@pulumi/gcp 6.37.0-alpha.1663276359 → 6.37.0-alpha.1663278410

package/types/output.d.ts

@@ -1539,6 +1539,43 @@ export declare namespace apigee {
         expression: string;
         title: string;
     }
+    interface EnvironmentNodeConfig {
+        /**
+         * -
+         * The current total number of gateway nodes that each environment currently has across
+         * all instances.
+         */
+        currentAggregateNodeCount: string;
+        /**
+         * The maximum total number of gateway nodes that the is reserved for all instances that
+         * has the specified environment. If not specified, the default is determined by the
+         * recommended maximum number of nodes for that gateway.
+         */
+        maxNodeCount?: string;
+        /**
+         * The minimum total number of gateway nodes that the is reserved for all instances that
+         * has the specified environment. If not specified, the default is determined by the
+         * recommended minimum number of nodes for that gateway.
+         */
+        minNodeCount?: string;
+    }
+    interface OrganizationProperties {
+        /**
+         * List of all properties in the object.
+         * Structure is documented below.
+         */
+        properties?: outputs.apigee.OrganizationPropertiesProperty[];
+    }
+    interface OrganizationPropertiesProperty {
+        /**
+         * Name of the property.
+         */
+        name?: string;
+        /**
+         * Value of the property.
+         */
+        value?: string;
+    }
 }
 export declare namespace appengine {
     interface ApplicationFeatureSettings {
@@ -3453,6 +3490,18 @@ export declare namespace bigquery {
         useLegacySql?: boolean;
     }
 }
+export declare namespace bigqueryanalyticshub {
+    interface DataExchanceIamMemberCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
+    interface DataExchangeIamBindingCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
+}
 export declare namespace bigtable {
     interface GCPolicyMaxAge {
         /**
@@ -6535,8 +6584,7 @@ export declare namespace cloudfunctionsv2 {
          */
         invertRegex?: boolean;
         /**
-         * ID of the project that owns the Cloud Source Repository. If omitted, the
-         * project ID requesting the build is assumed.
+         * Project identifier (preferrably project number but can also be the project ID) of the project that contains the secret. If not set, it will be populated with the function's project assuming that the secret exists in the same project as of the function.
          */
         projectId?: string;
         /**
@@ -6670,6 +6718,16 @@ export declare namespace cloudfunctionsv2 {
          * given time.
          */
         minInstanceCount?: number;
+        /**
+         * Secret environment variables configuration.
+         * Structure is documented below.
+         */
+        secretEnvironmentVariables?: outputs.cloudfunctionsv2.FunctionServiceConfigSecretEnvironmentVariable[];
+        /**
+         * Secret volumes configuration.
+         * Structure is documented below.
+         */
+        secretVolumes?: outputs.cloudfunctionsv2.FunctionServiceConfigSecretVolume[];
         /**
          * Name of the service associated with a Function.
          */
@@ -6699,6 +6757,53 @@ export declare namespace cloudfunctionsv2 {
          */
         vpcConnectorEgressSettings?: string;
     }
+    interface FunctionServiceConfigSecretEnvironmentVariable {
+        /**
+         * Name of the environment variable.
+         */
+        key: string;
+        /**
+         * Project identifier (preferrably project number but can also be the project ID) of the project that contains the secret. If not set, it will be populated with the function's project assuming that the secret exists in the same project as of the function.
+         */
+        projectId: string;
+        /**
+         * Name of the secret in secret manager (not the full resource name).
+         */
+        secret: string;
+        /**
+         * Version of the secret (version number or the string 'latest'). It is preferable to use latest version with secret volumes as secret value changes are reflected immediately.
+         */
+        version: string;
+    }
+    interface FunctionServiceConfigSecretVolume {
+        /**
+         * The path within the container to mount the secret volume. For example, setting the mountPath as /etc/secrets would mount the secret value files under the /etc/secrets directory. This directory will also be completely shadowed and unavailable to mount any other secrets. Recommended mount path: /etc/secrets
+         */
+        mountPath: string;
+        /**
+         * Project identifier (preferrably project number but can also be the project ID) of the project that contains the secret. If not set, it will be populated with the function's project assuming that the secret exists in the same project as of the function.
