pulumi-gcp 7.29.0a1719417555__py3-none-any.whl → 7.30.0__py3-none-any.whl

pulumi_gcp/certificateauthority/_inputs.py

@@ -4,105 +4,220 @@
 
 import copy
 import warnings
+import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 
 __all__ = [
     'AuthorityAccessUrlArgs',
+    'AuthorityAccessUrlArgsDict',
     'AuthorityConfigArgs',
+    'AuthorityConfigArgsDict',
     'AuthorityConfigSubjectConfigArgs',
+    'AuthorityConfigSubjectConfigArgsDict',
     'AuthorityConfigSubjectConfigSubjectArgs',
+    'AuthorityConfigSubjectConfigSubjectArgsDict',
     'AuthorityConfigSubjectConfigSubjectAltNameArgs',
+    'AuthorityConfigSubjectConfigSubjectAltNameArgsDict',
     'AuthorityConfigSubjectKeyIdArgs',
+    'AuthorityConfigSubjectKeyIdArgsDict',
     'AuthorityConfigX509ConfigArgs',
+    'AuthorityConfigX509ConfigArgsDict',
     'AuthorityConfigX509ConfigAdditionalExtensionArgs',
+    'AuthorityConfigX509ConfigAdditionalExtensionArgsDict',
     'AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgs',
+    'AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgsDict',
     'AuthorityConfigX509ConfigCaOptionsArgs',
+    'AuthorityConfigX509ConfigCaOptionsArgsDict',
     'AuthorityConfigX509ConfigKeyUsageArgs',
+    'AuthorityConfigX509ConfigKeyUsageArgsDict',
     'AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs',
+    'AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgsDict',
     'AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs',
+    'AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict',
     'AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs',
+    'AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict',
     'AuthorityConfigX509ConfigNameConstraintsArgs',
+    'AuthorityConfigX509ConfigNameConstraintsArgsDict',
     'AuthorityConfigX509ConfigPolicyIdArgs',
+    'AuthorityConfigX509ConfigPolicyIdArgsDict',
     'AuthorityKeySpecArgs',
+    'AuthorityKeySpecArgsDict',
     'AuthoritySubordinateConfigArgs',
+    'AuthoritySubordinateConfigArgsDict',
     'AuthoritySubordinateConfigPemIssuerChainArgs',
+    'AuthoritySubordinateConfigPemIssuerChainArgsDict',
     'CaPoolIamBindingConditionArgs',
+    'CaPoolIamBindingConditionArgsDict',
     'CaPoolIamMemberConditionArgs',
+    'CaPoolIamMemberConditionArgsDict',
     'CaPoolIssuancePolicyArgs',
+    'CaPoolIssuancePolicyArgsDict',
     'CaPoolIssuancePolicyAllowedIssuanceModesArgs',
+    'CaPoolIssuancePolicyAllowedIssuanceModesArgsDict',
     'CaPoolIssuancePolicyAllowedKeyTypeArgs',
+    'CaPoolIssuancePolicyAllowedKeyTypeArgsDict',
     'CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgs',
+    'CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgsDict',
     'CaPoolIssuancePolicyAllowedKeyTypeRsaArgs',
+    'CaPoolIssuancePolicyAllowedKeyTypeRsaArgsDict',
     'CaPoolIssuancePolicyBaselineValuesArgs',
+    'CaPoolIssuancePolicyBaselineValuesArgsDict',
     'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgs',
+    'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgsDict',
     'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgs',
+    'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgsDict',
     'CaPoolIssuancePolicyBaselineValuesCaOptionsArgs',
+    'CaPoolIssuancePolicyBaselineValuesCaOptionsArgsDict',
     'CaPoolIssuancePolicyBaselineValuesKeyUsageArgs',
+    'CaPoolIssuancePolicyBaselineValuesKeyUsageArgsDict',
     'CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs',
+    'CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgsDict',
     'CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs',
+    'CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgsDict',
     'CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgs',
+    'CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgsDict',
     'CaPoolIssuancePolicyBaselineValuesNameConstraintsArgs',
+    'CaPoolIssuancePolicyBaselineValuesNameConstraintsArgsDict',
     'CaPoolIssuancePolicyBaselineValuesPolicyIdArgs',
+    'CaPoolIssuancePolicyBaselineValuesPolicyIdArgsDict',
     'CaPoolIssuancePolicyIdentityConstraintsArgs',
+    'CaPoolIssuancePolicyIdentityConstraintsArgsDict',
     'CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs',
+    'CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgsDict',
     'CaPoolPublishingOptionsArgs',
+    'CaPoolPublishingOptionsArgsDict',
     'CertificateCertificateDescriptionArgs',
+    'CertificateCertificateDescriptionArgsDict',
     'CertificateCertificateDescriptionAuthorityKeyIdArgs',
+    'CertificateCertificateDescriptionAuthorityKeyIdArgsDict',
     'CertificateCertificateDescriptionCertFingerprintArgs',
+    'CertificateCertificateDescriptionCertFingerprintArgsDict',
     'CertificateCertificateDescriptionPublicKeyArgs',
+    'CertificateCertificateDescriptionPublicKeyArgsDict',
     'CertificateCertificateDescriptionSubjectDescriptionArgs',
+    'CertificateCertificateDescriptionSubjectDescriptionArgsDict',
     'CertificateCertificateDescriptionSubjectDescriptionSubjectArgs',
+    'CertificateCertificateDescriptionSubjectDescriptionSubjectArgsDict',
     'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgs',
+    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgsDict',
     'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgs',
+    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgsDict',
     'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgs',
+    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgsDict',
     'CertificateCertificateDescriptionSubjectKeyIdArgs',
+    'CertificateCertificateDescriptionSubjectKeyIdArgsDict',
     'CertificateCertificateDescriptionX509DescriptionArgs',
+    'CertificateCertificateDescriptionX509DescriptionArgsDict',
     'CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgs',
+    'CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgsDict',
     'CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgs',
+    'CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgsDict',
     'CertificateCertificateDescriptionX509DescriptionCaOptionArgs',
+    'CertificateCertificateDescriptionX509DescriptionCaOptionArgsDict',
     'CertificateCertificateDescriptionX509DescriptionKeyUsageArgs',
+    'CertificateCertificateDescriptionX509DescriptionKeyUsageArgsDict',
     'CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgs',
+    'CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgsDict',
     'CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgs',
+    'CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgsDict',
     'CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgs',
+    'CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgsDict',
     'CertificateCertificateDescriptionX509DescriptionNameConstraintArgs',
+    'CertificateCertificateDescriptionX509DescriptionNameConstraintArgsDict',
     'CertificateCertificateDescriptionX509DescriptionPolicyIdArgs',
+    'CertificateCertificateDescriptionX509DescriptionPolicyIdArgsDict',
     'CertificateConfigArgs',
+    'CertificateConfigArgsDict',
     'CertificateConfigPublicKeyArgs',
+    'CertificateConfigPublicKeyArgsDict',
     'CertificateConfigSubjectConfigArgs',
+    'CertificateConfigSubjectConfigArgsDict',
     'CertificateConfigSubjectConfigSubjectArgs',
+    'CertificateConfigSubjectConfigSubjectArgsDict',
     'CertificateConfigSubjectConfigSubjectAltNameArgs',
+    'CertificateConfigSubjectConfigSubjectAltNameArgsDict',
     'CertificateConfigSubjectKeyIdArgs',
+    'CertificateConfigSubjectKeyIdArgsDict',
     'CertificateConfigX509ConfigArgs',
+    'CertificateConfigX509ConfigArgsDict',
     'CertificateConfigX509ConfigAdditionalExtensionArgs',
+    'CertificateConfigX509ConfigAdditionalExtensionArgsDict',
     'CertificateConfigX509ConfigAdditionalExtensionObjectIdArgs',
+    'CertificateConfigX509ConfigAdditionalExtensionObjectIdArgsDict',
     'CertificateConfigX509ConfigCaOptionsArgs',
+    'CertificateConfigX509ConfigCaOptionsArgsDict',
     'CertificateConfigX509ConfigKeyUsageArgs',
+    'CertificateConfigX509ConfigKeyUsageArgsDict',
     'CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs',
+    'CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgsDict',
     'CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs',
+    'CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict',
     'CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs',
+    'CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict',
     'CertificateConfigX509ConfigNameConstraintsArgs',
+    'CertificateConfigX509ConfigNameConstraintsArgsDict',
     'CertificateConfigX509ConfigPolicyIdArgs',
+    'CertificateConfigX509ConfigPolicyIdArgsDict',
     'CertificateRevocationDetailArgs',
+    'CertificateRevocationDetailArgsDict',
     'CertificateTemplateIamBindingConditionArgs',
+    'CertificateTemplateIamBindingConditionArgsDict',
     'CertificateTemplateIamMemberConditionArgs',
+    'CertificateTemplateIamMemberConditionArgsDict',
     'CertificateTemplateIdentityConstraintsArgs',
+    'CertificateTemplateIdentityConstraintsArgsDict',
     'CertificateTemplateIdentityConstraintsCelExpressionArgs',
+    'CertificateTemplateIdentityConstraintsCelExpressionArgsDict',
     'CertificateTemplatePassthroughExtensionsArgs',
+    'CertificateTemplatePassthroughExtensionsArgsDict',
     'CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs',
+    'CertificateTemplatePassthroughExtensionsAdditionalExtensionArgsDict',
     'CertificateTemplatePredefinedValuesArgs',
+    'CertificateTemplatePredefinedValuesArgsDict',
     'CertificateTemplatePredefinedValuesAdditionalExtensionArgs',
+    'CertificateTemplatePredefinedValuesAdditionalExtensionArgsDict',
     'CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs',
+    'CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgsDict',
     'CertificateTemplatePredefinedValuesCaOptionsArgs',
+    'CertificateTemplatePredefinedValuesCaOptionsArgsDict',
     'CertificateTemplatePredefinedValuesKeyUsageArgs',
+    'CertificateTemplatePredefinedValuesKeyUsageArgsDict',
     'CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs',
+    'CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgsDict',
     'CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs',
+    'CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgsDict',
     'CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs',
+    'CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgsDict',
     'CertificateTemplatePredefinedValuesPolicyIdArgs',
+    'CertificateTemplatePredefinedValuesPolicyIdArgsDict',
 ]
 
