pulumi-gcp 7.12.0a1709102105__py3-none-any.whl → 7.12.0a1709133800__py3-none-any.whl

pulumi_gcp/iam/access_boundary_policy.py

@@ -191,6 +191,56 @@ class AccessBoundaryPolicy(pulumi.CustomResource):
         if they would like to test it.
 
         ## Example Usage
+        ### Iam Access Boundary Policy Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        project = gcp.organizations.Project("project",
+            project_id="my-project",
+            name="my-project",
+            org_id="123456789",
+            billing_account="000000-0000000-0000000-000000")
+        access_policy = gcp.accesscontextmanager.AccessPolicy("access-policy",
+            parent=project.org_id.apply(lambda org_id: f"organizations/{org_id}"),
+            title="my policy")
+        test_access = gcp.accesscontextmanager.AccessLevel("test-access",
+            parent=access_policy.name.apply(lambda name: f"accessPolicies/{name}"),
+            name=access_policy.name.apply(lambda name: f"accessPolicies/{name}/accessLevels/chromeos_no_lock"),
+            title="chromeos_no_lock",
+            basic=gcp.accesscontextmanager.AccessLevelBasicArgs(
+                conditions=[gcp.accesscontextmanager.AccessLevelBasicConditionArgs(
+                    device_policy=gcp.accesscontextmanager.AccessLevelBasicConditionDevicePolicyArgs(
+                        require_screen_lock=True,
+                        os_constraints=[gcp.accesscontextmanager.AccessLevelBasicConditionDevicePolicyOsConstraintArgs(
+                            os_type="DESKTOP_CHROME_OS",
+                        )],
+                    ),
+                    regions=[
+                        "CH",
+                        "IT",
+                        "US",
+                    ],
+                )],
+            ))
+        example = gcp.iam.AccessBoundaryPolicy("example",
+            parent=std.urlencode_output(input=project.project_id.apply(lambda project_id: f"cloudresourcemanager.googleapis.com/projects/{project_id}")).apply(lambda invoke: invoke.result),
+            name="my-ab-policy",
+            display_name="My AB policy",
+            rules=[gcp.iam.AccessBoundaryPolicyRuleArgs(
+                description="AB rule",
+                access_boundary_rule=gcp.iam.AccessBoundaryPolicyRuleAccessBoundaryRuleArgs(
+                    available_resource="*",
+                    available_permissions=["*"],
+                    availability_condition=gcp.iam.AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs(
+                        title="Access level expr",
+                        expression=pulumi.Output.all(project.org_id, test_access.name).apply(lambda org_id, name: f"request.matchAccessLevels('{org_id}', ['{name}'])"),
+                    ),
+                ),
+            )])
+        ```
 
         ## Import
 
@@ -224,6 +274,56 @@ class AccessBoundaryPolicy(pulumi.CustomResource):
         if they would like to test it.
 
         ## Example Usage
+        ### Iam Access Boundary Policy Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        project = gcp.organizations.Project("project",
+            project_id="my-project",
+            name="my-project",
+            org_id="123456789",
+            billing_account="000000-0000000-0000000-000000")
+        access_policy = gcp.accesscontextmanager.AccessPolicy("access-policy",
+            parent=project.org_id.apply(lambda org_id: f"organizations/{org_id}"),
+            title="my policy")
+        test_access = gcp.accesscontextmanager.AccessLevel("test-access",
+            parent=access_policy.name.apply(lambda name: f"accessPolicies/{name}"),
+            name=access_policy.name.apply(lambda name: f"accessPolicies/{name}/accessLevels/chromeos_no_lock"),
+            title="chromeos_no_lock",
+            basic=gcp.accesscontextmanager.AccessLevelBasicArgs(
+                conditions=[gcp.accesscontextmanager.AccessLevelBasicConditionArgs(
+                    device_policy=gcp.accesscontextmanager.AccessLevelBasicConditionDevicePolicyArgs(
+                        require_screen_lock=True,
+                        os_constraints=[gcp.accesscontextmanager.AccessLevelBasicConditionDevicePolicyOsConstraintArgs(
+                            os_type="DESKTOP_CHROME_OS",
+                        )],
+                    ),
+                    regions=[
+                        "CH",
+                        "IT",
+                        "US",
+                    ],
+                )],
+            ))
+        example = gcp.iam.AccessBoundaryPolicy("example",
+            parent=std.urlencode_output(input=project.project_id.apply(lambda project_id: f"cloudresourcemanager.googleapis.com/projects/{project_id}")).apply(lambda invoke: invoke.result),
+            name="my-ab-policy",
+            display_name="My AB policy",
+            rules=[gcp.iam.AccessBoundaryPolicyRuleArgs(
+                description="AB rule",
+                access_boundary_rule=gcp.iam.AccessBoundaryPolicyRuleAccessBoundaryRuleArgs(
+                    available_resource="*",
+                    available_permissions=["*"],
+                    availability_condition=gcp.iam.AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs(
+                        title="Access level expr",
+                        expression=pulumi.Output.all(project.org_id, test_access.name).apply(lambda org_id, name: f"request.matchAccessLevels('{org_id}', ['{name}'])"),
+                    ),
+                ),
+            )])
+        ```
 