+         */
+        projectId: string;
+        /**
+         * Name of the secret in secret manager (not the full resource name).
+         */
+        secret: string;
+        /**
+         * List of secret versions to mount for this secret. If empty, the latest version of the secret will be made available in a file named after the secret under the mount point.'
+         * Structure is documented below.
+         */
+        versions: outputs.cloudfunctionsv2.FunctionServiceConfigSecretVolumeVersion[];
+    }
+    interface FunctionServiceConfigSecretVolumeVersion {
+        /**
+         * Relative path of the file under the mount path where the secret value for this version will be fetched and made available. For example, setting the mountPath as '/etc/secrets' and path as secretFoo would mount the secret value file at /etc/secrets/secret_foo.
+         */
+        path: string;
+        /**
+         * Version of the secret (version number or the string 'latest'). It is preferable to use latest version with secret volumes as secret value changes are reflected immediately.
+         */
+        version: string;
+    }
 }
 export declare namespace cloudidentity {
     interface GetGroupMembershipsMembership {
@@ -9552,6 +9657,7 @@ export declare namespace compute {
     interface GetInstanceAdvancedMachineFeature {
         enableNestedVirtualization: boolean;
         threadsPerCore: number;
+        visibleCoreCount: number;
     }
     interface GetInstanceAttachedDisk {
         /**
@@ -9786,6 +9892,7 @@ export declare namespace compute {
     interface GetInstanceTemplateAdvancedMachineFeature {
         enableNestedVirtualization: boolean;
         threadsPerCore: number;
+        visibleCoreCount: number;
     }
     interface GetInstanceTemplateConfidentialInstanceConfig {
         enableConfidentialCompute: boolean;
@@ -10131,6 +10238,7 @@ export declare namespace compute {
         startTime: string;
     }
     interface GetResourcePolicySnapshotSchedulePolicySnapshotProperty {
+        chainName: string;
         guestFlush: boolean;
         labels: {
             [key: string]: string;
@@ -10622,6 +10730,10 @@ export declare namespace compute {
          * he number of threads per physical core. To disable [simultaneous multithreading (SMT)](https://cloud.google.com/compute/docs/instances/disabling-smt) set this to 1.
          */
         threadsPerCore?: number;
+        /**
+         * ) The number of physical cores to expose to an instance. [visible cores info (VC)](https://cloud.google.com/compute/docs/instances/customize-visible-cores).
+         */
+        visibleCoreCount?: number;
     }
     interface InstanceAttachedDisk {
         /**
@@ -10736,6 +10848,7 @@ export declare namespace compute {
     interface InstanceFromMachineImageAdvancedMachineFeatures {
         enableNestedVirtualization: boolean;
         threadsPerCore: number;
+        visibleCoreCount: number;
     }
     interface InstanceFromMachineImageAttachedDisk {
         deviceName: string;
@@ -10843,6 +10956,7 @@ export declare namespace compute {
     interface InstanceFromTemplateAdvancedMachineFeatures {
         enableNestedVirtualization: boolean;
         threadsPerCore: number;
+        visibleCoreCount: number;
     }
     interface InstanceFromTemplateAttachedDisk {
         deviceName: string;
@@ -11398,9 +11512,13 @@ export declare namespace compute {
          */
         enableNestedVirtualization?: boolean;
         /**
-         * he number of threads per physical core. To disable [simultaneous multithreading (SMT)](https://cloud.google.com/compute/docs/instances/disabling-smt) set this to 1.
+         * The number of threads per physical core. To disable [simultaneous multithreading (SMT)](https://cloud.google.com/compute/docs/instances/disabling-smt) set this to 1.
          */
         threadsPerCore?: number;
+        /**
+         * ) The number of physical cores to expose to an instance. [visible cores info (VC)](https://cloud.google.com/compute/docs/instances/customize-visible-cores).