+MYPY = False
+
+if not MYPY:
+    class AuthorityAccessUrlArgsDict(TypedDict):
+        ca_certificate_access_url: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The URL where this CertificateAuthority's CA certificate is published. This will only be
+        set for CAs that have been activated.
+        """
+        crl_access_urls: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        (Output)
+        The URL where this CertificateAuthority's CRLs are published. This will only be set for
+        CAs that have been activated.
+        """
+elif False:
+    AuthorityAccessUrlArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityAccessUrlArgs:
     def __init__(__self__, *,
@@ -150,6 +265,26 @@ class AuthorityAccessUrlArgs:
         pulumi.set(self, "crl_access_urls", value)
 
 
+if not MYPY:
+    class AuthorityConfigArgsDict(TypedDict):
+        subject_config: pulumi.Input['AuthorityConfigSubjectConfigArgsDict']
+        """
+        Specifies some of the values in a certificate that are related to the subject.
+        Structure is documented below.
+        """
+        x509_config: pulumi.Input['AuthorityConfigX509ConfigArgsDict']
+        """
+        Describes how some of the technical X.509 fields in a certificate should be populated.
+        Structure is documented below.
+        """
+        subject_key_id: NotRequired[pulumi.Input['AuthorityConfigSubjectKeyIdArgsDict']]
+        """
+        When specified this provides a custom SKI to be used in the certificate. This should only be used to maintain a SKI of an existing CA originally created outside CA service, which was not generated using method (1) described in RFC 5280 section 4.2.1.2..
+        Structure is documented below.
+        """
+elif False:
+    AuthorityConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigArgs:
     def __init__(__self__, *,
@@ -209,6 +344,21 @@ class AuthorityConfigArgs:
         pulumi.set(self, "subject_key_id", value)
 
 
+if not MYPY:
+    class AuthorityConfigSubjectConfigArgsDict(TypedDict):
+        subject: pulumi.Input['AuthorityConfigSubjectConfigSubjectArgsDict']
+        """
+        Contains distinguished name fields such as the location and organization.
+        Structure is documented below.
+        """
+        subject_alt_name: NotRequired[pulumi.Input['AuthorityConfigSubjectConfigSubjectAltNameArgsDict']]
+        """
+        The subject alternative name fields.
+        Structure is documented below.
+        """
+elif False:
+    AuthorityConfigSubjectConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigSubjectConfigArgs:
     def __init__(__self__, *,
@@ -251,6 +401,43 @@ class AuthorityConfigSubjectConfigArgs:
         pulumi.set(self, "subject_alt_name", value)
 
 
+if not MYPY:
+    class AuthorityConfigSubjectConfigSubjectArgsDict(TypedDict):
+        common_name: pulumi.Input[str]
+        """
+        The common name of the distinguished name.
+        """
+        organization: pulumi.Input[str]
+        """
+        The organization of the subject.
+        """
+        country_code: NotRequired[pulumi.Input[str]]
+        """
+        The country code of the subject.
+        """
+        locality: NotRequired[pulumi.Input[str]]
+        """
+        The locality or city of the subject.
+        """
+        organizational_unit: NotRequired[pulumi.Input[str]]
+        """
+        The organizational unit of the subject.
+        """
+        postal_code: NotRequired[pulumi.Input[str]]
+        """
+        The postal code of the subject.
+        """
+        province: NotRequired[pulumi.Input[str]]
+        """
+        The province, territory, or regional state of the subject.
+        """
+        street_address: NotRequired[pulumi.Input[str]]
+        """
+        The street address of the subject.
+        """
+elif False:
+    AuthorityConfigSubjectConfigSubjectArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigSubjectConfigSubjectArgs:
     def __init__(__self__, *,
@@ -384,6 +571,27 @@ class AuthorityConfigSubjectConfigSubjectArgs:
         pulumi.set(self, "street_address", value)
 
 
+if not MYPY:
+    class AuthorityConfigSubjectConfigSubjectAltNameArgsDict(TypedDict):
+        dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid, fully-qualified host names.
+        """
+        email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 2822 E-mail addresses.
+        """
+        ip_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
+        """
+        uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 3986 URIs.
+        """
+elif False:
+    AuthorityConfigSubjectConfigSubjectAltNameArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigSubjectConfigSubjectAltNameArgs:
     def __init__(__self__, *,
@@ -455,6 +663,17 @@ class AuthorityConfigSubjectConfigSubjectAltNameArgs:
         pulumi.set(self, "uris", value)
 
 
+if not MYPY:
+    class AuthorityConfigSubjectKeyIdArgsDict(TypedDict):
+        key_id: NotRequired[pulumi.Input[str]]
+        """
+        The value of the KeyId in lowercase hexidecimal.
+
+        <a name="nested_x509_config"></a>The `x509_config` block supports:
+        """
+elif False:
+    AuthorityConfigSubjectKeyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigSubjectKeyIdArgs:
     def __init__(__self__, *,
@@ -482,6 +701,36 @@ class AuthorityConfigSubjectKeyIdArgs:
         pulumi.set(self, "key_id", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigArgsDict(TypedDict):
+        ca_options: pulumi.Input['AuthorityConfigX509ConfigCaOptionsArgsDict']
+        """
+        Describes values that are relevant in a CA certificate.
+        """
+        key_usage: pulumi.Input['AuthorityConfigX509ConfigKeyUsageArgsDict']
+        """
+        Indicates the intended use for keys that correspond to a certificate.
+        """
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['AuthorityConfigX509ConfigAdditionalExtensionArgsDict']]]]
+        """
+        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
+        """
+        aia_ocsp_servers: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
+        "Authority Information Access" extension in the certificate.
+        """
+        name_constraints: NotRequired[pulumi.Input['AuthorityConfigX509ConfigNameConstraintsArgsDict']]
+        """
+        Describes the X.509 name constraints extension.
+        """
+        policy_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['AuthorityConfigX509ConfigPolicyIdArgsDict']]]]
+        """
+        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+        """
+elif False:
+    AuthorityConfigX509ConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigArgs:
     def __init__(__self__, *,
@@ -585,6 +834,25 @@ class AuthorityConfigX509ConfigArgs:
         pulumi.set(self, "policy_ids", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigAdditionalExtensionArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not this extension is critical (i.e., if the client does not know how to
+        handle this extension, the client should consider this to be an error).
+        """
+        object_id: pulumi.Input['AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgsDict']
+        """
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        value: pulumi.Input[str]
+        """
+        The value of this X.509 extension. A base64-encoded string.
+        """
+elif False:
+    AuthorityConfigX509ConfigAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -641,6 +909,15 @@ class AuthorityConfigX509ConfigAdditionalExtensionArgs:
         pulumi.set(self, "value", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgs:
     def __init__(__self__, *,
@@ -663,6 +940,32 @@ class AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigCaOptionsArgsDict(TypedDict):
+        is_ca: pulumi.Input[bool]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to true.
+        """
+        max_issuer_path_length: NotRequired[pulumi.Input[int]]
+        """
+        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
+        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. Setting the value to 0
+        requires setting `zero_max_issuer_path_length = true`.
+        """
+        non_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to false.
+        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
+        """
+        zero_max_issuer_path_length: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
+        If both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
+        the max path length will be omitted from the CA certificate.
+        """
+elif False:
+    AuthorityConfigX509ConfigCaOptionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigCaOptionsArgs:
     def __init__(__self__, *,
@@ -743,6 +1046,26 @@ class AuthorityConfigX509ConfigCaOptionsArgs:
         pulumi.set(self, "zero_max_issuer_path_length", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigKeyUsageArgsDict(TypedDict):
+        base_key_usage: pulumi.Input['AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        extended_key_usage: pulumi.Input['AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        unknown_extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict']]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        Structure is documented below.
+        """
+elif False:
+    AuthorityConfigX509ConfigKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigKeyUsageArgs:
     def __init__(__self__, *,
@@ -802,6 +1125,47 @@ class AuthorityConfigX509ConfigKeyUsageArgs:
         pulumi.set(self, "unknown_extended_key_usages", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgsDict(TypedDict):
+        cert_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to sign certificates.
+        """
+        content_commitment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
+        """
+        crl_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used sign certificate revocation lists.
+        """
+        data_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher data.
+        """
+        decipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to decipher only.
+        """
+        digital_signature: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for digital signatures.
+        """
+        encipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher only.
+        """
+        key_agreement: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used in a key agreement protocol.
+        """
+        key_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher other keys.
+        """
+elif False:
+    AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs:
     def __init__(__self__, *,
@@ -953,6 +1317,35 @@ class AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs:
         pulumi.set(self, "key_encipherment", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict(TypedDict):
+        client_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
+        """
+        code_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
+        """
+        email_protection: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
+        """
+        ocsp_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
+        """
+        server_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
+        """
+        time_stamping: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
+        """
+elif False:
+    AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -1056,6 +1449,15 @@ class AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs:
         pulumi.set(self, "time_stamping", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -1078,6 +1480,71 @@ class AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigNameConstraintsArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not the name constraints are marked critical.
+        """
+        excluded_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains excluded DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        excluded_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        excluded_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        excluded_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+        permitted_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains permitted DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        permitted_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        permitted_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        permitted_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+elif False:
+    AuthorityConfigX509ConfigNameConstraintsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigNameConstraintsArgs:
     def __init__(__self__, *,
@@ -1276,6 +1743,15 @@ class AuthorityConfigX509ConfigNameConstraintsArgs:
         pulumi.set(self, "permitted_uris", value)
 
