;
+            resourceInputs["businessJustification"] = args?.businessJustification;
+            resourceInputs["dataSensitivity"] = args?.dataSensitivity;
+            resourceInputs["frequencyEstimate"] = args?.frequencyEstimate;
+            resourceInputs["holdToken"] = args?.holdToken;
+            resourceInputs["requestId"] = args?.requestId;
+            resourceInputs["requestedBy"] = args?.requestedBy;
+            resourceInputs["toolName"] = args?.toolName;
+            resourceInputs["violationId"] = args?.violationId;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["policyChangeJson"] = undefined /*out*/;
+            resourceInputs["reviewDecision"] = undefined /*out*/;
+            resourceInputs["reviewNotes"] = undefined /*out*/;
+            resourceInputs["reviewedBy"] = undefined /*out*/;
+            resourceInputs["status"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PolicyException.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyException resources.
+ */
+export interface PolicyExceptionState {
+    /**
+     * Agent ID associated with the request.
+     */
+    agentId?: pulumi.Input<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    alternativesConsidered?: pulumi.Input<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    businessJustification?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    dataSensitivity?: pulumi.Input<string | undefined>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    frequencyEstimate?: pulumi.Input<string | undefined>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    holdToken?: pulumi.Input<string | undefined>;
+    /**
+     * Policy change metadata returned by the review flow.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Requester identity.
+     */
+    requestedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Review decision when present.
+     */
+    reviewDecision?: pulumi.Input<string | undefined>;
+    /**
+     * Review notes when present.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity when present.
+     */
+    reviewedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Current policy exception status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    toolName?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    violationId?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyException resource.
+ */
+export interface PolicyExceptionArgs {
+    /**
+     * Agent ID associated with the request.
+     */
+    agentId?: pulumi.Input<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    alternativesConsidered?: pulumi.Input<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    businessJustification: pulumi.Input<string>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    dataSensitivity: pulumi.Input<string>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    frequencyEstimate: pulumi.Input<string>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    holdToken?: pulumi.Input<string | undefined>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Requester identity.
+     */
+    requestedBy: pulumi.Input<string>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    toolName?: pulumi.Input<string | undefined>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    violationId: pulumi.Input<string>;
+}