         ## Import
 

pulumi_gcp/iam/deny_policy.py

@@ -195,6 +195,52 @@ class DenyPolicy(pulumi.CustomResource):
             * [Permissions supported in deny policies](https://cloud.google.com/iam/docs/deny-permissions-support)
 
         ## Example Usage
+        ### Iam Deny Policy Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        project = gcp.organizations.Project("project",
+            project_id="my-project",
+            name="my-project",
+            org_id="123456789",
+            billing_account="000000-0000000-0000000-000000")
+        test_account = gcp.serviceaccount.Account("test-account",
+            account_id="svc-acc",
+            display_name="Test Service Account",
+            project=project.project_id)
+        example = gcp.iam.DenyPolicy("example",
+            parent=std.urlencode_output(input=project.project_id.apply(lambda project_id: f"cloudresourcemanager.googleapis.com/projects/{project_id}")).apply(lambda invoke: invoke.result),
+            name="my-deny-policy",
+            display_name="A deny rule",
+            rules=[
+                gcp.iam.DenyPolicyRuleArgs(
+                    description="First rule",
+                    deny_rule=gcp.iam.DenyPolicyRuleDenyRuleArgs(
+                        denied_principals=["principalSet://goog/public:all"],
+                        denial_condition=gcp.iam.DenyPolicyRuleDenyRuleDenialConditionArgs(
+                            title="Some expr",
+                            expression="!resource.matchTag('12345678/env', 'test')",
+                        ),
+                        denied_permissions=["cloudresourcemanager.googleapis.com/projects.update"],
+                    ),
+                ),
+                gcp.iam.DenyPolicyRuleArgs(
+                    description="Second rule",
+                    deny_rule=gcp.iam.DenyPolicyRuleDenyRuleArgs(
+                        denied_principals=["principalSet://goog/public:all"],
+                        denial_condition=gcp.iam.DenyPolicyRuleDenyRuleDenialConditionArgs(
+                            title="Some expr",
+                            expression="!resource.matchTag('12345678/env', 'test')",
+                        ),
+                        denied_permissions=["cloudresourcemanager.googleapis.com/projects.update"],
+                        exception_principals=[test_account.email.apply(lambda email: f"principal://iam.googleapis.com/projects/-/serviceAccounts/{email}")],
+                    ),
+                ),
+            ])
+        ```
 
         ## Import
 
@@ -232,6 +278,52 @@ class DenyPolicy(pulumi.CustomResource):
             * [Permissions supported in deny policies](https://cloud.google.com/iam/docs/deny-permissions-support)
 
         ## Example Usage
+        ### Iam Deny Policy Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        project = gcp.organizations.Project("project",
+            project_id="my-project",
+            name="my-project",
+            org_id="123456789",
+            billing_account="000000-0000000-0000000-000000")
+        test_account = gcp.serviceaccount.Account("test-account",
+            account_id="svc-acc",
+            display_name="Test Service Account",
+            project=project.project_id)
+        example = gcp.iam.DenyPolicy("example",
+            parent=std.urlencode_output(input=project.project_id.apply(lambda project_id: f"cloudresourcemanager.googleapis.com/projects/{project_id}")).apply(lambda invoke: invoke.result),
+            name="my-deny-policy",
+            display_name="A deny rule",
+            rules=[
+                gcp.iam.DenyPolicyRuleArgs(
+                    description="First rule",
+                    deny_rule=gcp.iam.DenyPolicyRuleDenyRuleArgs(
+                        denied_principals=["principalSet://goog/public:all"],
+                        denial_condition=gcp.iam.DenyPolicyRuleDenyRuleDenialConditionArgs(
+                            title="Some expr",
+                            expression="!resource.matchTag('12345678/env', 'test')",
+                        ),
+                        denied_permissions=["cloudresourcemanager.googleapis.com/projects.update"],
+                    ),
+                ),
+                gcp.iam.DenyPolicyRuleArgs(
+                    description="Second rule",
+                    deny_rule=gcp.iam.DenyPolicyRuleDenyRuleArgs(
+                        denied_principals=["principalSet://goog/public:all"],
+                        denial_condition=gcp.iam.DenyPolicyRuleDenyRuleDenialConditionArgs(
+                            title="Some expr",
+                            expression="!resource.matchTag('12345678/env', 'test')",
+                        ),
+                        denied_permissions=["cloudresourcemanager.googleapis.com/projects.update"],
+                        exception_principals=[test_account.email.apply(lambda email: f"principal://iam.googleapis.com/projects/-/serviceAccounts/{email}")],
+                    ),
+                ),
+            ])
+        ```
 
