@pulumi/gcp 6.18.0 → 6.20.0-alpha.1650381466

package/README.md

@@ -8,8 +8,8 @@
 
 # Google Cloud Platform Resource Provider
 
-The Google Cloud Platform (GCP) resource provider for Pulumi lets you use GCP resources in your cloud programs.  To use
-this package, please [install the Pulumi CLI first](https://pulumi.com/). For a streamlined Pulumi walkthrough, including language runtime installation and GCP configuration, click "Get Started" below.
+The Google Cloud Platform (GCP) resource provider for Pulumi lets you use GCP resources in your cloud programs. To use
+this package, [install the Pulumi CLI](https://www.pulumi.com/docs/get-started/install/). For a streamlined Pulumi walkthrough, including language runtime installation and GCP configuration, select "Get Started" below.
 
 <div>
     <a href="https://www.pulumi.com/docs/get-started/gcp" title="Get Started">
@@ -51,4 +51,5 @@ To use from .NET, install using `dotnet add package`:
 
 ## Reference
 
-For further information, please visit [the GCP provider docs](https://www.pulumi.com/docs/intro/cloud-providers/gcp) or for detailed reference documentation, please visit [the API docs](https://www.pulumi.com/docs/reference/pkg/gcp).
+For further information, visit [GCP in the Pulumi Registry](https://www.pulumi.com/registry/packages/gcp/)
+or for detailed API reference documentation, visit [GCP API Docs in the Pulumi Registry](https://www.pulumi.com/registry/packages/gcp/api-docs/).

package/accessapproval/getFolderServiceAccount.d.ts

@@ -0,0 +1,65 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Get the email address of a folder's Access Approval service account.
+ *
+ * Each Google Cloud folder has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getFolderServiceAccount({
+ *     folderId: "my-folder",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+export declare function getFolderServiceAccount(args: GetFolderServiceAccountArgs, opts?: pulumi.InvokeOptions): Promise<GetFolderServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getFolderServiceAccount.
+ */
+export interface GetFolderServiceAccountArgs {
+    /**
+     * The folder ID the service account was created for.
+     */
+    folderId: string;
+}
+/**
+ * A collection of values returned by getFolderServiceAccount.
+ */
+export interface GetFolderServiceAccountResult {
+    /**
+     * The email address of the service account. This value is
+     * often used to refer to the service account in order to grant IAM permissions.
+     */
+    readonly accountEmail: string;
+    readonly folderId: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    /**
+     * The Access Approval service account resource name. Format is "folders/{folder_id}/serviceAccount".
+     */
+    readonly name: string;
+}
+export declare function getFolderServiceAccountOutput(args: GetFolderServiceAccountOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetFolderServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getFolderServiceAccount.
+ */
+export interface GetFolderServiceAccountOutputArgs {
+    /**
+     * The folder ID the service account was created for.
+     */
+    folderId: pulumi.Input<string>;
+}

package/accessapproval/getFolderServiceAccount.js

@@ -0,0 +1,47 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFolderServiceAccountOutput = exports.getFolderServiceAccount = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * Get the email address of a folder's Access Approval service account.
+ *
+ * Each Google Cloud folder has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getFolderServiceAccount({
+ *     folderId: "my-folder",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+function getFolderServiceAccount(args, opts) {
+    if (!opts) {
+        opts = {};
+    }
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+    return pulumi.runtime.invoke("gcp:accessapproval/getFolderServiceAccount:getFolderServiceAccount", {
+        "folderId": args.folderId,
+    }, opts);
+}
+exports.getFolderServiceAccount = getFolderServiceAccount;
+function getFolderServiceAccountOutput(args, opts) {
+    return pulumi.output(args).apply(a => getFolderServiceAccount(a, opts));
+}
+exports.getFolderServiceAccountOutput = getFolderServiceAccountOutput;
+//# sourceMappingURL=getFolderServiceAccount.js.map

package/accessapproval/getFolderServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFolderServiceAccount.js","sourceRoot":"","sources":["../../accessapproval/getFolderServiceAccount.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,uBAAuB,CAAC,IAAiC,EAAE,IAA2B;IAClG,IAAI,CAAC,IAAI,EAAE;QACP,IAAI,GAAG,EAAE,CAAA;KACZ;IAED,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oEAAoE,EAAE;QAC/F,UAAU,EAAE,IAAI,CAAC,QAAQ;KAC5B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AATD,0DASC;AAgCD,SAAgB,6BAA6B,CAAC,IAAuC,EAAE,IAA2B;IAC9G,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC3E,CAAC;AAFD,sEAEC"}