 
+if not MYPY:
+    class AuthorityConfigX509ConfigPolicyIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    AuthorityConfigX509ConfigPolicyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthorityConfigX509ConfigPolicyIdArgs:
     def __init__(__self__, *,
@@ -1298,10 +1774,28 @@ class AuthorityConfigX509ConfigPolicyIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
-@pulumi.input_type
-class AuthorityKeySpecArgs:
-    def __init__(__self__, *,
-                 algorithm: Optional[pulumi.Input[str]] = None,
+if not MYPY:
+    class AuthorityKeySpecArgsDict(TypedDict):
+        algorithm: NotRequired[pulumi.Input[str]]
+        """
+        The algorithm to use for creating a managed Cloud KMS key for a for a simplified
+        experience. All managed keys will be have their ProtectionLevel as HSM.
+        Possible values are: `SIGN_HASH_ALGORITHM_UNSPECIFIED`, `RSA_PSS_2048_SHA256`, `RSA_PSS_3072_SHA256`, `RSA_PSS_4096_SHA256`, `RSA_PKCS1_2048_SHA256`, `RSA_PKCS1_3072_SHA256`, `RSA_PKCS1_4096_SHA256`, `EC_P256_SHA256`, `EC_P384_SHA384`.
+
+        - - -
+        """
+        cloud_kms_key_version: NotRequired[pulumi.Input[str]]
+        """
+        The resource name for an existing Cloud KMS CryptoKeyVersion in the format
+        `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
+        """
+elif False:
+    AuthorityKeySpecArgsDict: TypeAlias = Mapping[str, Any]
+
+@pulumi.input_type
+class AuthorityKeySpecArgs:
+    def __init__(__self__, *,
+                 algorithm: Optional[pulumi.Input[str]] = None,
                  cloud_kms_key_version: Optional[pulumi.Input[str]] = None):
         """
         :param pulumi.Input[str] algorithm: The algorithm to use for creating a managed Cloud KMS key for a for a simplified
@@ -1347,6 +1841,24 @@ class AuthorityKeySpecArgs:
         pulumi.set(self, "cloud_kms_key_version", value)
 
 
+if not MYPY:
+    class AuthoritySubordinateConfigArgsDict(TypedDict):
+        certificate_authority: NotRequired[pulumi.Input[str]]
+        """
+        This can refer to a CertificateAuthority that was used to create a
+        subordinate CertificateAuthority. This field is used for information
+        and usability purposes only. The resource name is in the format
+        `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
+        """
+        pem_issuer_chain: NotRequired[pulumi.Input['AuthoritySubordinateConfigPemIssuerChainArgsDict']]
+        """
+        Contains the PEM certificate chain for the issuers of this CertificateAuthority,
+        but not pem certificate for this CA itself.
+        Structure is documented below.
+        """
+elif False:
+    AuthoritySubordinateConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthoritySubordinateConfigArgs:
     def __init__(__self__, *,
@@ -1396,6 +1908,15 @@ class AuthoritySubordinateConfigArgs:
         pulumi.set(self, "pem_issuer_chain", value)
 
 
+if not MYPY:
+    class AuthoritySubordinateConfigPemIssuerChainArgsDict(TypedDict):
+        pem_certificates: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Expected to be in leaf-to-root order according to RFC 5246.
+        """
+elif False:
+    AuthoritySubordinateConfigPemIssuerChainArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class AuthoritySubordinateConfigPemIssuerChainArgs:
     def __init__(__self__, *,
@@ -1419,6 +1940,20 @@ class AuthoritySubordinateConfigPemIssuerChainArgs:
         pulumi.set(self, "pem_certificates", value)
 
 
+if not MYPY:
+    class CaPoolIamBindingConditionArgsDict(TypedDict):
+        expression: pulumi.Input[str]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        title: pulumi.Input[str]
+        """
+        A title for the expression, i.e. a short string describing its purpose.
+        """
+        description: NotRequired[pulumi.Input[str]]
+elif False:
+    CaPoolIamBindingConditionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIamBindingConditionArgs:
     def __init__(__self__, *,
@@ -1468,6 +2003,20 @@ class CaPoolIamBindingConditionArgs:
         pulumi.set(self, "description", value)
 
