pulumi-gcp 7.15.0a1711038061__py3-none-any.whl → 7.16.0__py3-none-any.whl

pulumi_gcp/firestore/database.py

@@ -8,6 +8,8 @@ import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
 from .. import _utilities
+from . import outputs
+from ._inputs import *
 
 __all__ = ['DatabaseArgs', 'Database']
 
@@ -17,6 +19,7 @@ class DatabaseArgs:
                  location_id: pulumi.Input[str],
                  type: pulumi.Input[str],
                  app_engine_integration_mode: Optional[pulumi.Input[str]] = None,
+                 cmek_config: Optional[pulumi.Input['DatabaseCmekConfigArgs']] = None,
                  concurrency_mode: Optional[pulumi.Input[str]] = None,
                  delete_protection_state: Optional[pulumi.Input[str]] = None,
                  deletion_policy: Optional[pulumi.Input[str]] = None,
@@ -36,6 +39,10 @@ class DatabaseArgs:
                - - -
         :param pulumi.Input[str] app_engine_integration_mode: The App Engine integration mode to use for this database.
                Possible values are: `ENABLED`, `DISABLED`.
+        :param pulumi.Input['DatabaseCmekConfigArgs'] cmek_config: The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+               database. If not present, the database is secured by the default Google
+               encryption key.
+               Structure is documented below.
         :param pulumi.Input[str] concurrency_mode: The concurrency control mode to use for this database.
                Possible values are: `OPTIMISTIC`, `PESSIMISTIC`, `OPTIMISTIC_WITH_ENTITY_GROUPS`.
         :param pulumi.Input[str] delete_protection_state: State of delete protection for the database. When delete protection is enabled, this database cannot be deleted. The
@@ -66,6 +73,8 @@ class DatabaseArgs:
         pulumi.set(__self__, "type", type)
         if app_engine_integration_mode is not None:
             pulumi.set(__self__, "app_engine_integration_mode", app_engine_integration_mode)
+        if cmek_config is not None:
+            pulumi.set(__self__, "cmek_config", cmek_config)
         if concurrency_mode is not None:
             pulumi.set(__self__, "concurrency_mode", concurrency_mode)
         if delete_protection_state is not None:
@@ -123,6 +132,21 @@ class DatabaseArgs:
     def app_engine_integration_mode(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "app_engine_integration_mode", value)
 
+    @property
+    @pulumi.getter(name="cmekConfig")
+    def cmek_config(self) -> Optional[pulumi.Input['DatabaseCmekConfigArgs']]:
+        """
+        The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+        database. If not present, the database is secured by the default Google
+        encryption key.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "cmek_config")
+
+    @cmek_config.setter
+    def cmek_config(self, value: Optional[pulumi.Input['DatabaseCmekConfigArgs']]):
+        pulumi.set(self, "cmek_config", value)
+
     @property
     @pulumi.getter(name="concurrencyMode")
     def concurrency_mode(self) -> Optional[pulumi.Input[str]]:
@@ -219,6 +243,7 @@ class DatabaseArgs:
 class _DatabaseState:
     def __init__(__self__, *,
                  app_engine_integration_mode: Optional[pulumi.Input[str]] = None,
+                 cmek_config: Optional[pulumi.Input['DatabaseCmekConfigArgs']] = None,
                  concurrency_mode: Optional[pulumi.Input[str]] = None,
                  create_time: Optional[pulumi.Input[str]] = None,
                  delete_protection_state: Optional[pulumi.Input[str]] = None,
@@ -238,6 +263,10 @@ class _DatabaseState:
         Input properties used for looking up and filtering Database resources.
         :param pulumi.Input[str] app_engine_integration_mode: The App Engine integration mode to use for this database.
                Possible values are: `ENABLED`, `DISABLED`.
+        :param pulumi.Input['DatabaseCmekConfigArgs'] cmek_config: The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+               database. If not present, the database is secured by the default Google
+               encryption key.
+               Structure is documented below.
         :param pulumi.Input[str] concurrency_mode: The concurrency control mode to use for this database.
                Possible values are: `OPTIMISTIC`, `PESSIMISTIC`, `OPTIMISTIC_WITH_ENTITY_GROUPS`.
         :param pulumi.Input[str] create_time: Output only. The timestamp at which this database was created.
@@ -292,6 +321,8 @@ class _DatabaseState:
         """
         if app_engine_integration_mode is not None:
             pulumi.set(__self__, "app_engine_integration_mode", app_engine_integration_mode)
+        if cmek_config is not None:
+            pulumi.set(__self__, "cmek_config", cmek_config)
         if concurrency_mode is not None:
             pulumi.set(__self__, "concurrency_mode", concurrency_mode)
         if create_time is not None:
@@ -336,6 +367,21 @@ class _DatabaseState:
     def app_engine_integration_mode(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "app_engine_integration_mode", value)
 
