@atensec/pulumi-thoth 0.1.4 → 0.1.6

package/governance/policyBundle.ts

@@ -0,0 +1,299 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyBundle extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyBundle resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyBundleState, opts?: pulumi.CustomResourceOptions): PolicyBundle {
+        return new PolicyBundle(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyBundle:PolicyBundle';
+
+    /**
+     * Returns true if the given object is an instance of PolicyBundle.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyBundle {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyBundle.__pulumiType;
+    }
+
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    declare public readonly assignments: pulumi.Output<string[] | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Creator identity.
+     */
+    declare public /*out*/ readonly createdBy: pulumi.Output<string>;
+    /**
+     * Optional policy bundle description.
+     */
+    declare public readonly description: pulumi.Output<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    declare public readonly enforcementMode: pulumi.Output<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    declare public readonly expectedHash: pulumi.Output<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    declare public readonly framework: pulumi.Output<string>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    declare public readonly name: pulumi.Output<string>;
+    /**
+     * SHA-256 hash of policy content.
+     */
+    declare public /*out*/ readonly policyHash: pulumi.Output<string>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    declare public readonly rawPolicy: pulumi.Output<string | undefined>;
+    /**
+     * Resolved immutable source version (S3 version ID or file revision hint).
+     */
+    declare public /*out*/ readonly resolvedVersion: pulumi.Output<string>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    declare public readonly s3Uri: pulumi.Output<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    declare public readonly s3VersionId: pulumi.Output<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    declare public readonly sourceUri: pulumi.Output<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    declare public readonly status: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Last update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Monotonic policy bundle version.
+     */
+    declare public /*out*/ readonly version: pulumi.Output<number>;
+
+    /**
+     * Create a PolicyBundle resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyBundleArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyBundleArgs | PolicyBundleState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyBundleState | undefined;
+            resourceInputs["assignments"] = state?.assignments;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["createdBy"] = state?.createdBy;
+            resourceInputs["description"] = state?.description;
+            resourceInputs["enforcementMode"] = state?.enforcementMode;
+            resourceInputs["expectedHash"] = state?.expectedHash;
+            resourceInputs["framework"] = state?.framework;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["policyHash"] = state?.policyHash;
+            resourceInputs["rawPolicy"] = state?.rawPolicy;
+            resourceInputs["resolvedVersion"] = state?.resolvedVersion;
+            resourceInputs["s3Uri"] = state?.s3Uri;
+            resourceInputs["s3VersionId"] = state?.s3VersionId;
+            resourceInputs["sourceUri"] = state?.sourceUri;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["version"] = state?.version;
+        } else {
+            const args = argsOrState as PolicyBundleArgs | undefined;
+            if (args?.framework === undefined && !opts.urn) {
+                throw new Error("Missing required property 'framework'");
+            }
+            if (args?.name === undefined && !opts.urn) {
+                throw new Error("Missing required property 'name'");
+            }
+            resourceInputs["assignments"] = args?.assignments;
+            resourceInputs["description"] = args?.description;
+            resourceInputs["enforcementMode"] = args?.enforcementMode;
+            resourceInputs["expectedHash"] = args?.expectedHash;
+            resourceInputs["framework"] = args?.framework;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["rawPolicy"] = args?.rawPolicy ? pulumi.secret(args.rawPolicy) : undefined;
+            resourceInputs["s3Uri"] = args?.s3Uri;
+            resourceInputs["s3VersionId"] = args?.s3VersionId;
+            resourceInputs["sourceUri"] = args?.sourceUri;
+            resourceInputs["status"] = args?.status;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["createdBy"] = undefined /*out*/;
+            resourceInputs["policyHash"] = undefined /*out*/;
+            resourceInputs["resolvedVersion"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+            resourceInputs["version"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["rawPolicy"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(PolicyBundle.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyBundle resources.
+ */
+export interface PolicyBundleState {
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Creator identity.
+     */
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy bundle description.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    expectedHash?: pulumi.Input<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    framework?: pulumi.Input<string | undefined>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * SHA-256 hash of policy content.
+     */
+    policyHash?: pulumi.Input<string | undefined>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    rawPolicy?: pulumi.Input<string | undefined>;
+    /**
+     * Resolved immutable source version (S3 version ID or file revision hint).
+     */
+    resolvedVersion?: pulumi.Input<string | undefined>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    s3Uri?: pulumi.Input<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    s3VersionId?: pulumi.Input<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    sourceUri?: pulumi.Input<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Monotonic policy bundle version.
+     */
+    version?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyBundle resource.
+ */
+export interface PolicyBundleArgs {
+    /**
+     * Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
+     */
+    assignments?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Optional policy bundle description.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * Customer-facing policy mode: enforce or observe. Defaults to enforce.
+     */
+    enforcementMode?: pulumi.Input<string | undefined>;
+    /**
+     * Optional expected SHA-256 hash (hex or sha256:<hex>) to enforce policy integrity.
+     */
+    expectedHash?: pulumi.Input<string | undefined>;
+    /**
+     * Policy framework: OPA or CEDAR.
+     */
+    framework: pulumi.Input<string>;
+    /**
+     * Stable bundle name. Updates create a new version for the same name.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
+     */
+    rawPolicy?: pulumi.Input<string | undefined>;
+    /**
+     * Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
+     */
+    s3Uri?: pulumi.Input<string | undefined>;
+    /**
+     * Optional S3 object version ID to pin deterministic policy enforcement.
+     */
+    s3VersionId?: pulumi.Input<string | undefined>;
+    /**
+     * Unified policy source URI (file:// or s3://). Set this or raw_policy.
+     */
+    sourceUri?: pulumi.Input<string | undefined>;
+    /**
+     * Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
+     */
+    status?: pulumi.Input<string | undefined>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",

package/tsconfig.json

@@ -26,12 +26,15 @@
         "access/getApiKeyMetrics.ts",
         "access/getApiKeys.ts",
         "access/index.ts",
+        "billing/getCreditBank.ts",
+        "billing/getEstimate.ts",
         "billing/getInvoices.ts",
         "billing/getMonthlyCost.ts",
         "billing/getPricing.ts",
         "billing/getReport.ts",
         "billing/getReports.ts",
         "billing/index.ts",
+        "billing/overageCap.ts",
         "browser/enrollment.ts",
         "browser/getEnrollments.ts",
         "browser/getPolicies.ts",
@@ -53,12 +56,16 @@
         "governance/getApprovals.ts",
         "governance/getCostReport.ts",
         "governance/getDay7Report.ts",
+        "governance/getEffectivePolicyBundles.ts",
         "governance/getEvidenceBundle.ts",
         "governance/getEvidenceChain.ts",
         "governance/getEvidenceSlos.ts",
         "governance/getEvidenceVerify.ts",
         "governance/getFeed.ts",
+        "governance/getPackRuleVersions.ts",
+        "governance/getPackRules.ts",
         "governance/getPacks.ts",
+        "governance/getPolicyBundles.ts",
         "governance/getReportsOverview.ts",
         "governance/getRuntimeStatus.ts",
         "governance/getTenantSettings.ts",
@@ -68,6 +75,7 @@
         "governance/packAssignment.ts",
         "governance/packAssignmentBulk.ts",
         "governance/pamSettings.ts",
+        "governance/policyBundle.ts",
         "governance/policySync.ts",
         "governance/siemSettings.ts",
         "governance/webhookSettings.ts",