 
+if not MYPY:
+    class CaPoolIamMemberConditionArgsDict(TypedDict):
+        expression: pulumi.Input[str]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        title: pulumi.Input[str]
+        """
+        A title for the expression, i.e. a short string describing its purpose.
+        """
+        description: NotRequired[pulumi.Input[str]]
+elif False:
+    CaPoolIamMemberConditionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIamMemberConditionArgs:
     def __init__(__self__, *,
@@ -1517,6 +2066,41 @@ class CaPoolIamMemberConditionArgs:
         pulumi.set(self, "description", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyArgsDict(TypedDict):
+        allowed_issuance_modes: NotRequired[pulumi.Input['CaPoolIssuancePolicyAllowedIssuanceModesArgsDict']]
+        """
+        IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool.
+        Structure is documented below.
+        """
+        allowed_key_types: NotRequired[pulumi.Input[Sequence[pulumi.Input['CaPoolIssuancePolicyAllowedKeyTypeArgsDict']]]]
+        """
+        If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here.
+        Otherwise, any key may be used.
+        Structure is documented below.
+        """
+        baseline_values: NotRequired[pulumi.Input['CaPoolIssuancePolicyBaselineValuesArgsDict']]
+        """
+        A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request
+        includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate
+        request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate
+        issuance request will fail.
+        Structure is documented below.
+        """
+        identity_constraints: NotRequired[pulumi.Input['CaPoolIssuancePolicyIdentityConstraintsArgsDict']]
+        """
+        Describes constraints on identities that may appear in Certificates issued through this CaPool.
+        If this is omitted, then this CaPool will not add restrictions on a certificate's identity.
+        Structure is documented below.
+        """
+        maximum_lifetime: NotRequired[pulumi.Input[str]]
+        """
+        The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority
+        expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.
+        """
+elif False:
+    CaPoolIssuancePolicyArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyArgs:
     def __init__(__self__, *,
@@ -1624,6 +2208,19 @@ class CaPoolIssuancePolicyArgs:
         pulumi.set(self, "maximum_lifetime", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyAllowedIssuanceModesArgsDict(TypedDict):
+        allow_config_based_issuance: pulumi.Input[bool]
+        """
+        When true, allows callers to create Certificates by specifying a CertificateConfig.
+        """
+        allow_csr_based_issuance: pulumi.Input[bool]
+        """
+        When true, allows callers to create Certificates by specifying a CSR.
+        """
+elif False:
+    CaPoolIssuancePolicyAllowedIssuanceModesArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyAllowedIssuanceModesArgs:
     def __init__(__self__, *,
@@ -1661,6 +2258,21 @@ class CaPoolIssuancePolicyAllowedIssuanceModesArgs:
         pulumi.set(self, "allow_csr_based_issuance", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyAllowedKeyTypeArgsDict(TypedDict):
+        elliptic_curve: NotRequired[pulumi.Input['CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgsDict']]
+        """
+        Represents an allowed Elliptic Curve key type.
+        Structure is documented below.
+        """
+        rsa: NotRequired[pulumi.Input['CaPoolIssuancePolicyAllowedKeyTypeRsaArgsDict']]
+        """
+        Describes an RSA key that may be used in a Certificate issued from a CaPool.
+        Structure is documented below.
+        """
+elif False:
+    CaPoolIssuancePolicyAllowedKeyTypeArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyAllowedKeyTypeArgs:
     def __init__(__self__, *,
@@ -1704,6 +2316,16 @@ class CaPoolIssuancePolicyAllowedKeyTypeArgs:
         pulumi.set(self, "rsa", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgsDict(TypedDict):
+        signature_algorithm: pulumi.Input[str]
+        """
+        The algorithm used.
+        Possible values are: `ECDSA_P256`, `ECDSA_P384`, `EDDSA_25519`.
+        """
+elif False:
+    CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgs:
     def __init__(__self__, *,
@@ -1728,6 +2350,21 @@ class CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgs:
         pulumi.set(self, "signature_algorithm", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyAllowedKeyTypeRsaArgsDict(TypedDict):
+        max_modulus_size: NotRequired[pulumi.Input[str]]
+        """
+        The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
+        service will not enforce an explicit upper bound on RSA modulus sizes.
+        """
+        min_modulus_size: NotRequired[pulumi.Input[str]]
+        """
+        The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
+        service-level min RSA modulus size will continue to apply.
+        """
+elif False:
+    CaPoolIssuancePolicyAllowedKeyTypeRsaArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyAllowedKeyTypeRsaArgs:
     def __init__(__self__, *,
@@ -1771,6 +2408,41 @@ class CaPoolIssuancePolicyAllowedKeyTypeRsaArgs:
         pulumi.set(self, "min_modulus_size", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesArgsDict(TypedDict):
+        ca_options: pulumi.Input['CaPoolIssuancePolicyBaselineValuesCaOptionsArgsDict']
+        """
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        key_usage: pulumi.Input['CaPoolIssuancePolicyBaselineValuesKeyUsageArgsDict']
+        """
+        Indicates the intended use for keys that correspond to a certificate.
+        Structure is documented below.
+        """
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgsDict']]]]
+        """
+        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
+        Structure is documented below.
+        """
+        aia_ocsp_servers: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
+        "Authority Information Access" extension in the certificate.
+        """
+        name_constraints: NotRequired[pulumi.Input['CaPoolIssuancePolicyBaselineValuesNameConstraintsArgsDict']]
+        """
+        Describes the X.509 name constraints extension.
+        Structure is documented below.
+        """
+        policy_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CaPoolIssuancePolicyBaselineValuesPolicyIdArgsDict']]]]
+        """
+        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+        Structure is documented below.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesArgs:
     def __init__(__self__, *,
@@ -1884,6 +2556,25 @@ class CaPoolIssuancePolicyBaselineValuesArgs:
         pulumi.set(self, "policy_ids", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not this extension is critical (i.e., if the client does not know how to
+        handle this extension, the client should consider this to be an error).
+        """
+        object_id: pulumi.Input['CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgsDict']
+        """
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        value: pulumi.Input[str]
+        """
+        The value of this X.509 extension. A base64-encoded string.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -1940,6 +2631,15 @@ class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgs:
         pulumi.set(self, "value", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgs:
     def __init__(__self__, *,
@@ -1962,6 +2662,31 @@ class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesCaOptionsArgsDict(TypedDict):
+        is_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to true.
+        """
+        max_issuer_path_length: NotRequired[pulumi.Input[int]]
+        """
+        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
+        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
+        """
+        non_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to false.
+        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
+        """
+        zero_max_issuer_path_length: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
+        if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
+        the max path length will be omitted from the CA certificate.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesCaOptionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesCaOptionsArgs:
     def __init__(__self__, *,
@@ -2041,6 +2766,26 @@ class CaPoolIssuancePolicyBaselineValuesCaOptionsArgs:
         pulumi.set(self, "zero_max_issuer_path_length", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesKeyUsageArgsDict(TypedDict):
+        base_key_usage: pulumi.Input['CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        extended_key_usage: pulumi.Input['CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        unknown_extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgsDict']]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        Structure is documented below.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesKeyUsageArgs:
     def __init__(__self__, *,
@@ -2100,6 +2845,47 @@ class CaPoolIssuancePolicyBaselineValuesKeyUsageArgs:
         pulumi.set(self, "unknown_extended_key_usages", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgsDict(TypedDict):
+        cert_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to sign certificates.
+        """
+        content_commitment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
+        """
+        crl_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used sign certificate revocation lists.
+        """
+        data_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher data.
+        """
+        decipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to decipher only.
+        """
+        digital_signature: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for digital signatures.
+        """
+        encipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher only.
+        """
+        key_agreement: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used in a key agreement protocol.
+        """
+        key_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher other keys.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs:
     def __init__(__self__, *,
@@ -2251,6 +3037,35 @@ class CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs:
         pulumi.set(self, "key_encipherment", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgsDict(TypedDict):
+        client_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
+        """
+        code_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
+        """
+        email_protection: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
+        """
+        ocsp_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
+        """
+        server_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
+        """
+        time_stamping: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -2354,6 +3169,15 @@ class CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs:
         pulumi.set(self, "time_stamping", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -2376,6 +3200,71 @@ class CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesNameConstraintsArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not the name constraints are marked critical.
+        """
+        excluded_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains excluded DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        excluded_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        excluded_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        excluded_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+        permitted_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains permitted DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        permitted_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        permitted_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        permitted_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesNameConstraintsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesNameConstraintsArgs:
     def __init__(__self__, *,
@@ -2574,6 +3463,15 @@ class CaPoolIssuancePolicyBaselineValuesNameConstraintsArgs:
         pulumi.set(self, "permitted_uris", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyBaselineValuesPolicyIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CaPoolIssuancePolicyBaselineValuesPolicyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyBaselineValuesPolicyIdArgs:
     def __init__(__self__, *,
@@ -2596,6 +3494,28 @@ class CaPoolIssuancePolicyBaselineValuesPolicyIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyIdentityConstraintsArgsDict(TypedDict):
+        allow_subject_alt_names_passthrough: pulumi.Input[bool]
+        """
+        If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate.
+        Otherwise, the requested SubjectAltNames will be discarded.
+        """
+        allow_subject_passthrough: pulumi.Input[bool]
+        """
+        If this is set, the Subject field may be copied from a certificate request into the signed certificate.
+        Otherwise, the requested Subject will be discarded.
+        """
+        cel_expression: NotRequired[pulumi.Input['CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgsDict']]
+        """
+        A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a
+        certificate is signed. To see the full allowed syntax and some examples,
+        see https://cloud.google.com/certificate-authority-service/docs/cel-guide
+        Structure is documented below.
+        """
+elif False:
+    CaPoolIssuancePolicyIdentityConstraintsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyIdentityConstraintsArgs:
     def __init__(__self__, *,
@@ -2659,6 +3579,27 @@ class CaPoolIssuancePolicyIdentityConstraintsArgs:
         pulumi.set(self, "cel_expression", value)
 
 
+if not MYPY:
+    class CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgsDict(TypedDict):
+        expression: pulumi.Input[str]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        description: NotRequired[pulumi.Input[str]]
+        """
+        Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        """
+        location: NotRequired[pulumi.Input[str]]
+        """
+        String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        """
+        title: NotRequired[pulumi.Input[str]]
+        """
+        Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        """
+elif False:
+    CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs:
     def __init__(__self__, *,
@@ -2729,6 +3670,31 @@ class CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs:
         pulumi.set(self, "title", value)
 