+         */
+        visibleCoreCount?: number;
     }
     interface InstanceTemplateConfidentialInstanceConfig {
         /**
@@ -14823,6 +14941,12 @@ export declare namespace compute {
         startTime: string;
     }
     interface ResourcePolicySnapshotSchedulePolicySnapshotProperties {
+        /**
+         * Creates the new snapshot in the snapshot chain labeled with the
+         * specified name. The chain name must be 1-63 characters long and comply
+         * with RFC1035.
+         */
+        chainName?: string;
         /**
          * Whether to perform a 'guest aware' snapshot.
          */
@@ -18048,6 +18172,13 @@ export declare namespace container {
          */
         enabled: boolean;
     }
+    interface ClusterCostManagementConfig {
+        /**
+         * Enable the PodSecurityPolicy controller for this cluster.
+         * If enabled, pods must be valid under a PodSecurityPolicy to be created.
+         */
+        enabled: boolean;
+    }
     interface ClusterDatabaseEncryption {
         /**
          * the key to use to encrypt/decrypt secrets.  See the [DatabaseEncryption definition](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#Cluster.DatabaseEncryption) for more information.
@@ -18247,12 +18378,7 @@ export declare namespace container {
          */
         ephemeralStorageConfig?: outputs.container.ClusterNodeConfigEphemeralStorageConfig;
         /**
-         * Parameters for the Google Container Filesystem (GCFS).
-         * If unspecified, GCFS will not be enabled on the node pool. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion` from GKE versions 1.19 or later to use it.
-         * For GKE versions 1.19, 1.20, and 1.21, the recommended minimum `nodeVersion` would be 1.19.15-gke.1300, 1.20.11-gke.1300, and 1.21.5-gke.1300 respectively.
-         * A `machineType` that has more than 16 GiB of memory is also recommended.
-         * GCFS must be enabled in order to use [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming).
-         * Structure is documented below.
+         * The default Google Container Filesystem (GCFS) configuration at the cluster level. e.g. enable [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming) across all the node pools within the cluster. Structure is documented below.
          */
         gcfsConfig?: outputs.container.ClusterNodeConfigGcfsConfig;
         /**
@@ -18555,8 +18681,30 @@ export declare namespace container {
         tags?: string[];
     }
     interface ClusterNodePoolAutoscaling {
-        maxNodeCount: number;
-        minNodeCount: number;
+        locationPolicy?: string;
+        maxNodeCount?: number;
+        minNodeCount?: number;
+        totalMaxNodeCount?: number;
+        totalMinNodeCount?: number;
+    }
+    interface ClusterNodePoolDefaults {
+        /**
+         * ) - Subset of NodeConfig message that has defaults.
+         */
+        nodeConfigDefaults?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaults;
+    }
+    interface ClusterNodePoolDefaultsNodeConfigDefaults {
+        /**
+         * The default Google Container Filesystem (GCFS) configuration at the cluster level. e.g. enable [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming) across all the node pools within the cluster. Structure is documented below.
+         */
+        gcfsConfig?: outputs.container.ClusterNodePoolDefaultsNodeConfigDefaultsGcfsConfig;
+    }
+    interface ClusterNodePoolDefaultsNodeConfigDefaultsGcfsConfig {
+        /**
+         * Enable the PodSecurityPolicy controller for this cluster.
+         * If enabled, pods must be valid under a PodSecurityPolicy to be created.
+         */
+        enabled: boolean;
     }
     interface ClusterNodePoolManagement {
         autoRepair?: boolean;
@@ -18596,12 +18744,7 @@ export declare namespace container {
          */
         ephemeralStorageConfig?: outputs.container.ClusterNodePoolNodeConfigEphemeralStorageConfig;
         /**
-         * Parameters for the Google Container Filesystem (GCFS).
-         * If unspecified, GCFS will not be enabled on the node pool. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion` from GKE versions 1.19 or later to use it.