+    @property
+    @pulumi.getter(name="cmekConfig")
+    def cmek_config(self) -> Optional[pulumi.Input['DatabaseCmekConfigArgs']]:
+        """
+        The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+        database. If not present, the database is secured by the default Google
+        encryption key.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "cmek_config")
+
+    @cmek_config.setter
+    def cmek_config(self, value: Optional[pulumi.Input['DatabaseCmekConfigArgs']]):
+        pulumi.set(self, "cmek_config", value)
+
     @property
     @pulumi.getter(name="concurrencyMode")
     def concurrency_mode(self) -> Optional[pulumi.Input[str]]:
@@ -559,6 +605,7 @@ class Database(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  app_engine_integration_mode: Optional[pulumi.Input[str]] = None,
+                 cmek_config: Optional[pulumi.Input[pulumi.InputType['DatabaseCmekConfigArgs']]] = None,
                  concurrency_mode: Optional[pulumi.Input[str]] = None,
                  delete_protection_state: Optional[pulumi.Input[str]] = None,
                  deletion_policy: Optional[pulumi.Input[str]] = None,
@@ -618,6 +665,40 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE")
         ```
         <!--End PulumiCodeChooser -->
+        ### Firestore Cmek Database
+
+        <!--Start PulumiCodeChooser -->
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        project = gcp.organizations.get_project()
+        key_ring = gcp.kms.KeyRing("key_ring",
+            name="kms-key-ring",
+            location="us")
+        crypto_key = gcp.kms.CryptoKey("crypto_key",
+            name="kms-key",
+            key_ring=key_ring.id,
+            purpose="ENCRYPT_DECRYPT")
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="cmek-database-id",
+            location_id="nam5",
+            type="FIRESTORE_NATIVE",
+            concurrency_mode="OPTIMISTIC",
+            app_engine_integration_mode="DISABLED",
+            point_in_time_recovery_enablement="POINT_IN_TIME_RECOVERY_ENABLED",
+            delete_protection_state="DELETE_PROTECTION_ENABLED",
+            deletion_policy="DELETE",
+            cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
+                kms_key_name=crypto_key.id,
+            ))
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+        ```
+        <!--End PulumiCodeChooser -->
         ### Firestore Default Database In Datastore Mode
 
         <!--Start PulumiCodeChooser -->
@@ -651,6 +732,40 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE")
         ```
         <!--End PulumiCodeChooser -->
+        ### Firestore Cmek Database In Datastore Mode
+
+        <!--Start PulumiCodeChooser -->
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        project = gcp.organizations.get_project()
+        key_ring = gcp.kms.KeyRing("key_ring",
+            name="kms-key-ring",
+            location="us")
+        crypto_key = gcp.kms.CryptoKey("crypto_key",
+            name="kms-key",
+            key_ring=key_ring.id,
+            purpose="ENCRYPT_DECRYPT")
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="cmek-database-id",
+            location_id="nam5",
+            type="DATASTORE_MODE",
+            concurrency_mode="OPTIMISTIC",
+            app_engine_integration_mode="DISABLED",
+            point_in_time_recovery_enablement="POINT_IN_TIME_RECOVERY_ENABLED",
+            delete_protection_state="DELETE_PROTECTION_ENABLED",
+            deletion_policy="DELETE",
+            cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
+                kms_key_name=crypto_key.id,
+            ))
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+        ```
+        <!--End PulumiCodeChooser -->
 