         ## Import
 

pulumi_gcp/iam/outputs.py

@@ -550,9 +550,6 @@ class WorkforcePoolProviderOidc(dict):
                .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
                keys are supported. The JWK must use following format and include only
                the following fields:
-               ```python
-               import pulumi
-               ```
         :param 'WorkforcePoolProviderOidcWebSsoConfigArgs' web_sso_config: Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.
                Structure is documented below.
         """
@@ -600,9 +597,6 @@ class WorkforcePoolProviderOidc(dict):
         .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
         keys are supported. The JWK must use following format and include only
         the following fields:
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "jwks_json")
 
@@ -896,18 +890,12 @@ class WorkloadIdentityPoolProviderOidc(dict):
                If this list is empty, the OIDC token audience must be equal to the full canonical
                resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
                For example:
-               ```python
-               import pulumi
-               ```
         :param str jwks_json: OIDC JWKs in JSON String format. For details on definition of a
                JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
                use the `jwks_uri` from the discovery document fetched from the
                .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
                keys are supported. The JWK must use following format and include only
                the following fields:
-               ```python
-               import pulumi
-               ```
         """
         pulumi.set(__self__, "issuer_uri", issuer_uri)
         if allowed_audiences is not None:
@@ -934,9 +922,6 @@ class WorkloadIdentityPoolProviderOidc(dict):
         If this list is empty, the OIDC token audience must be equal to the full canonical
         resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
         For example:
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "allowed_audiences")
 
@@ -950,9 +935,6 @@ class WorkloadIdentityPoolProviderOidc(dict):
         .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
         keys are supported. The JWK must use following format and include only
         the following fields:
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "jwks_json")
 

pulumi_gcp/iam/workforce_pool.py

@@ -417,9 +417,9 @@ class WorkforcePool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkforcePool("example",
-            location="global",
+            workforce_pool_id="example-pool",
             parent="organizations/123456789",
-            workforce_pool_id="example-pool")
+            location="global")
         ```
         ### Iam Workforce Pool Full
 
@@ -428,19 +428,19 @@ class WorkforcePool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkforcePool("example",
+            workforce_pool_id="example-pool",
+            parent="organizations/123456789",
+            location="global",
+            display_name="Display name",
+            description="A sample workforce pool.",
+            disabled=False,
+            session_duration="7200s",
             access_restrictions=gcp.iam.WorkforcePoolAccessRestrictionsArgs(
                 allowed_services=[gcp.iam.WorkforcePoolAccessRestrictionsAllowedServiceArgs(
                     domain="backstory.chronicle.security",
                 )],
                 disable_programmatic_signin=False,
-            ),
-            description="A sample workforce pool.",
-            disabled=False,
-            display_name="Display name",
-            location="global",
-            parent="organizations/123456789",
-            session_duration="7200s",
-            workforce_pool_id="example-pool")
+            ))
         ```
 
         ## Import
@@ -511,9 +511,9 @@ class WorkforcePool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkforcePool("example",
-            location="global",
+            workforce_pool_id="example-pool",
             parent="organizations/123456789",
-            workforce_pool_id="example-pool")
+            location="global")
         ```
         ### Iam Workforce Pool Full
 