-         * For GKE versions 1.19, 1.20, and 1.21, the recommended minimum `nodeVersion` would be 1.19.15-gke.1300, 1.20.11-gke.1300, and 1.21.5-gke.1300 respectively.
-         * A `machineType` that has more than 16 GiB of memory is also recommended.
-         * GCFS must be enabled in order to use [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming).
-         * Structure is documented below.
+         * The default Google Container Filesystem (GCFS) configuration at the cluster level. e.g. enable [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming) across all the node pools within the cluster. Structure is documented below.
          */
         gcfsConfig?: outputs.container.ClusterNodePoolNodeConfigGcfsConfig;
         /**
@@ -18963,6 +19106,13 @@ export declare namespace container {
     interface ClusterResourceUsageExportConfigBigqueryDestination {
         datasetId: string;
     }
+    interface ClusterServiceExternalIpsConfig {
+        /**
+         * Enable the PodSecurityPolicy controller for this cluster.
+         * If enabled, pods must be valid under a PodSecurityPolicy to be created.
+         */
+        enabled: boolean;
+    }
     interface ClusterTpuConfig {
         /**
          * Enable the PodSecurityPolicy controller for this cluster.
@@ -19064,6 +19214,9 @@ export declare namespace container {
     interface GetClusterConfidentialNode {
         enabled: boolean;
     }
+    interface GetClusterCostManagementConfig {
+        enabled: boolean;
+    }
     interface GetClusterDatabaseEncryption {
         keyName: string;
         state: string;
@@ -19244,8 +19397,20 @@ export declare namespace container {
         tags: string[];
     }
     interface GetClusterNodePoolAutoscaling {
+        locationPolicy: string;
         maxNodeCount: number;
         minNodeCount: number;
+        totalMaxNodeCount: number;
+        totalMinNodeCount: number;
+    }
+    interface GetClusterNodePoolDefault {
+        nodeConfigDefaults: outputs.container.GetClusterNodePoolDefaultNodeConfigDefault[];
+    }
+    interface GetClusterNodePoolDefaultNodeConfigDefault {
+        gcfsConfigs: outputs.container.GetClusterNodePoolDefaultNodeConfigDefaultGcfsConfig[];
+    }
+    interface GetClusterNodePoolDefaultNodeConfigDefaultGcfsConfig {
+        enabled: boolean;
     }
     interface GetClusterNodePoolManagement {
         autoRepair: boolean;
@@ -19372,6 +19537,9 @@ export declare namespace container {
     interface GetClusterResourceUsageExportConfigBigqueryDestination {
         datasetId: string;
     }
+    interface GetClusterServiceExternalIpsConfig {
+        enabled: boolean;
+    }
     interface GetClusterTpuConfig {
         enabled: boolean;
         ipv4CidrBlock: string;
@@ -19385,14 +19553,32 @@ export declare namespace container {
     }
     interface NodePoolAutoscaling {
         /**
-         * Maximum number of nodes in the NodePool. Must be >= min_node_count.
+         * Location policy specifies the algorithm used when scaling-up the node pool. \
+         * "BALANCED" - Is a best effort policy that aims to balance the sizes of available zones. \
+         * "ANY" - Instructs the cluster autoscaler to prioritize utilization of unused reservations,
+         * and reduce preemption risk for Spot VMs.
          */
-        maxNodeCount: number;
+        locationPolicy?: string;
         /**
-         * Minimum number of nodes in the NodePool. Must be >=0 and
-         * <= `maxNodeCount`.
+         * Maximum number of nodes per zone in the NodePool.
+         * Must be >= min_node_count. Cannot be used with total limits.
          */
-        minNodeCount: number;
+        maxNodeCount?: number;
+        /**
+         * Minimum number of nodes per zone in the NodePool.
+         * Must be >=0 and <= `maxNodeCount`. Cannot be used with total limits.
+         */
+        minNodeCount?: number;
+        /**
+         * Total maximum number of nodes in the NodePool.