         ## Import
 
@@ -680,6 +795,10 @@ class Database(pulumi.CustomResource):
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] app_engine_integration_mode: The App Engine integration mode to use for this database.
                Possible values are: `ENABLED`, `DISABLED`.
+        :param pulumi.Input[pulumi.InputType['DatabaseCmekConfigArgs']] cmek_config: The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+               database. If not present, the database is secured by the default Google
+               encryption key.
+               Structure is documented below.
         :param pulumi.Input[str] concurrency_mode: The concurrency control mode to use for this database.
                Possible values are: `OPTIMISTIC`, `PESSIMISTIC`, `OPTIMISTIC_WITH_ENTITY_GROUPS`.
         :param pulumi.Input[str] delete_protection_state: State of delete protection for the database. When delete protection is enabled, this database cannot be deleted. The
@@ -771,6 +890,40 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE")
         ```
         <!--End PulumiCodeChooser -->
+        ### Firestore Cmek Database
+
+        <!--Start PulumiCodeChooser -->
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        project = gcp.organizations.get_project()
+        key_ring = gcp.kms.KeyRing("key_ring",
+            name="kms-key-ring",
+            location="us")
+        crypto_key = gcp.kms.CryptoKey("crypto_key",
+            name="kms-key",
+            key_ring=key_ring.id,
+            purpose="ENCRYPT_DECRYPT")
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="cmek-database-id",
+            location_id="nam5",
+            type="FIRESTORE_NATIVE",
+            concurrency_mode="OPTIMISTIC",
+            app_engine_integration_mode="DISABLED",
+            point_in_time_recovery_enablement="POINT_IN_TIME_RECOVERY_ENABLED",
+            delete_protection_state="DELETE_PROTECTION_ENABLED",
+            deletion_policy="DELETE",
+            cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
+                kms_key_name=crypto_key.id,
+            ))
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+        ```
+        <!--End PulumiCodeChooser -->
         ### Firestore Default Database In Datastore Mode
 
         <!--Start PulumiCodeChooser -->
@@ -804,6 +957,40 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE")
         ```
         <!--End PulumiCodeChooser -->
+        ### Firestore Cmek Database In Datastore Mode
+
+        <!--Start PulumiCodeChooser -->
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        project = gcp.organizations.get_project()
+        key_ring = gcp.kms.KeyRing("key_ring",
+            name="kms-key-ring",
+            location="us")
+        crypto_key = gcp.kms.CryptoKey("crypto_key",
+            name="kms-key",
+            key_ring=key_ring.id,
+            purpose="ENCRYPT_DECRYPT")
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="cmek-database-id",
+            location_id="nam5",
+            type="DATASTORE_MODE",
+            concurrency_mode="OPTIMISTIC",
+            app_engine_integration_mode="DISABLED",
+            point_in_time_recovery_enablement="POINT_IN_TIME_RECOVERY_ENABLED",
+            delete_protection_state="DELETE_PROTECTION_ENABLED",
+            deletion_policy="DELETE",
+            cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
+                kms_key_name=crypto_key.id,
+            ))
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+        ```
+        <!--End PulumiCodeChooser -->
 
         ## Import
 
@@ -845,6 +1032,7 @@ class Database(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  app_engine_integration_mode: Optional[pulumi.Input[str]] = None,
+                 cmek_config: Optional[pulumi.Input[pulumi.InputType['DatabaseCmekConfigArgs']]] = None,
                  concurrency_mode: Optional[pulumi.Input[str]] = None,
                  delete_protection_state: Optional[pulumi.Input[str]] = None,
                  deletion_policy: Optional[pulumi.Input[str]] = None,
@@ -863,6 +1051,7 @@ class Database(pulumi.CustomResource):
             __props__ = DatabaseArgs.__new__(DatabaseArgs)
 
             __props__.__dict__["app_engine_integration_mode"] = app_engine_integration_mode
+            __props__.__dict__["cmek_config"] = cmek_config
             __props__.__dict__["concurrency_mode"] = concurrency_mode
             __props__.__dict__["delete_protection_state"] = delete_protection_state
             __props__.__dict__["deletion_policy"] = deletion_policy
@@ -893,6 +1082,7 @@ class Database(pulumi.CustomResource):
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             app_engine_integration_mode: Optional[pulumi.Input[str]] = None,
+            cmek_config: Optional[pulumi.Input[pulumi.InputType['DatabaseCmekConfigArgs']]] = None,
             concurrency_mode: Optional[pulumi.Input[str]] = None,
             create_time: Optional[pulumi.Input[str]] = None,
             delete_protection_state: Optional[pulumi.Input[str]] = None,
@@ -917,6 +1107,10 @@ class Database(pulumi.CustomResource):
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] app_engine_integration_mode: The App Engine integration mode to use for this database.
                Possible values are: `ENABLED`, `DISABLED`.
+        :param pulumi.Input[pulumi.InputType['DatabaseCmekConfigArgs']] cmek_config: The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+               database. If not present, the database is secured by the default Google
+               encryption key.
+               Structure is documented below.
         :param pulumi.Input[str] concurrency_mode: The concurrency control mode to use for this database.
                Possible values are: `OPTIMISTIC`, `PESSIMISTIC`, `OPTIMISTIC_WITH_ENTITY_GROUPS`.
         :param pulumi.Input[str] create_time: Output only. The timestamp at which this database was created.
@@ -974,6 +1168,7 @@ class Database(pulumi.CustomResource):
         __props__ = _DatabaseState.__new__(_DatabaseState)
 