@@ -522,19 +522,19 @@ class WorkforcePool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkforcePool("example",
+            workforce_pool_id="example-pool",
+            parent="organizations/123456789",
+            location="global",
+            display_name="Display name",
+            description="A sample workforce pool.",
+            disabled=False,
+            session_duration="7200s",
             access_restrictions=gcp.iam.WorkforcePoolAccessRestrictionsArgs(
                 allowed_services=[gcp.iam.WorkforcePoolAccessRestrictionsAllowedServiceArgs(
                     domain="backstory.chronicle.security",
                 )],
                 disable_programmatic_signin=False,
-            ),
-            description="A sample workforce pool.",
-            disabled=False,
-            display_name="Display name",
-            location="global",
-            parent="organizations/123456789",
-            session_duration="7200s",
-            workforce_pool_id="example-pool")
+            ))
         ```
 
         ## Import

pulumi_gcp/iam/workforce_pool_provider.py

@@ -81,9 +81,6 @@ class WorkforcePoolProviderArgs:
                For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
                For example, the following maps the sub claim of the incoming credential to the `subject` attribute
                on a Google token:
-               ```python
-               import pulumi
-               ```
                An object containing a list of `"key": value` pairs.
                Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         :param pulumi.Input[str] description: A user-specified description of the provider. Cannot exceed 256 characters.
@@ -214,9 +211,6 @@ class WorkforcePoolProviderArgs:
         For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
         For example, the following maps the sub claim of the incoming credential to the `subject` attribute
         on a Google token:
-        ```python
-        import pulumi
-        ```
         An object containing a list of `"key": value` pairs.
         Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         """
@@ -349,9 +343,6 @@ class _WorkforcePoolProviderState:
                For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
                For example, the following maps the sub claim of the incoming credential to the `subject` attribute
                on a Google token:
-               ```python
-               import pulumi
-               ```
                An object containing a list of `"key": value` pairs.
                Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         :param pulumi.Input[str] description: A user-specified description of the provider. Cannot exceed 256 characters.
@@ -464,9 +455,6 @@ class _WorkforcePoolProviderState:
         For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
         For example, the following maps the sub claim of the incoming credential to the `subject` attribute
         on a Google token:
-        ```python
-        import pulumi
-        ```
         An object containing a list of `"key": value` pairs.
         Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         """
@@ -822,9 +810,6 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
                For example, the following maps the sub claim of the incoming credential to the `subject` attribute
                on a Google token:
-               ```python
-               import pulumi
-               ```
                An object containing a list of `"key": value` pairs.
                Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         :param pulumi.Input[str] description: A user-specified description of the provider. Cannot exceed 256 characters.
@@ -1124,9 +1109,6 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
                For example, the following maps the sub claim of the incoming credential to the `subject` attribute
                on a Google token:
-               ```python
-               import pulumi
-               ```
                An object containing a list of `"key": value` pairs.
                Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         :param pulumi.Input[str] description: A user-specified description of the provider. Cannot exceed 256 characters.
@@ -1228,9 +1210,6 @@ class WorkforcePoolProvider(pulumi.CustomResource):
         For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute.
         For example, the following maps the sub claim of the incoming credential to the `subject` attribute
         on a Google token:
-        ```python
-        import pulumi
-        ```
         An object containing a list of `"key": value` pairs.
         Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
         """

pulumi_gcp/iam/workload_identity_pool.py

@@ -305,10 +305,10 @@ class WorkloadIdentityPool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkloadIdentityPool("example",
-            description="Identity pool for automated test",
-            disabled=True,
+            workload_identity_pool_id="example-pool",
             display_name="Name of pool",
-            workload_identity_pool_id="example-pool")
+            description="Identity pool for automated test",
+            disabled=True)
         ```
 
         ## Import
@@ -383,10 +383,10 @@ class WorkloadIdentityPool(pulumi.CustomResource):
         import pulumi_gcp as gcp
 
         example = gcp.iam.WorkloadIdentityPool("example",
-            description="Identity pool for automated test",
-            disabled=True,
+            workload_identity_pool_id="example-pool",
             display_name="Name of pool",
-            workload_identity_pool_id="example-pool")
+            description="Identity pool for automated test",
+            disabled=True)
         ```
 