+         * Must be >= total_min_node_count. Cannot be used with per zone limits.
+         */
+        totalMaxNodeCount?: number;
+        /**
+         * Total minimum number of nodes in the NodePool.
+         * Must be >=0 and <= `totalMaxNodeCount`. Cannot be used with per zone limits.
+         */
+        totalMinNodeCount?: number;
     }
     interface NodePoolManagement {
         /**
@@ -22645,6 +22831,10 @@ export declare namespace dataproc {
          * Optional. The URIs of service account scopes to be included in Compute Engine instances. The following base set of scopes is always included: * https://www.googleapis.com/auth/cloud.useraccounts.readonly * https://www.googleapis.com/auth/devstorage.read_write * https://www.googleapis.com/auth/logging.write If no scopes are specified, the following defaults are also provided: * https://www.googleapis.com/auth/bigquery * https://www.googleapis.com/auth/bigtable.admin.table * https://www.googleapis.com/auth/bigtable.data * https://www.googleapis.com/auth/devstorage.full_control
          */
         serviceAccountScopes?: string[];
+        /**
+         * Optional. Shielded Instance Config for clusters using [Compute Engine Shielded VMs](https://cloud.google.com/security/shielded-cloud/shielded-vm). Structure defined below.
+         */
+        shieldedInstanceConfig?: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigGceClusterConfigShieldedInstanceConfig;
         /**
          * Optional. The Compute Engine subnetwork to be used for machine communications. Cannot be specified with network_uri. A full URL, partial URI, or short name are valid. Examples: * `https://www.googleapis.com/compute/v1/projects//regions/us-east1/subnetworks/sub0` * `sub0`
          */
@@ -22678,6 +22868,20 @@ export declare namespace dataproc {
          */
         values?: string[];
     }
+    interface WorkflowTemplatePlacementManagedClusterConfigGceClusterConfigShieldedInstanceConfig {
+        /**
+         * Optional. Defines whether instances have [Integrity Monitoring](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring) enabled.
+         */
+        enableIntegrityMonitoring?: boolean;
+        /**
+         * Optional. Defines whether instances have [Secure Boot](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#secure-boot) enabled.
+         */
+        enableSecureBoot?: boolean;
+        /**
+         * Optional. Defines whether instances have the [vTPM](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm) enabled.
+         */
+        enableVtpm?: boolean;
+    }
     interface WorkflowTemplatePlacementManagedClusterConfigGkeClusterConfig {
         /**
          * Optional. A target for the deployment.
@@ -23043,6 +23247,156 @@ export declare namespace datastore {
         name: string;
     }
 }
+export declare namespace datastream {
+    interface ConnectionProfileForwardSshConnectivity {
+        /**
+         * Hostname for the SSH tunnel.
+         */
+        hostname: string;
+        /**
+         * SSH password.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        password?: string;
+        /**
+         * Port for the SSH tunnel.
+         */
+        port?: number;
+        /**
+         * SSH private key.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        privateKey?: string;
+        /**
+         * Username for the SSH tunnel.
+         */
+        username: string;
+    }
+    interface ConnectionProfileGcsProfile {
+        /**
+         * The Cloud Storage bucket name.
+         */
+        bucket: string;
+        /**
+         * The root path inside the Cloud Storage bucket.
+         */
+        rootPath?: string;
+    }
+    interface ConnectionProfileMysqlProfile {
+        /**
+         * Hostname for the SSH tunnel.
+         */
+        hostname: string;
+        /**
+         * SSH password.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        password: string;
+        /**
+         * Port for the SSH tunnel.
+         */
+        port?: number;
+        /**
+         * SSL configuration for the MySQL connection.
+         * Structure is documented below.
+         */
+        sslConfig?: outputs.datastream.ConnectionProfileMysqlProfileSslConfig;
+        /**
+         * Username for the SSH tunnel.