 
+if not MYPY:
+    class CaPoolPublishingOptionsArgsDict(TypedDict):
+        publish_ca_cert: pulumi.Input[bool]
+        """
+        When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access"
+        X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding
+        X.509 extension will not be written in issued certificates.
+        """
+        publish_crl: pulumi.Input[bool]
+        """
+        When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension
+        in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not
+        be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are
+        also rebuilt shortly after a certificate is revoked.
+        """
+        encoding_format: NotRequired[pulumi.Input[str]]
+        """
+        Specifies the encoding format of each CertificateAuthority's CA
+        certificate and CRLs. If this is omitted, CA certificates and CRLs
+        will be published in PEM.
+        Possible values are: `PEM`, `DER`.
+        """
+elif False:
+    CaPoolPublishingOptionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CaPoolPublishingOptionsArgs:
     def __init__(__self__, *,
@@ -2776,27 +3742,78 @@ class CaPoolPublishingOptionsArgs:
         be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are
         also rebuilt shortly after a certificate is revoked.
         """
-        return pulumi.get(self, "publish_crl")
-
-    @publish_crl.setter
-    def publish_crl(self, value: pulumi.Input[bool]):
-        pulumi.set(self, "publish_crl", value)
-
-    @property
-    @pulumi.getter(name="encodingFormat")
-    def encoding_format(self) -> Optional[pulumi.Input[str]]:
+        return pulumi.get(self, "publish_crl")
+
+    @publish_crl.setter
+    def publish_crl(self, value: pulumi.Input[bool]):
+        pulumi.set(self, "publish_crl", value)
+
+    @property
+    @pulumi.getter(name="encodingFormat")
+    def encoding_format(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies the encoding format of each CertificateAuthority's CA
+        certificate and CRLs. If this is omitted, CA certificates and CRLs
+        will be published in PEM.
+        Possible values are: `PEM`, `DER`.
+        """
+        return pulumi.get(self, "encoding_format")
+
+    @encoding_format.setter
+    def encoding_format(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "encoding_format", value)
+
+
+if not MYPY:
+    class CertificateCertificateDescriptionArgsDict(TypedDict):
+        aia_issuing_certificate_urls: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        (Output)
+        Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
+        """
+        authority_key_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionAuthorityKeyIdArgsDict']]]]
+        """
+        (Output)
+        Identifies the subjectKeyId of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
+        Structure is documented below.
+        """
+        cert_fingerprints: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionCertFingerprintArgsDict']]]]
+        """
+        (Output)
+        The hash of the x.509 certificate.
+        Structure is documented below.
+        """
+        crl_distribution_points: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        (Output)
+        Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
+        """
+        public_keys: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionPublicKeyArgsDict']]]]
+        """
+        (Output)
+        A PublicKey describes a public key.
+        Structure is documented below.
+        """
+        subject_descriptions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectDescriptionArgsDict']]]]
+        """
+        (Output)
+        Describes some of the values in a certificate that are related to the subject and lifetime.
+        Structure is documented below.
+        """
+        subject_key_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectKeyIdArgsDict']]]]
+        """
+        (Output)
+        Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
+        Structure is documented below.
+        """
+        x509_descriptions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionArgsDict']]]]
         """
-        Specifies the encoding format of each CertificateAuthority's CA
-        certificate and CRLs. If this is omitted, CA certificates and CRLs
-        will be published in PEM.
-        Possible values are: `PEM`, `DER`.
+        (Output)
+        A structured description of the issued X.509 certificate.
+        Structure is documented below.
         """
-        return pulumi.get(self, "encoding_format")
-
-    @encoding_format.setter
-    def encoding_format(self, value: Optional[pulumi.Input[str]]):
-        pulumi.set(self, "encoding_format", value)
-
+elif False:
+    CertificateCertificateDescriptionArgsDict: TypeAlias = Mapping[str, Any]
 
 @pulumi.input_type
 class CertificateCertificateDescriptionArgs:
@@ -2961,6 +3978,16 @@ class CertificateCertificateDescriptionArgs:
         pulumi.set(self, "x509_descriptions", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionAuthorityKeyIdArgsDict(TypedDict):
+        key_id: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
+        """
+elif False:
+    CertificateCertificateDescriptionAuthorityKeyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionAuthorityKeyIdArgs:
     def __init__(__self__, *,
@@ -2986,6 +4013,16 @@ class CertificateCertificateDescriptionAuthorityKeyIdArgs:
         pulumi.set(self, "key_id", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionCertFingerprintArgsDict(TypedDict):
+        sha256_hash: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
+        """
+elif False:
+    CertificateCertificateDescriptionCertFingerprintArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionCertFingerprintArgs:
     def __init__(__self__, *,
@@ -3011,6 +4048,20 @@ class CertificateCertificateDescriptionCertFingerprintArgs:
         pulumi.set(self, "sha256_hash", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionPublicKeyArgsDict(TypedDict):
+        format: NotRequired[pulumi.Input[str]]
+        """
+        The format of the public key. Currently, only PEM format is supported.
+        Possible values are: `KEY_TYPE_UNSPECIFIED`, `PEM`.
+        """
+        key: NotRequired[pulumi.Input[str]]
+        """
+        Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
+        """
+elif False:
+    CertificateCertificateDescriptionPublicKeyArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionPublicKeyArgs:
     def __init__(__self__, *,
@@ -3052,6 +4103,44 @@ class CertificateCertificateDescriptionPublicKeyArgs:
         pulumi.set(self, "key", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectDescriptionArgsDict(TypedDict):
+        hex_serial_number: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The serial number encoded in lowercase hexadecimal.
+        """
+        lifetime: NotRequired[pulumi.Input[str]]
+        """
+        The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
+        "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
+        fractional digits, terminated by 's'. Example: "3.5s".
+        """
+        not_after_time: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The time at which the certificate expires.
+        """
+        not_before_time: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The time at which the certificate becomes valid.
+        """
+        subject_alt_names: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgsDict']]]]
+        """
+        (Output)
+        The subject alternative name fields.
+        Structure is documented below.
+        """
+        subjects: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectDescriptionSubjectArgsDict']]]]
+        """
+        (Output)
+        Contains distinguished name fields such as the location and organization.
+        Structure is documented below.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectDescriptionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectDescriptionArgs:
     def __init__(__self__, *,
@@ -3173,6 +4262,43 @@ class CertificateCertificateDescriptionSubjectDescriptionArgs:
         pulumi.set(self, "subjects", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectDescriptionSubjectArgsDict(TypedDict):
+        common_name: NotRequired[pulumi.Input[str]]
+        """
+        The common name of the distinguished name.
+        """
+        country_code: NotRequired[pulumi.Input[str]]
+        """
+        The country code of the subject.
+        """
+        locality: NotRequired[pulumi.Input[str]]
+        """
+        The locality or city of the subject.
+        """
+        organization: NotRequired[pulumi.Input[str]]
+        """
+        The organization of the subject.
+        """
+        organizational_unit: NotRequired[pulumi.Input[str]]
+        """
+        The organizational unit of the subject.
+        """
+        postal_code: NotRequired[pulumi.Input[str]]
+        """
+        The postal code of the subject.
+        """
+        province: NotRequired[pulumi.Input[str]]
+        """
+        The province, territory, or regional state of the subject.
+        """
+        street_address: NotRequired[pulumi.Input[str]]
+        """
+        The street address of the subject.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectDescriptionSubjectArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectDescriptionSubjectArgs:
     def __init__(__self__, *,
@@ -3308,6 +4434,33 @@ class CertificateCertificateDescriptionSubjectDescriptionSubjectArgs:
         pulumi.set(self, "street_address", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgsDict(TypedDict):
+        custom_sans: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgsDict']]]]
+        """
+        (Output)
+        Contains additional subject alternative name values.
+        Structure is documented below.
+        """
+        dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid, fully-qualified host names.
+        """
+        email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 2822 E-mail addresses.
+        """
+        ip_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
+        """
+        uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 3986 URIs.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgs:
     def __init__(__self__, *,
@@ -3399,6 +4552,26 @@ class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgs:
         pulumi.set(self, "uris", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgsDict(TypedDict):
+        critical: NotRequired[pulumi.Input[bool]]
+        """
+        (Output)
+        Indicates whether or not the name constraints are marked critical.
+        """
+        obect_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgsDict']]]]
+        """
+        (Output)
+        Describes how some of the technical fields in a certificate should be populated.
+        Structure is documented below.
+        """
+        value: NotRequired[pulumi.Input[str]]
+        """
+        The value of this X.509 extension. A base64-encoded string.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgs:
     def __init__(__self__, *,
@@ -3460,6 +4633,16 @@ class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan
         pulumi.set(self, "value", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgsDict(TypedDict):
+        object_id_paths: NotRequired[pulumi.Input[Sequence[pulumi.Input[int]]]]
+        """
+        (Output)
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgs:
     def __init__(__self__, *,
@@ -3485,6 +4668,15 @@ class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionSubjectKeyIdArgsDict(TypedDict):
+        key_id: NotRequired[pulumi.Input[str]]
+        """
+        The value of the KeyId in lowercase hexidecimal.
+        """
+elif False:
+    CertificateCertificateDescriptionSubjectKeyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionSubjectKeyIdArgs:
     def __init__(__self__, *,
@@ -3508,6 +4700,47 @@ class CertificateCertificateDescriptionSubjectKeyIdArgs:
         pulumi.set(self, "key_id", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionArgsDict(TypedDict):
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgsDict']]]]
+        """
+        (Output)
+        Describes custom X.509 extensions.
+        Structure is documented below.
+        """
+        aia_ocsp_servers: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        (Output)
+        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
+        "Authority Information Access" extension in the certificate.
+        """
+        ca_options: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionCaOptionArgsDict']]]]
+        """
+        (Output)
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionKeyUsageArgsDict']]]]
+        """
+        (Output)
+        Indicates the intended use for keys that correspond to a certificate.
+        Structure is documented below.
+        """
+        name_constraints: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionNameConstraintArgsDict']]]]
+        """
+        (Output)
+        Describes the X.509 name constraints extension.
+        Structure is documented below.
+        """
+        policy_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionPolicyIdArgsDict']]]]
+        """
+        (Output)
+        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+        Structure is documented below.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionArgs:
     def __init__(__self__, *,
@@ -3635,6 +4868,25 @@ class CertificateCertificateDescriptionX509DescriptionArgs:
         pulumi.set(self, "policy_ids", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgsDict(TypedDict):
+        critical: NotRequired[pulumi.Input[bool]]
+        """
+        Indicates whether or not this extension is critical (i.e., if the client does not know how to
+        handle this extension, the client should consider this to be an error).
+        """
+        object_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgsDict']]]]
+        """
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        value: NotRequired[pulumi.Input[str]]
+        """
+        The value of this X.509 extension. A base64-encoded string.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -3694,6 +4946,15 @@ class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgs:
         pulumi.set(self, "value", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgsDict(TypedDict):
+        object_id_paths: NotRequired[pulumi.Input[Sequence[pulumi.Input[int]]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgs:
     def __init__(__self__, *,
@@ -3717,6 +4978,20 @@ class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectI
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionCaOptionArgsDict(TypedDict):
+        is_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to true.
+        """
+        max_issuer_path_length: NotRequired[pulumi.Input[int]]
+        """
+        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
+        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionCaOptionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionCaOptionArgs:
     def __init__(__self__, *,
@@ -3758,6 +5033,26 @@ class CertificateCertificateDescriptionX509DescriptionCaOptionArgs:
         pulumi.set(self, "max_issuer_path_length", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionKeyUsageArgsDict(TypedDict):
+        base_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgsDict']]]]
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgsDict']]]]
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        unknown_extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgsDict']]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        Structure is documented below.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionKeyUsageArgs:
     def __init__(__self__, *,
@@ -3819,6 +5114,47 @@ class CertificateCertificateDescriptionX509DescriptionKeyUsageArgs:
         pulumi.set(self, "unknown_extended_key_usages", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgsDict(TypedDict):
+        cert_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to sign certificates.
+        """
+        content_commitment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
+        """
+        crl_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used sign certificate revocation lists.
+        """
+        data_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher data.
+        """
+        decipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to decipher only.
+        """
+        digital_signature: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for digital signatures.
+        """
+        encipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher only.
+        """
+        key_agreement: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used in a key agreement protocol.
+        """
+        key_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher other keys.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgs:
     def __init__(__self__, *,
@@ -3961,14 +5297,43 @@ class CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgs:
     @pulumi.getter(name="keyEncipherment")
     def key_encipherment(self) -> Optional[pulumi.Input[bool]]:
         """
-        The key may be used to encipher other keys.
+        The key may be used to encipher other keys.
+        """
+        return pulumi.get(self, "key_encipherment")
+
+    @key_encipherment.setter
+    def key_encipherment(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "key_encipherment", value)
+
+
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgsDict(TypedDict):
+        client_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
+        """
+        code_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
+        """
+        email_protection: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
+        """
+        ocsp_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
+        """
+        server_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
+        """
+        time_stamping: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
         """
-        return pulumi.get(self, "key_encipherment")
-
-    @key_encipherment.setter
-    def key_encipherment(self, value: Optional[pulumi.Input[bool]]):
-        pulumi.set(self, "key_encipherment", value)
-
+elif False:
+    CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
 