         __props__.__dict__["app_engine_integration_mode"] = app_engine_integration_mode
+        __props__.__dict__["cmek_config"] = cmek_config
         __props__.__dict__["concurrency_mode"] = concurrency_mode
         __props__.__dict__["create_time"] = create_time
         __props__.__dict__["delete_protection_state"] = delete_protection_state
@@ -1000,6 +1195,17 @@ class Database(pulumi.CustomResource):
         """
         return pulumi.get(self, "app_engine_integration_mode")
 
+    @property
+    @pulumi.getter(name="cmekConfig")
+    def cmek_config(self) -> pulumi.Output[Optional['outputs.DatabaseCmekConfig']]:
+        """
+        The CMEK (Customer Managed Encryption Key) configuration for a Firestore
+        database. If not present, the database is secured by the default Google
+        encryption key.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "cmek_config")
+
     @property
     @pulumi.getter(name="concurrencyMode")
     def concurrency_mode(self) -> pulumi.Output[str]:

pulumi_gcp/firestore/index.py

@@ -320,32 +320,18 @@ class Index(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
-        import pulumi_time as time
-
-        project = gcp.organizations.Project("project",
-            project_id="project-id",
-            name="project-id",
-            org_id="123456789")
-        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s)
-        firestore = gcp.projects.Service("firestore",
-            project=project.project_id,
-            service="firestore.googleapis.com")
+
         database = gcp.firestore.Database("database",
-            project=project.project_id,
-            name="(default)",
+            project="my-project-name",
+            name="database-id",
             location_id="nam5",
-            type="FIRESTORE_NATIVE")
-        # Creating a document also creates its collection
-        document = gcp.firestore.Document("document",
-            project=project.project_id,
-            database=database.name,
-            collection="somenewcollection",
-            document_id="",
-            fields="{\\"something\\":{\\"mapValue\\":{\\"fields\\":{\\"akey\\":{\\"stringValue\\":\\"avalue\\"}}}}}")
+            type="FIRESTORE_NATIVE",
+            delete_protection_state="DELETE_PROTECTION_DISABLED",
+            deletion_policy="DELETE")
         my_index = gcp.firestore.Index("my-index",
-            project=project.project_id,
+            project="my-project-name",
             database=database.name,
-            collection=document.collection,
+            collection="atestcollection",
             fields=[
                 gcp.firestore.IndexFieldArgs(
                     field_path="name",
@@ -365,10 +351,17 @@ class Index(pulumi.CustomResource):
         import pulumi
         import pulumi_gcp as gcp
 
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="database-id-dm",
+            location_id="nam5",
+            type="DATASTORE_MODE",
+            delete_protection_state="DELETE_PROTECTION_DISABLED",
+            deletion_policy="DELETE")
         my_index = gcp.firestore.Index("my-index",
             project="my-project-name",
-            database="(default)",
-            collection="chatrooms",
+            database=database.name,
+            collection="atestcollection",
             query_scope="COLLECTION_RECURSIVE",
             api_scope="DATASTORE_MODE_API",
             fields=[
@@ -449,32 +442,18 @@ class Index(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
-        import pulumi_time as time
-
-        project = gcp.organizations.Project("project",
-            project_id="project-id",
-            name="project-id",
-            org_id="123456789")
-        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s)
-        firestore = gcp.projects.Service("firestore",
-            project=project.project_id,
-            service="firestore.googleapis.com")
+
         database = gcp.firestore.Database("database",
-            project=project.project_id,
-            name="(default)",
+            project="my-project-name",
+            name="database-id",
             location_id="nam5",
-            type="FIRESTORE_NATIVE")
-        # Creating a document also creates its collection
-        document = gcp.firestore.Document("document",
-            project=project.project_id,
-            database=database.name,
-            collection="somenewcollection",
-            document_id="",
-            fields="{\\"something\\":{\\"mapValue\\":{\\"fields\\":{\\"akey\\":{\\"stringValue\\":\\"avalue\\"}}}}}")
+            type="FIRESTORE_NATIVE",
+            delete_protection_state="DELETE_PROTECTION_DISABLED",
+            deletion_policy="DELETE")
         my_index = gcp.firestore.Index("my-index",
-            project=project.project_id,
+            project="my-project-name",
             database=database.name,
-            collection=document.collection,
+            collection="atestcollection",
             fields=[
                 gcp.firestore.IndexFieldArgs(
                     field_path="name",
@@ -494,10 +473,17 @@ class Index(pulumi.CustomResource):
         import pulumi
         import pulumi_gcp as gcp
 