         ## Import

pulumi_gcp/iam/workload_identity_pool_provider.py

@@ -74,18 +74,12 @@ class WorkloadIdentityPoolProviderArgs:
                the total size of all mapped attributes must not exceed 8KB.
                For AWS providers, the following rules apply:
                - If no attribute mapping is defined, the following default mapping applies:
-               ```python
-               import pulumi
-               ```
                - If any custom attribute mappings are defined, they must include a mapping to the
                `google.subject` attribute.
                For OIDC providers, the following rules apply:
                - Custom attribute mappings must be defined, and must include a mapping to the
                `google.subject` attribute. For example, the following maps the `sub` claim of the
                incoming credential to the `subject` attribute on a Google token.
-               ```python
-               import pulumi
-               ```
         :param pulumi.Input['WorkloadIdentityPoolProviderAwsArgs'] aws: An Amazon Web Services identity provider. Not compatible with the property oidc or saml.
                Structure is documented below.
         :param pulumi.Input[str] description: A description for the provider. Cannot exceed 256 characters.
@@ -202,18 +196,12 @@ class WorkloadIdentityPoolProviderArgs:
         the total size of all mapped attributes must not exceed 8KB.
         For AWS providers, the following rules apply:
         - If no attribute mapping is defined, the following default mapping applies:
-        ```python
-        import pulumi
-        ```
         - If any custom attribute mappings are defined, they must include a mapping to the
         `google.subject` attribute.
         For OIDC providers, the following rules apply:
         - Custom attribute mappings must be defined, and must include a mapping to the
         `google.subject` attribute. For example, the following maps the `sub` claim of the
         incoming credential to the `subject` attribute on a Google token.
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "attribute_mapping")
 
@@ -365,18 +353,12 @@ class _WorkloadIdentityPoolProviderState:
                the total size of all mapped attributes must not exceed 8KB.
                For AWS providers, the following rules apply:
                - If no attribute mapping is defined, the following default mapping applies:
-               ```python
-               import pulumi
-               ```
                - If any custom attribute mappings are defined, they must include a mapping to the
                `google.subject` attribute.
                For OIDC providers, the following rules apply:
                - Custom attribute mappings must be defined, and must include a mapping to the
                `google.subject` attribute. For example, the following maps the `sub` claim of the
                incoming credential to the `subject` attribute on a Google token.
-               ```python
-               import pulumi
-               ```
         :param pulumi.Input['WorkloadIdentityPoolProviderAwsArgs'] aws: An Amazon Web Services identity provider. Not compatible with the property oidc or saml.
                Structure is documented below.
         :param pulumi.Input[str] description: A description for the provider. Cannot exceed 256 characters.
@@ -486,18 +468,12 @@ class _WorkloadIdentityPoolProviderState:
         the total size of all mapped attributes must not exceed 8KB.
         For AWS providers, the following rules apply:
         - If no attribute mapping is defined, the following default mapping applies:
-        ```python
-        import pulumi
-        ```
         - If any custom attribute mappings are defined, they must include a mapping to the
         `google.subject` attribute.
         For OIDC providers, the following rules apply:
         - Custom attribute mappings must be defined, and must include a mapping to the
         `google.subject` attribute. For example, the following maps the `sub` claim of the
         incoming credential to the `subject` attribute on a Google token.
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "attribute_mapping")
 
@@ -774,6 +750,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_std as std
 
         pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
         example = gcp.iam.WorkloadIdentityPoolProvider("example",
@@ -785,7 +762,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "attribute.environment": "assertion.arn.contains(\\":instance-profile/Production\\") ? \\"prod\\" : \\"test\\"",
             },
             saml=gcp.iam.WorkloadIdentityPoolProviderSamlArgs(
-                idp_metadata_xml=(lambda path: open(path).read())("test-fixtures/metadata.xml"),
+                idp_metadata_xml=std.file(input="test-fixtures/metadata.xml").result,
             ))
         ```
         ### Iam Workload Identity Pool Provider Saml Full
@@ -793,6 +770,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_std as std
 
         pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
         example = gcp.iam.WorkloadIdentityPoolProvider("example",
@@ -807,7 +785,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "attribute.environment": "assertion.arn.contains(\\":instance-profile/Production\\") ? \\"prod\\" : \\"test\\"",
             },
             saml=gcp.iam.WorkloadIdentityPoolProviderSamlArgs(
-                idp_metadata_xml=(lambda path: open(path).read())("test-fixtures/metadata.xml"),
+                idp_metadata_xml=std.file(input="test-fixtures/metadata.xml").result,
             ))
         ```
         ### Iam Workload Identity Pool Provider Oidc Upload Key
@@ -905,18 +883,12 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                the total size of all mapped attributes must not exceed 8KB.
                For AWS providers, the following rules apply:
                - If no attribute mapping is defined, the following default mapping applies:
-               ```python
-               import pulumi
-               ```
                - If any custom attribute mappings are defined, they must include a mapping to the
                `google.subject` attribute.
                For OIDC providers, the following rules apply:
                - Custom attribute mappings must be defined, and must include a mapping to the
                `google.subject` attribute. For example, the following maps the `sub` claim of the
                incoming credential to the `subject` attribute on a Google token.
-               ```python
-               import pulumi
-               ```
         :param pulumi.Input[pulumi.InputType['WorkloadIdentityPoolProviderAwsArgs']] aws: An Amazon Web Services identity provider. Not compatible with the property oidc or saml.
                Structure is documented below.
         :param pulumi.Input[str] description: A description for the provider. Cannot exceed 256 characters.
@@ -1045,6 +1017,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_std as std
 
         pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
         example = gcp.iam.WorkloadIdentityPoolProvider("example",
@@ -1056,7 +1029,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "attribute.environment": "assertion.arn.contains(\\":instance-profile/Production\\") ? \\"prod\\" : \\"test\\"",
             },
             saml=gcp.iam.WorkloadIdentityPoolProviderSamlArgs(
-                idp_metadata_xml=(lambda path: open(path).read())("test-fixtures/metadata.xml"),
+                idp_metadata_xml=std.file(input="test-fixtures/metadata.xml").result,
             ))
         ```
         ### Iam Workload Identity Pool Provider Saml Full
@@ -1064,6 +1037,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_std as std
 
         pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
         example = gcp.iam.WorkloadIdentityPoolProvider("example",
@@ -1078,7 +1052,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "attribute.environment": "assertion.arn.contains(\\":instance-profile/Production\\") ? \\"prod\\" : \\"test\\"",
             },
             saml=gcp.iam.WorkloadIdentityPoolProviderSamlArgs(
-                idp_metadata_xml=(lambda path: open(path).read())("test-fixtures/metadata.xml"),
+                idp_metadata_xml=std.file(input="test-fixtures/metadata.xml").result,
             ))
         ```
         ### Iam Workload Identity Pool Provider Oidc Upload Key
@@ -1256,18 +1230,12 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                the total size of all mapped attributes must not exceed 8KB.
                For AWS providers, the following rules apply:
                - If no attribute mapping is defined, the following default mapping applies:
-               ```python
-               import pulumi
-               ```
                - If any custom attribute mappings are defined, they must include a mapping to the
                `google.subject` attribute.
                For OIDC providers, the following rules apply:
                - Custom attribute mappings must be defined, and must include a mapping to the
                `google.subject` attribute. For example, the following maps the `sub` claim of the
                incoming credential to the `subject` attribute on a Google token.
-               ```python
-               import pulumi
-               ```
         :param pulumi.Input[pulumi.InputType['WorkloadIdentityPoolProviderAwsArgs']] aws: An Amazon Web Services identity provider. Not compatible with the property oidc or saml.
                Structure is documented below.
         :param pulumi.Input[str] description: A description for the provider. Cannot exceed 256 characters.
@@ -1365,18 +1333,12 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         the total size of all mapped attributes must not exceed 8KB.
         For AWS providers, the following rules apply:
         - If no attribute mapping is defined, the following default mapping applies:
-        ```python
-        import pulumi
-        ```
         - If any custom attribute mappings are defined, they must include a mapping to the
         `google.subject` attribute.
         For OIDC providers, the following rules apply:
         - Custom attribute mappings must be defined, and must include a mapping to the
         `google.subject` attribute. For example, the following maps the `sub` claim of the
         incoming credential to the `subject` attribute on a Google token.
-        ```python
-        import pulumi
-        ```
         """
         return pulumi.get(self, "attribute_mapping")