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgs:
@@ -4073,6 +5438,15 @@ class CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageAr
         pulumi.set(self, "time_stamping", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgsDict(TypedDict):
+        object_id_paths: NotRequired[pulumi.Input[Sequence[pulumi.Input[int]]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -4096,6 +5470,71 @@ class CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKey
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionNameConstraintArgsDict(TypedDict):
+        critical: NotRequired[pulumi.Input[bool]]
+        """
+        Indicates whether or not the name constraints are marked critical.
+        """
+        excluded_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains excluded DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        excluded_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        excluded_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        excluded_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+        permitted_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains permitted DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        permitted_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        permitted_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        permitted_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionNameConstraintArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionNameConstraintArgs:
     def __init__(__self__, *,
@@ -4295,6 +5734,15 @@ class CertificateCertificateDescriptionX509DescriptionNameConstraintArgs:
         pulumi.set(self, "permitted_uris", value)
 
 
+if not MYPY:
+    class CertificateCertificateDescriptionX509DescriptionPolicyIdArgsDict(TypedDict):
+        object_id_paths: NotRequired[pulumi.Input[Sequence[pulumi.Input[int]]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateCertificateDescriptionX509DescriptionPolicyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateCertificateDescriptionX509DescriptionPolicyIdArgs:
     def __init__(__self__, *,
@@ -4318,6 +5766,34 @@ class CertificateCertificateDescriptionX509DescriptionPolicyIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateConfigArgsDict(TypedDict):
+        public_key: pulumi.Input['CertificateConfigPublicKeyArgsDict']
+        """
+        A PublicKey describes a public key.
+        Structure is documented below.
+
+
+        <a name="nested_x509_config"></a>The `x509_config` block supports:
+        """
+        subject_config: pulumi.Input['CertificateConfigSubjectConfigArgsDict']
+        """
+        Specifies some of the values in a certificate that are related to the subject.
+        Structure is documented below.
+        """
+        x509_config: pulumi.Input['CertificateConfigX509ConfigArgsDict']
+        """
+        Describes how some of the technical X.509 fields in a certificate should be populated.
+        Structure is documented below.
+        """
+        subject_key_id: NotRequired[pulumi.Input['CertificateConfigSubjectKeyIdArgsDict']]
+        """
+        When specified this provides a custom SKI to be used in the certificate. This should only be used to maintain a SKI of an existing CA originally created outside CA service, which was not generated using method (1) described in RFC 5280 section 4.2.1.2..
+        Structure is documented below.
+        """
+elif False:
+    CertificateConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigArgs:
     def __init__(__self__, *,
@@ -4400,6 +5876,20 @@ class CertificateConfigArgs:
         pulumi.set(self, "subject_key_id", value)
 
 
+if not MYPY:
+    class CertificateConfigPublicKeyArgsDict(TypedDict):
+        format: pulumi.Input[str]
+        """
+        The format of the public key. Currently, only PEM format is supported.
+        Possible values are: `KEY_TYPE_UNSPECIFIED`, `PEM`.
+        """
+        key: NotRequired[pulumi.Input[str]]
+        """
+        Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
+        """
+elif False:
+    CertificateConfigPublicKeyArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigPublicKeyArgs:
     def __init__(__self__, *,
@@ -4440,6 +5930,21 @@ class CertificateConfigPublicKeyArgs:
         pulumi.set(self, "key", value)
 
 
+if not MYPY:
+    class CertificateConfigSubjectConfigArgsDict(TypedDict):
+        subject: pulumi.Input['CertificateConfigSubjectConfigSubjectArgsDict']
+        """
+        Contains distinguished name fields such as the location and organization.
+        Structure is documented below.
+        """
+        subject_alt_name: NotRequired[pulumi.Input['CertificateConfigSubjectConfigSubjectAltNameArgsDict']]
+        """
+        The subject alternative name fields.
+        Structure is documented below.
+        """
+elif False:
+    CertificateConfigSubjectConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigSubjectConfigArgs:
     def __init__(__self__, *,
@@ -4482,6 +5987,43 @@ class CertificateConfigSubjectConfigArgs:
         pulumi.set(self, "subject_alt_name", value)
 
 
+if not MYPY:
+    class CertificateConfigSubjectConfigSubjectArgsDict(TypedDict):
+        common_name: pulumi.Input[str]
+        """
+        The common name of the distinguished name.
+        """
+        organization: pulumi.Input[str]
+        """
+        The organization of the subject.
+        """
+        country_code: NotRequired[pulumi.Input[str]]
+        """
+        The country code of the subject.
+        """
+        locality: NotRequired[pulumi.Input[str]]
+        """
+        The locality or city of the subject.
+        """
+        organizational_unit: NotRequired[pulumi.Input[str]]
+        """
+        The organizational unit of the subject.
+        """
+        postal_code: NotRequired[pulumi.Input[str]]
+        """
+        The postal code of the subject.
+        """
+        province: NotRequired[pulumi.Input[str]]
+        """
+        The province, territory, or regional state of the subject.
+        """
+        street_address: NotRequired[pulumi.Input[str]]
+        """
+        The street address of the subject.
+        """
+elif False:
+    CertificateConfigSubjectConfigSubjectArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigSubjectConfigSubjectArgs:
     def __init__(__self__, *,
@@ -4615,6 +6157,27 @@ class CertificateConfigSubjectConfigSubjectArgs:
         pulumi.set(self, "street_address", value)
 