+        database = gcp.firestore.Database("database",
+            project="my-project-name",
+            name="database-id-dm",
+            location_id="nam5",
+            type="DATASTORE_MODE",
+            delete_protection_state="DELETE_PROTECTION_DISABLED",
+            deletion_policy="DELETE")
         my_index = gcp.firestore.Index("my-index",
             project="my-project-name",
-            database="(default)",
-            collection="chatrooms",
+            database=database.name,
+            collection="atestcollection",
             query_scope="COLLECTION_RECURSIVE",
             api_scope="DATASTORE_MODE_API",
             fields=[

pulumi_gcp/firestore/outputs.py

@@ -13,6 +13,7 @@ from . import outputs
 __all__ = [
     'BackupScheduleDailyRecurrence',
     'BackupScheduleWeeklyRecurrence',
+    'DatabaseCmekConfig',
     'FieldIndexConfig',
     'FieldIndexConfigIndex',
     'FieldTtlConfig',
@@ -46,6 +47,85 @@ class BackupScheduleWeeklyRecurrence(dict):
         return pulumi.get(self, "day")
 
 
+@pulumi.output_type
+class DatabaseCmekConfig(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "kmsKeyName":
+            suggest = "kms_key_name"
+        elif key == "activeKeyVersions":
+            suggest = "active_key_versions"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in DatabaseCmekConfig. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        DatabaseCmekConfig.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        DatabaseCmekConfig.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 kms_key_name: str,
+                 active_key_versions: Optional[Sequence[str]] = None):
+        """
+        :param str kms_key_name: The resource ID of a Cloud KMS key. If set, the database created will
+               be a Customer-managed Encryption Key (CMEK) database encrypted with
+               this key. This feature is allowlist only in initial launch.
+               Only keys in the same location as this database are allowed to be used
+               for encryption. For Firestore's nam5 multi-region, this corresponds to Cloud KMS
+               multi-region us. For Firestore's eur3 multi-region, this corresponds to
+               Cloud KMS multi-region europe. See https://cloud.google.com/kms/docs/locations.
+               This value should be the KMS key resource ID in the format of
+               `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.
+               How to retrive this resource ID is listed at
+               https://cloud.google.com/kms/docs/getting-resource-ids#getting_the_id_for_a_key_and_version.
+        :param Sequence[str] active_key_versions: (Output)
+               Currently in-use KMS key versions (https://cloud.google.com/kms/docs/resource-hierarchy#key_versions).
+               During key rotation (https://cloud.google.com/kms/docs/key-rotation), there can be
+               multiple in-use key versions.
+               The expected format is
+               `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}`.
+        """
+        pulumi.set(__self__, "kms_key_name", kms_key_name)
+        if active_key_versions is not None:
+            pulumi.set(__self__, "active_key_versions", active_key_versions)
+
+    @property
+    @pulumi.getter(name="kmsKeyName")
+    def kms_key_name(self) -> str:
+        """
+        The resource ID of a Cloud KMS key. If set, the database created will
+        be a Customer-managed Encryption Key (CMEK) database encrypted with
+        this key. This feature is allowlist only in initial launch.
+        Only keys in the same location as this database are allowed to be used
+        for encryption. For Firestore's nam5 multi-region, this corresponds to Cloud KMS
+        multi-region us. For Firestore's eur3 multi-region, this corresponds to
+        Cloud KMS multi-region europe. See https://cloud.google.com/kms/docs/locations.
+        This value should be the KMS key resource ID in the format of
+        `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.
+        How to retrive this resource ID is listed at
+        https://cloud.google.com/kms/docs/getting-resource-ids#getting_the_id_for_a_key_and_version.
+        """
+        return pulumi.get(self, "kms_key_name")
+
+    @property
+    @pulumi.getter(name="activeKeyVersions")
+    def active_key_versions(self) -> Optional[Sequence[str]]:
+        """
+        (Output)
+        Currently in-use KMS key versions (https://cloud.google.com/kms/docs/resource-hierarchy#key_versions).
+        During key rotation (https://cloud.google.com/kms/docs/key-rotation), there can be
+        multiple in-use key versions.
+        The expected format is
+        `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}`.
+        """
+        return pulumi.get(self, "active_key_versions")
+
+
 @pulumi.output_type
 class FieldIndexConfig(dict):
     def __init__(__self__, *,