+         */
+        username: string;
+    }
+    interface ConnectionProfileMysqlProfileSslConfig {
+        /**
+         * PEM-encoded certificate of the CA that signed the source database
+         * server's certificate.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        caCertificate?: string;
+        /**
+         * -
+         * Indicates whether the clientKey field is set.
+         */
+        caCertificateSet: boolean;
+        /**
+         * PEM-encoded certificate that will be used by the replica to
+         * authenticate against the source database server. If this field
+         * is used then the 'clientKey' and the 'caCertificate' fields are
+         * mandatory.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        clientCertificate?: string;
+        /**
+         * -
+         * Indicates whether the clientCertificate field is set.
+         */
+        clientCertificateSet: boolean;
+        /**
+         * PEM-encoded private key associated with the Client Certificate.
+         * If this field is used then the 'client_certificate' and the
+         * 'ca_certificate' fields are mandatory.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        clientKey?: string;
+        /**
+         * -
+         * Indicates whether the clientKey field is set.
+         */
+        clientKeySet: boolean;
+    }
+    interface ConnectionProfileOracleProfile {
+        /**
+         * Connection string attributes
+         */
+        connectionAttributes?: {
+            [key: string]: string;
+        };
+        /**
+         * Database for the Oracle connection.
+         */
+        databaseService: string;
+        /**
+         * Hostname for the SSH tunnel.
+         */
+        hostname: string;
+        /**
+         * SSH password.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        password: string;
+        /**
+         * Port for the SSH tunnel.
+         */
+        port?: number;
+        /**
+         * Username for the SSH tunnel.
+         */
+        username: string;
+    }
+    interface ConnectionProfilePostgresqlProfile {
+        /**
+         * Database for the PostgreSQL connection.
+         */
+        database: string;
+        /**
+         * Hostname for the SSH tunnel.
+         */
+        hostname: string;
+        /**
+         * SSH password.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
+         */
+        password: string;
+        /**
+         * Port for the SSH tunnel.
+         */
+        port?: number;
+        /**
+         * Username for the SSH tunnel.
+         */
+        username: string;
+    }
+}
 export declare namespace deploymentmanager {
     interface DeploymentLabel {
         /**
@@ -25475,7 +25829,7 @@ export declare namespace logging {
         /**
          * Whether to use [BigQuery's partition tables](https://cloud.google.com/bigquery/docs/partitioned-tables).
          * By default, Logging creates dated tables based on the log entries' timestamps, e.g. syslog_20170523. With partitioned
-         * tables the date suffix is no longer present and [special query syntax](https://cloud.google.com/bigquery/docs/querying-partitioned-tables)
+         * tables, the date suffix is no longer present and [special query syntax](https://cloud.google.com/bigquery/docs/querying-partitioned-tables)
          * has to be used instead. In both cases, tables are sharded based on UTC timezone.
          */
         usePartitionedTables: boolean;
@@ -25503,7 +25857,7 @@ export declare namespace logging {
         /**
          * Whether to use [BigQuery's partition tables](https://cloud.google.com/bigquery/docs/partitioned-tables).
          * By default, Logging creates dated tables based on the log entries' timestamps, e.g. syslog_20170523. With partitioned
-         * tables the date suffix is no longer present and [special query syntax](https://cloud.google.com/bigquery/docs/querying-partitioned-tables)
+         * tables, the date suffix is no longer present and [special query syntax](https://cloud.google.com/bigquery/docs/querying-partitioned-tables)
          * has to be used instead. In both cases, tables are sharded based on UTC timezone.
          */
         usePartitionedTables: boolean;
@@ -25663,7 +26017,7 @@ export declare namespace logging {
     interface ProjectSinkBigqueryOptions {
         /**
          * Whether to use [BigQuery's partition tables](https://cloud.google.com/bigquery/docs/partitioned-tables).
-         * By default, Logging creates dated tables based on the log entries' timestamps, e.g. syslog_20170523. With partitioned
+         * By default, Logging creates dated tables based on the log entries' timestamps, e.g. `syslog20170523`. With partitioned
          * tables the date suffix is no longer present and [special query syntax](https://cloud.google.com/bigquery/docs/querying-partitioned-tables)
          * has to be used instead. In both cases, tables are sharded based on UTC timezone.