 
+if not MYPY:
+    class CertificateConfigSubjectConfigSubjectAltNameArgsDict(TypedDict):
+        dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid, fully-qualified host names.
+        """
+        email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 2822 E-mail addresses.
+        """
+        ip_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
+        """
+        uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains only valid RFC 3986 URIs.
+        """
+elif False:
+    CertificateConfigSubjectConfigSubjectAltNameArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigSubjectConfigSubjectAltNameArgs:
     def __init__(__self__, *,
@@ -4686,6 +6249,15 @@ class CertificateConfigSubjectConfigSubjectAltNameArgs:
         pulumi.set(self, "uris", value)
 
 
+if not MYPY:
+    class CertificateConfigSubjectKeyIdArgsDict(TypedDict):
+        key_id: NotRequired[pulumi.Input[str]]
+        """
+        The value of the KeyId in lowercase hexidecimal.
+        """
+elif False:
+    CertificateConfigSubjectKeyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigSubjectKeyIdArgs:
     def __init__(__self__, *,
@@ -4709,6 +6281,47 @@ class CertificateConfigSubjectKeyIdArgs:
         pulumi.set(self, "key_id", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigArgsDict(TypedDict):
+        key_usage: pulumi.Input['CertificateConfigX509ConfigKeyUsageArgsDict']
+        """
+        (Output)
+        Indicates the intended use for keys that correspond to a certificate.
+        Structure is documented below.
+        """
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateConfigX509ConfigAdditionalExtensionArgsDict']]]]
+        """
+        (Output)
+        Describes custom X.509 extensions.
+        Structure is documented below.
+        """
+        aia_ocsp_servers: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        (Output)
+        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
+        "Authority Information Access" extension in the certificate.
+        """
+        ca_options: NotRequired[pulumi.Input['CertificateConfigX509ConfigCaOptionsArgsDict']]
+        """
+        (Output)
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        name_constraints: NotRequired[pulumi.Input['CertificateConfigX509ConfigNameConstraintsArgsDict']]
+        """
+        (Output)
+        Describes the X.509 name constraints extension.
+        Structure is documented below.
+        """
+        policy_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateConfigX509ConfigPolicyIdArgsDict']]]]
+        """
+        (Output)
+        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+        Structure is documented below.
+        """
+elif False:
+    CertificateConfigX509ConfigArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigArgs:
     def __init__(__self__, *,
@@ -4835,6 +6448,25 @@ class CertificateConfigX509ConfigArgs:
         pulumi.set(self, "policy_ids", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigAdditionalExtensionArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not this extension is critical (i.e., if the client does not know how to
+        handle this extension, the client should consider this to be an error).
+        """
+        object_id: pulumi.Input['CertificateConfigX509ConfigAdditionalExtensionObjectIdArgsDict']
+        """
+        Describes values that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        value: pulumi.Input[str]
+        """
+        The value of this X.509 extension. A base64-encoded string.
+        """
+elif False:
+    CertificateConfigX509ConfigAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -4891,6 +6523,15 @@ class CertificateConfigX509ConfigAdditionalExtensionArgs:
         pulumi.set(self, "value", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigAdditionalExtensionObjectIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateConfigX509ConfigAdditionalExtensionObjectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigAdditionalExtensionObjectIdArgs:
     def __init__(__self__, *,
@@ -4913,6 +6554,31 @@ class CertificateConfigX509ConfigAdditionalExtensionObjectIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigCaOptionsArgsDict(TypedDict):
+        is_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to true.
+        """
+        max_issuer_path_length: NotRequired[pulumi.Input[int]]
+        """
+        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
+        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
+        """
+        non_ca: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "CA" in Basic Constraints extension will be set to false.
+        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
+        """
+        zero_max_issuer_path_length: NotRequired[pulumi.Input[bool]]
+        """
+        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
+        if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
+        the max path length will be omitted from the CA certificate.
+        """
+elif False:
+    CertificateConfigX509ConfigCaOptionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigCaOptionsArgs:
     def __init__(__self__, *,
@@ -4992,6 +6658,26 @@ class CertificateConfigX509ConfigCaOptionsArgs:
         pulumi.set(self, "zero_max_issuer_path_length", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigKeyUsageArgsDict(TypedDict):
+        base_key_usage: pulumi.Input['CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        extended_key_usage: pulumi.Input['CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict']
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        unknown_extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict']]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        Structure is documented below.
+        """
+elif False:
+    CertificateConfigX509ConfigKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigKeyUsageArgs:
     def __init__(__self__, *,
@@ -5044,12 +6730,53 @@ class CertificateConfigX509ConfigKeyUsageArgs:
         An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
         Structure is documented below.
         """
-        return pulumi.get(self, "unknown_extended_key_usages")
-
-    @unknown_extended_key_usages.setter
-    def unknown_extended_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs']]]]):
-        pulumi.set(self, "unknown_extended_key_usages", value)
-
+        return pulumi.get(self, "unknown_extended_key_usages")
+
+    @unknown_extended_key_usages.setter
+    def unknown_extended_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs']]]]):
+        pulumi.set(self, "unknown_extended_key_usages", value)
+
+
+if not MYPY:
+    class CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgsDict(TypedDict):
+        cert_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to sign certificates.
+        """
+        content_commitment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
+        """
+        crl_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used sign certificate revocation lists.
+        """
+        data_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher data.
+        """
+        decipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to decipher only.
+        """
+        digital_signature: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for digital signatures.
+        """
+        encipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher only.
+        """
+        key_agreement: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used in a key agreement protocol.
+        """
+        key_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher other keys.
+        """
+elif False:
+    CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
 
 @pulumi.input_type
 class CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs:
@@ -5202,6 +6929,35 @@ class CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs:
         pulumi.set(self, "key_encipherment", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict(TypedDict):
+        client_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
+        """
+        code_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
+        """
+        email_protection: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
+        """
+        ocsp_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
+        """
+        server_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
+        """
+        time_stamping: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
+        """
+elif False:
+    CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -5305,6 +7061,15 @@ class CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs:
         pulumi.set(self, "time_stamping", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -5327,6 +7092,71 @@ class CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigNameConstraintsArgsDict(TypedDict):
+        critical: pulumi.Input[bool]
+        """
+        Indicates whether or not the name constraints are marked critical.
+        """
+        excluded_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains excluded DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        excluded_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        excluded_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        excluded_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the excluded URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+        permitted_dns_names: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains permitted DNS names. Any DNS name that can be
+        constructed by simply adding zero or more labels to
+        the left-hand side of the name satisfies the name constraint.
+        For example, `example.com`, `www.example.com`, `www.sub.example.com`
+        would satisfy `example.com` while `example1.com` does not.
+        """
+        permitted_email_addresses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted email addresses. The value can be a particular
+        email address, a hostname to indicate all email addresses on that host or
+        a domain with a leading period (e.g. `.example.com`) to indicate
+        all email addresses in that domain.
+        """
+        permitted_ip_ranges: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted IP ranges. For IPv4 addresses, the ranges
+        are expressed using CIDR notation as specified in RFC 4632.
+        For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
+        addresses.
+        """
+        permitted_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Contains the permitted URIs that apply to the host part of the name.
+        The value can be a hostname or a domain with a
+        leading period (like `.example.com`)
+        """
+elif False:
+    CertificateConfigX509ConfigNameConstraintsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigNameConstraintsArgs:
     def __init__(__self__, *,
@@ -5525,6 +7355,15 @@ class CertificateConfigX509ConfigNameConstraintsArgs:
         pulumi.set(self, "permitted_uris", value)
 
 
+if not MYPY:
+    class CertificateConfigX509ConfigPolicyIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
+        """
+elif False:
+    CertificateConfigX509ConfigPolicyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateConfigX509ConfigPolicyIdArgs:
     def __init__(__self__, *,
@@ -5547,6 +7386,21 @@ class CertificateConfigX509ConfigPolicyIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateRevocationDetailArgsDict(TypedDict):
+        revocation_state: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        Indicates why a Certificate was revoked.
+        """
+        revocation_time: NotRequired[pulumi.Input[str]]
+        """
+        (Output)
+        The time at which this Certificate was revoked.
+        """
+elif False:
+    CertificateRevocationDetailArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateRevocationDetailArgs:
     def __init__(__self__, *,
@@ -5590,6 +7444,20 @@ class CertificateRevocationDetailArgs:
         pulumi.set(self, "revocation_time", value)
 