package/accessapproval/getOrganizationServiceAccount.d.ts

@@ -0,0 +1,65 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Get the email address of an organization's Access Approval service account.
+ *
+ * Each Google Cloud organization has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getOrganizationServiceAccount({
+ *     organizationId: "my-organization",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+export declare function getOrganizationServiceAccount(args: GetOrganizationServiceAccountArgs, opts?: pulumi.InvokeOptions): Promise<GetOrganizationServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getOrganizationServiceAccount.
+ */
+export interface GetOrganizationServiceAccountArgs {
+    /**
+     * The organization ID the service account was created for.
+     */
+    organizationId: string;
+}
+/**
+ * A collection of values returned by getOrganizationServiceAccount.
+ */
+export interface GetOrganizationServiceAccountResult {
+    /**
+     * The email address of the service account. This value is
+     * often used to refer to the service account in order to grant IAM permissions.
+     */
+    readonly accountEmail: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    /**
+     * The Access Approval service account resource name. Format is "organizations/{organization_id}/serviceAccount".
+     */
+    readonly name: string;
+    readonly organizationId: string;
+}
+export declare function getOrganizationServiceAccountOutput(args: GetOrganizationServiceAccountOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetOrganizationServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getOrganizationServiceAccount.
+ */
+export interface GetOrganizationServiceAccountOutputArgs {
+    /**
+     * The organization ID the service account was created for.
+     */
+    organizationId: pulumi.Input<string>;
+}

package/accessapproval/getOrganizationServiceAccount.js

@@ -0,0 +1,47 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrganizationServiceAccountOutput = exports.getOrganizationServiceAccount = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * Get the email address of an organization's Access Approval service account.
+ *
+ * Each Google Cloud organization has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getOrganizationServiceAccount({
+ *     organizationId: "my-organization",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+function getOrganizationServiceAccount(args, opts) {
+    if (!opts) {
+        opts = {};
+    }
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+    return pulumi.runtime.invoke("gcp:accessapproval/getOrganizationServiceAccount:getOrganizationServiceAccount", {
+        "organizationId": args.organizationId,
+    }, opts);
+}
+exports.getOrganizationServiceAccount = getOrganizationServiceAccount;
+function getOrganizationServiceAccountOutput(args, opts) {
+    return pulumi.output(args).apply(a => getOrganizationServiceAccount(a, opts));
+}
+exports.getOrganizationServiceAccountOutput = getOrganizationServiceAccountOutput;
+//# sourceMappingURL=getOrganizationServiceAccount.js.map

package/accessapproval/getOrganizationServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getOrganizationServiceAccount.js","sourceRoot":"","sources":["../../accessapproval/getOrganizationServiceAccount.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,6BAA6B,CAAC,IAAuC,EAAE,IAA2B;IAC9G,IAAI,CAAC,IAAI,EAAE;QACP,IAAI,GAAG,EAAE,CAAA;KACZ;IAED,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gFAAgF,EAAE;QAC3G,gBAAgB,EAAE,IAAI,CAAC,cAAc;KACxC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AATD,sEASC;AAgCD,SAAgB,mCAAmC,CAAC,IAA6C,EAAE,IAA2B;IAC1H,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AACjF,CAAC;AAFD,kFAEC"}

package/accessapproval/getProjectServiceAccount.d.ts

@@ -0,0 +1,65 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Get the email address of a project's Access Approval service account.
+ *
+ * Each Google Cloud project has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getProjectServiceAccount({
+ *     projectId: "my-project",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+export declare function getProjectServiceAccount(args: GetProjectServiceAccountArgs, opts?: pulumi.InvokeOptions): Promise<GetProjectServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getProjectServiceAccount.
+ */
+export interface GetProjectServiceAccountArgs {
+    /**
+     * The project ID the service account was created for.
+     */
+    projectId: string;
+}
+/**
+ * A collection of values returned by getProjectServiceAccount.
+ */
+export interface GetProjectServiceAccountResult {
+    /**
+     * The email address of the service account. This value is
+     * often used to refer to the service account in order to grant IAM permissions.
+     */
+    readonly accountEmail: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    /**
+     * The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
+     */
+    readonly name: string;
+    readonly projectId: string;
+}
+export declare function getProjectServiceAccountOutput(args: GetProjectServiceAccountOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetProjectServiceAccountResult>;
+/**
+ * A collection of arguments for invoking getProjectServiceAccount.
+ */
+export interface GetProjectServiceAccountOutputArgs {
+    /**
+     * The project ID the service account was created for.
+     */
+    projectId: pulumi.Input<string>;
+}