pulumi_gcp/gkeonprem/_inputs.py

@@ -4904,8 +4904,7 @@ class VMwareClusterNetworkConfigArgs:
                Structure is documented below.
         :param pulumi.Input['VMwareClusterNetworkConfigStaticIpConfigArgs'] static_ip_config: Configuration settings for a static IP configuration.
                Structure is documented below.
-        :param pulumi.Input[str] vcenter_network: (Output)
-               vcenter_network specifies vCenter network name. Inherited from the admin cluster.
+        :param pulumi.Input[str] vcenter_network: vcenter_network specifies vCenter network name. Inherited from the admin cluster.
         """
         pulumi.set(__self__, "pod_address_cidr_blocks", pod_address_cidr_blocks)
         pulumi.set(__self__, "service_address_cidr_blocks", service_address_cidr_blocks)
@@ -5003,7 +5002,6 @@ class VMwareClusterNetworkConfigArgs:
     @pulumi.getter(name="vcenterNetwork")
     def vcenter_network(self) -> Optional[pulumi.Input[str]]:
         """
-        (Output)
         vcenter_network specifies vCenter network name. Inherited from the admin cluster.
         """
         return pulumi.get(self, "vcenter_network")

pulumi_gcp/gkeonprem/outputs.py

@@ -5361,8 +5361,7 @@ class VMwareClusterNetworkConfig(dict):
                Structure is documented below.
         :param 'VMwareClusterNetworkConfigStaticIpConfigArgs' static_ip_config: Configuration settings for a static IP configuration.
                Structure is documented below.
-        :param str vcenter_network: (Output)
-               vcenter_network specifies vCenter network name. Inherited from the admin cluster.
+        :param str vcenter_network: vcenter_network specifies vCenter network name. Inherited from the admin cluster.
         """
         pulumi.set(__self__, "pod_address_cidr_blocks", pod_address_cidr_blocks)
         pulumi.set(__self__, "service_address_cidr_blocks", service_address_cidr_blocks)
@@ -5436,7 +5435,6 @@ class VMwareClusterNetworkConfig(dict):
     @pulumi.getter(name="vcenterNetwork")
     def vcenter_network(self) -> Optional[str]:
         """
-        (Output)
         vcenter_network specifies vCenter network name. Inherited from the admin cluster.
         """
         return pulumi.get(self, "vcenter_network")

pulumi_gcp/gkeonprem/v_mware_cluster.py

@@ -1093,6 +1093,7 @@ class VMwareCluster(pulumi.CustomResource):
                         gateway="test-gateway",
                     ),
                 ),
+                vcenter_network="test-vcenter-network",
             ),
             control_plane_node=gcp.gkeonprem.VMwareClusterControlPlaneNodeArgs(
                 cpus=4,
@@ -1399,6 +1400,7 @@ class VMwareCluster(pulumi.CustomResource):
                         gateway="test-gateway",
                     ),
                 ),
+                vcenter_network="test-vcenter-network",
             ),
             control_plane_node=gcp.gkeonprem.VMwareClusterControlPlaneNodeArgs(
                 cpus=4,

pulumi_gcp/iap/__init__.py

@@ -16,6 +16,7 @@ from .client import *
 from .get_app_engine_service_iam_policy import *
 from .get_app_engine_version_iam_policy import *
 from .get_client import *
+from .get_tunnel_dest_group_iam_policy import *
 from .get_tunnel_iam_policy import *
 from .get_tunnel_instance_iam_policy import *
 from .get_web_backend_service_iam_policy import *
@@ -23,6 +24,10 @@ from .get_web_iam_policy import *
 from .get_web_region_backend_service_iam_policy import *
 from .get_web_type_app_engine_iam_policy import *
 from .get_web_type_compute_iam_policy import *
+from .tunnel_dest_group import *
+from .tunnel_dest_group_iam_binding import *
+from .tunnel_dest_group_iam_member import *
+from .tunnel_dest_group_iam_policy import *
 from .tunnel_iam_binding import *
 from .tunnel_iam_member import *
 from .tunnel_iam_policy import *