 
+if not MYPY:
+    class CertificateTemplateIamBindingConditionArgsDict(TypedDict):
+        expression: pulumi.Input[str]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        title: pulumi.Input[str]
+        """
+        A title for the expression, i.e. a short string describing its purpose.
+        """
+        description: NotRequired[pulumi.Input[str]]
+elif False:
+    CertificateTemplateIamBindingConditionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplateIamBindingConditionArgs:
     def __init__(__self__, *,
@@ -5639,6 +7507,20 @@ class CertificateTemplateIamBindingConditionArgs:
         pulumi.set(self, "description", value)
 
 
+if not MYPY:
+    class CertificateTemplateIamMemberConditionArgsDict(TypedDict):
+        expression: pulumi.Input[str]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        title: pulumi.Input[str]
+        """
+        A title for the expression, i.e. a short string describing its purpose.
+        """
+        description: NotRequired[pulumi.Input[str]]
+elif False:
+    CertificateTemplateIamMemberConditionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplateIamMemberConditionArgs:
     def __init__(__self__, *,
@@ -5688,6 +7570,24 @@ class CertificateTemplateIamMemberConditionArgs:
         pulumi.set(self, "description", value)
 
 
+if not MYPY:
+    class CertificateTemplateIdentityConstraintsArgsDict(TypedDict):
+        allow_subject_alt_names_passthrough: pulumi.Input[bool]
+        """
+        Required. If this is true, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.
+        """
+        allow_subject_passthrough: pulumi.Input[bool]
+        """
+        Required. If this is true, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.
+        """
+        cel_expression: NotRequired[pulumi.Input['CertificateTemplateIdentityConstraintsCelExpressionArgsDict']]
+        """
+        Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel
+        Structure is documented below.
+        """
+elif False:
+    CertificateTemplateIdentityConstraintsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplateIdentityConstraintsArgs:
     def __init__(__self__, *,
@@ -5743,6 +7643,27 @@ class CertificateTemplateIdentityConstraintsArgs:
         pulumi.set(self, "cel_expression", value)
 
 
+if not MYPY:
+    class CertificateTemplateIdentityConstraintsCelExpressionArgsDict(TypedDict):
+        description: NotRequired[pulumi.Input[str]]
+        """
+        Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        """
+        expression: NotRequired[pulumi.Input[str]]
+        """
+        Textual representation of an expression in Common Expression Language syntax.
+        """
+        location: NotRequired[pulumi.Input[str]]
+        """
+        Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        """
+        title: NotRequired[pulumi.Input[str]]
+        """
+        Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        """
+elif False:
+    CertificateTemplateIdentityConstraintsCelExpressionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplateIdentityConstraintsCelExpressionArgs:
     def __init__(__self__, *,
@@ -5814,6 +7735,20 @@ class CertificateTemplateIdentityConstraintsCelExpressionArgs:
         pulumi.set(self, "title", value)
 
 
+if not MYPY:
+    class CertificateTemplatePassthroughExtensionsArgsDict(TypedDict):
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateTemplatePassthroughExtensionsAdditionalExtensionArgsDict']]]]
+        """
+        Optional. A set of ObjectIds identifying custom X.509 extensions. Will be combined with known_extensions to determine the full set of X.509 extensions.
+        Structure is documented below.
+        """
+        known_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Optional. A set of named X.509 extensions. Will be combined with additional_extensions to determine the full set of X.509 extensions.
+        """
+elif False:
+    CertificateTemplatePassthroughExtensionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePassthroughExtensionsArgs:
     def __init__(__self__, *,
@@ -5855,6 +7790,15 @@ class CertificateTemplatePassthroughExtensionsArgs:
         pulumi.set(self, "known_extensions", value)
 
 
+if not MYPY:
+    class CertificateTemplatePassthroughExtensionsAdditionalExtensionArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        Required. The parts of an OID path. The most significant parts of the path come first.
+        """
+elif False:
+    CertificateTemplatePassthroughExtensionsAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -5877,6 +7821,35 @@ class CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesArgsDict(TypedDict):
+        additional_extensions: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateTemplatePredefinedValuesAdditionalExtensionArgsDict']]]]
+        """
+        Optional. Describes custom X.509 extensions.
+        Structure is documented below.
+        """
+        aia_ocsp_servers: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
+        """
+        Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
+        """
+        ca_options: NotRequired[pulumi.Input['CertificateTemplatePredefinedValuesCaOptionsArgsDict']]
+        """
+        Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
+        Structure is documented below.
+        """
+        key_usage: NotRequired[pulumi.Input['CertificateTemplatePredefinedValuesKeyUsageArgsDict']]
+        """
+        Optional. Indicates the intended use for keys that correspond to a certificate.
+        Structure is documented below.
+        """
+        policy_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateTemplatePredefinedValuesPolicyIdArgsDict']]]]
+        """
+        Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+        Structure is documented below.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesArgs:
     def __init__(__self__, *,
@@ -5972,6 +7945,24 @@ class CertificateTemplatePredefinedValuesArgs:
         pulumi.set(self, "policy_ids", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesAdditionalExtensionArgsDict(TypedDict):
+        object_id: pulumi.Input['CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgsDict']
+        """
+        Required. The OID for this X.509 extension.
+        Structure is documented below.
+        """
+        value: pulumi.Input[str]
+        """
+        Required. The value of this X.509 extension.
+        """
+        critical: NotRequired[pulumi.Input[bool]]
+        """
+        Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
+        """
+elif False:
+    CertificateTemplatePredefinedValuesAdditionalExtensionArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesAdditionalExtensionArgs:
     def __init__(__self__, *,
@@ -6027,6 +8018,15 @@ class CertificateTemplatePredefinedValuesAdditionalExtensionArgs:
         pulumi.set(self, "critical", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        Required. The parts of an OID path. The most significant parts of the path come first.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs:
     def __init__(__self__, *,
@@ -6049,6 +8049,19 @@ class CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesCaOptionsArgsDict(TypedDict):
+        is_ca: NotRequired[pulumi.Input[bool]]
+        """
+        Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
+        """
+        max_issuer_path_length: NotRequired[pulumi.Input[int]]
+        """
+        Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesCaOptionsArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesCaOptionsArgs:
     def __init__(__self__, *,
@@ -6088,6 +8101,26 @@ class CertificateTemplatePredefinedValuesCaOptionsArgs:
         pulumi.set(self, "max_issuer_path_length", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesKeyUsageArgsDict(TypedDict):
+        base_key_usage: NotRequired[pulumi.Input['CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgsDict']]
+        """
+        Describes high-level ways in which a key may be used.
+        Structure is documented below.
+        """
+        extended_key_usage: NotRequired[pulumi.Input['CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgsDict']]
+        """
+        Detailed scenarios in which a key may be used.
+        Structure is documented below.
+        """
+        unknown_extended_key_usages: NotRequired[pulumi.Input[Sequence[pulumi.Input['CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgsDict']]]]
+        """
+        Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
+        Structure is documented below.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesKeyUsageArgs:
     def __init__(__self__, *,
@@ -6149,6 +8182,47 @@ class CertificateTemplatePredefinedValuesKeyUsageArgs:
         pulumi.set(self, "unknown_extended_key_usages", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgsDict(TypedDict):
+        cert_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to sign certificates.
+        """
+        content_commitment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
+        """
+        crl_sign: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used sign certificate revocation lists.
+        """
+        data_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher data.
+        """
+        decipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to decipher only.
+        """
+        digital_signature: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used for digital signatures.
+        """
+        encipher_only: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher only.
+        """
+        key_agreement: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used in a key agreement protocol.
+        """
+        key_encipherment: NotRequired[pulumi.Input[bool]]
+        """
+        The key may be used to encipher other keys.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs:
     def __init__(__self__, *,
@@ -6300,6 +8374,35 @@ class CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs:
         pulumi.set(self, "key_encipherment", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgsDict(TypedDict):
+        client_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
+        """
+        code_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
+        """
+        email_protection: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
+        """
+        ocsp_signing: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
+        """
+        server_auth: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
+        """
+        time_stamping: NotRequired[pulumi.Input[bool]]
+        """
+        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
+        """
+elif False:
+    CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -6403,6 +8506,15 @@ class CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs:
         pulumi.set(self, "time_stamping", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        Required. The parts of an OID path. The most significant parts of the path come first.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs:
     def __init__(__self__, *,
@@ -6425,6 +8537,15 @@ class CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs:
         pulumi.set(self, "object_id_paths", value)
 
 
+if not MYPY:
+    class CertificateTemplatePredefinedValuesPolicyIdArgsDict(TypedDict):
+        object_id_paths: pulumi.Input[Sequence[pulumi.Input[int]]]
+        """
+        Required. The parts of an OID path. The most significant parts of the path come first.
+        """
+elif False:
+    CertificateTemplatePredefinedValuesPolicyIdArgsDict: TypeAlias = Mapping[str, Any]
+
 @pulumi.input_type
 class CertificateTemplatePredefinedValuesPolicyIdArgs:
     def __init__(__self__, *,