package/accessapproval/getProjectServiceAccount.js

@@ -0,0 +1,47 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProjectServiceAccountOutput = exports.getProjectServiceAccount = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * Get the email address of a project's Access Approval service account.
+ *
+ * Each Google Cloud project has a unique service account used by Access Approval.
+ * When using Access Approval with a
+ * [custom signing key](https://cloud.google.com/cloud-provider-access-management/access-approval/docs/review-approve-access-requests-custom-keys),
+ * this account needs to be granted the `cloudkms.signerVerifier` IAM role on the
+ * Cloud KMS key used to sign approvals.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const serviceAccount = gcp.accessapproval.getProjectServiceAccount({
+ *     projectId: "my-project",
+ * });
+ * const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
+ *     cryptoKeyId: google_kms_crypto_key.crypto_key.id,
+ *     role: "roles/cloudkms.signerVerifier",
+ *     member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
+ * });
+ * ```
+ */
+function getProjectServiceAccount(args, opts) {
+    if (!opts) {
+        opts = {};
+    }
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+    return pulumi.runtime.invoke("gcp:accessapproval/getProjectServiceAccount:getProjectServiceAccount", {
+        "projectId": args.projectId,
+    }, opts);
+}
+exports.getProjectServiceAccount = getProjectServiceAccount;
+function getProjectServiceAccountOutput(args, opts) {
+    return pulumi.output(args).apply(a => getProjectServiceAccount(a, opts));
+}
+exports.getProjectServiceAccountOutput = getProjectServiceAccountOutput;
+//# sourceMappingURL=getProjectServiceAccount.js.map

package/accessapproval/getProjectServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getProjectServiceAccount.js","sourceRoot":"","sources":["../../accessapproval/getProjectServiceAccount.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,wBAAwB,CAAC,IAAkC,EAAE,IAA2B;IACpG,IAAI,CAAC,IAAI,EAAE;QACP,IAAI,GAAG,EAAE,CAAA;KACZ;IAED,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,sEAAsE,EAAE;QACjG,WAAW,EAAE,IAAI,CAAC,SAAS;KAC9B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AATD,4DASC;AAgCD,SAAgB,8BAA8B,CAAC,IAAwC,EAAE,IAA2B;IAChH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC5E,CAAC;AAFD,wEAEC"}

package/accessapproval/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./getFolderServiceAccount";
+export * from "./getOrganizationServiceAccount";
+export * from "./getProjectServiceAccount";

package/accessapproval/index.js

@@ -0,0 +1,23 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Export members:
+__exportStar(require("./getFolderServiceAccount"), exports);
+__exportStar(require("./getOrganizationServiceAccount"), exports);
+__exportStar(require("./getProjectServiceAccount"), exports);
+//# sourceMappingURL=index.js.map

package/accessapproval/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../accessapproval/index.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;;;;;;;;;;;;;;AAEjF,kBAAkB;AAClB,4DAA0C;AAC1C,kEAAgD;AAChD,6DAA2C"}