          */
@@ -32054,6 +32408,12 @@ export declare namespace vertex {
          */
         kmsKeyName?: string;
     }
+    interface AiFeatureStoreEncryptionSpec {
+        /**
+         * The Cloud KMS resource identifier of the customer managed encryption key used to protect a resource. Has the form: projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key. The key needs to be in the same region as where the compute resource is created.
+         */
+        kmsKeyName: string;
+    }
     interface AiFeatureStoreEntityTypeMonitoringConfig {
         /**
          * Configuration of how features in Featurestore are monitored.

package/vertex/aiFeatureStore.d.ts

@@ -16,6 +16,9 @@ import { input as inputs, output as outputs } from "../types";
  *     onlineServingConfig: {
  *         fixedNodeCount: 2,
  *     },
+ *     encryptionSpec: {
+ *         kmsKeyName: "kms-name",
+ *     },
  *     forceDestroy: true,
  * }, {
  *     provider: google_beta,
@@ -63,6 +66,11 @@ export declare class AiFeatureStore extends pulumi.CustomResource {
      * nine fractional digits.
      */
     readonly createTime: pulumi.Output<string>;
+    /**
+     * If set, both of the online and offline data storage will be secured by this key.
+     * Structure is documented below.
+     */
+    readonly encryptionSpec: pulumi.Output<outputs.vertex.AiFeatureStoreEncryptionSpec | undefined>;
     /**
      * Used to perform consistent read-modify-write updates.
      */
@@ -118,6 +126,11 @@ export interface AiFeatureStoreState {
      * nine fractional digits.
      */
     createTime?: pulumi.Input<string>;
+    /**
+     * If set, both of the online and offline data storage will be secured by this key.
+     * Structure is documented below.
+     */
+    encryptionSpec?: pulumi.Input<inputs.vertex.AiFeatureStoreEncryptionSpec>;
     /**
      * Used to perform consistent read-modify-write updates.
      */
@@ -160,6 +173,11 @@ export interface AiFeatureStoreState {
  * The set of arguments for constructing a AiFeatureStore resource.
  */
 export interface AiFeatureStoreArgs {
+    /**
+     * If set, both of the online and offline data storage will be secured by this key.
+     * Structure is documented below.
+     */
+    encryptionSpec?: pulumi.Input<inputs.vertex.AiFeatureStoreEncryptionSpec>;
     /**
      * If set to true, any EntityTypes and Features for this Featurestore will also be deleted
      */

package/vertex/aiFeatureStore.js

@@ -21,6 +21,9 @@ const utilities = require("../utilities");
  *     onlineServingConfig: {
  *         fixedNodeCount: 2,
  *     },
+ *     encryptionSpec: {
+ *         kmsKeyName: "kms-name",
+ *     },
  *     forceDestroy: true,
  * }, {
  *     provider: google_beta,
@@ -54,6 +57,7 @@ class AiFeatureStore extends pulumi.CustomResource {
         if (opts.id) {
             const state = argsOrState;
             resourceInputs["createTime"] = state ? state.createTime : undefined;
+            resourceInputs["encryptionSpec"] = state ? state.encryptionSpec : undefined;
             resourceInputs["etag"] = state ? state.etag : undefined;
             resourceInputs["forceDestroy"] = state ? state.forceDestroy : undefined;
             resourceInputs["labels"] = state ? state.labels : undefined;
@@ -65,6 +69,7 @@ class AiFeatureStore extends pulumi.CustomResource {
         }
         else {
             const args = argsOrState;
+            resourceInputs["encryptionSpec"] = args ? args.encryptionSpec : undefined;
             resourceInputs["forceDestroy"] = args ? args.forceDestroy : undefined;
             resourceInputs["labels"] = args ? args.labels : undefined;
             resourceInputs["name"] = args ? args.name : undefined;