package/accesscontextmanager/accessPolicy.d.ts

@@ -27,7 +27,23 @@ import * as pulumi from "@pulumi/pulumi";
  *
  * const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
  *     parent: "organizations/123456789",
- *     title: "my policy",
+ *     title: "Org Access Policy",
+ * });
+ * ```
+ * ### Access Context Manager Access Policy Scoped
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const project = new gcp.organizations.Project("project", {
+ *     orgId: "123456789",
+ *     projectId: "acm-test-proj-123",
+ * });
+ * const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
+ *     parent: "organizations/123456789",
+ *     scopes: pulumi.interpolate`projects/${project.number}`,
+ *     title: "Scoped Access Policy",
  * });
  * ```
  *
@@ -68,6 +84,11 @@ export declare class AccessPolicy extends pulumi.CustomResource {
      * Format: organizations/{organization_id}
      */
     readonly parent: pulumi.Output<string>;
+    /**
+     * Folder or project on which this policy is applicable.
+     * Format: folders/{{folder_id}} or projects/{{project_id}}
+     */
+    readonly scopes: pulumi.Output<string | undefined>;
     /**
      * Human readable title. Does not affect behavior.
      */
@@ -102,6 +123,11 @@ export interface AccessPolicyState {
      * Format: organizations/{organization_id}
      */
     parent?: pulumi.Input<string>;
+    /**
+     * Folder or project on which this policy is applicable.
+     * Format: folders/{{folder_id}} or projects/{{project_id}}
+     */
+    scopes?: pulumi.Input<string>;
     /**
      * Human readable title. Does not affect behavior.
      */
@@ -120,6 +146,11 @@ export interface AccessPolicyArgs {
      * Format: organizations/{organization_id}
      */
     parent: pulumi.Input<string>;
+    /**
+     * Folder or project on which this policy is applicable.
+     * Format: folders/{{folder_id}} or projects/{{project_id}}
+     */
+    scopes?: pulumi.Input<string>;
     /**
      * Human readable title. Does not affect behavior.
      */

package/accesscontextmanager/accessPolicy.js

@@ -33,7 +33,23 @@ const utilities = require("../utilities");
  *
  * const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
  *     parent: "organizations/123456789",
- *     title: "my policy",
+ *     title: "Org Access Policy",
+ * });
+ * ```
+ * ### Access Context Manager Access Policy Scoped
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as gcp from "@pulumi/gcp";
+ *
+ * const project = new gcp.organizations.Project("project", {
+ *     orgId: "123456789",
+ *     projectId: "acm-test-proj-123",
+ * });
+ * const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
+ *     parent: "organizations/123456789",
+ *     scopes: pulumi.interpolate`projects/${project.number}`,
+ *     title: "Scoped Access Policy",
  * });
  * ```
  *
@@ -54,6 +70,7 @@ class AccessPolicy extends pulumi.CustomResource {
             resourceInputs["createTime"] = state ? state.createTime : undefined;
             resourceInputs["name"] = state ? state.name : undefined;
             resourceInputs["parent"] = state ? state.parent : undefined;
+            resourceInputs["scopes"] = state ? state.scopes : undefined;
             resourceInputs["title"] = state ? state.title : undefined;
             resourceInputs["updateTime"] = state ? state.updateTime : undefined;
         }
@@ -66,6 +83,7 @@ class AccessPolicy extends pulumi.CustomResource {
                 throw new Error("Missing required property 'title'");
             }
             resourceInputs["parent"] = args ? args.parent : undefined;
+            resourceInputs["scopes"] = args ? args.scopes : undefined;
             resourceInputs["title"] = args ? args.title : undefined;
             resourceInputs["createTime"] = undefined /*out*/;
             resourceInputs["name"] = undefined /*out*/;

package/accesscontextmanager/accessPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessPolicy.js","sourceRoot":"","sources":["../../accesscontextmanager/accessPolicy.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAa,YAAa,SAAQ,MAAM,CAAC,cAAc;IA0DnD,YAAY,IAAY,EAAE,WAAkD,EAAE,IAAmC;QAC7G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA4C,CAAC;YAC3D,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SACvE;aAAM;YACH,MAAM,IAAI,GAAG,WAA2C,CAAC;YACzD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACzD;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;aACxD;YACD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAnFD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAyB,EAAE,IAAmC;QACvH,OAAO,IAAI,YAAY,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACnE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,YAAY,CAAC;IAC7D,CAAC;;AA1BL,oCAqFC;AAvEG,gBAAgB;AACO,yBAAY,GAAG,oDAAoD,CAAC"}
+{"version":3,"file":"accessPolicy.js","sourceRoot":"","sources":["../../accesscontextmanager/accessPolicy.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAa,YAAa,SAAQ,MAAM,CAAC,cAAc;IA+DnD,YAAY,IAAY,EAAE,WAAkD,EAAE,IAAmC;QAC7G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA4C,CAAC;YAC3D,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SACvE;aAAM;YACH,MAAM,IAAI,GAAG,WAA2C,CAAC;YACzD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACzD;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;aACxD;YACD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IA1FD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAyB,EAAE,IAAmC;QACvH,OAAO,IAAI,YAAY,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACnE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,YAAY,CAAC;IAC7D,CAAC;;AA1BL,oCA4FC;AA9EG,gBAAgB;AACO,yBAAY,GAAG,oDAAoD,CAAC"}