pulumi-gcp 7.30.0__py3-none-any.whl → 7.30.0a1719470057__py3-none-any.whl

pulumi_gcp/certificateauthority/certificate.py

@@ -4,14 +4,9 @@
 
 import copy
 import warnings
-import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
-if sys.version_info >= (3, 11):
-    from typing import NotRequired, TypedDict, TypeAlias
-else:
-    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 from . import outputs
 from ._inputs import *
@@ -587,7 +582,7 @@ class Certificate(pulumi.CustomResource):
                  opts: Optional[pulumi.ResourceOptions] = None,
                  certificate_authority: Optional[pulumi.Input[str]] = None,
                  certificate_template: Optional[pulumi.Input[str]] = None,
-                 config: Optional[pulumi.Input[Union['CertificateConfigArgs', 'CertificateConfigArgsDict']]] = None,
+                 config: Optional[pulumi.Input[pulumi.InputType['CertificateConfigArgs']]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  lifetime: Optional[pulumi.Input[str]] = None,
                  location: Optional[pulumi.Input[str]] = None,
@@ -620,34 +615,34 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -658,53 +653,53 @@ class Certificate(pulumi.CustomResource):
             certificate_authority=default_authority.certificate_authority_id,
             lifetime="86000s",
             name="cert-1",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                    },
-                    "subjectAltName": {
-                        "emailAddresses": ["email@example.com"],
-                        "ipAddresses": ["127.0.0.1"],
-                        "uris": ["http://www.ietf.org/rfc/rfc3986.txt"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                    "nameConstraints": {
-                        "critical": True,
-                        "permittedDnsNames": ["*.example.com"],
-                        "excludedDnsNames": ["*.deny.example.com"],
-                        "permittedIpRanges": ["10.0.0.0/8"],
-                        "excludedIpRanges": ["10.1.1.0/24"],
-                        "permittedEmailAddresses": [".example.com"],
-                        "excludedEmailAddresses": [".deny.example.com"],
-                        "permittedUris": [".example.com"],
-                        "excludedUris": [".deny.example.com"],
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.base64encode_output(input=cert_key.public_key_pem).apply(lambda invoke: invoke.result),
-                },
-            })
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectAltNameArgs(
+                        email_addresses=["email@example.com"],
+                        ip_addresses=["127.0.0.1"],
+                        uris=["http://www.ietf.org/rfc/rfc3986.txt"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                    name_constraints=gcp.certificateauthority.CertificateConfigX509ConfigNameConstraintsArgs(
+                        critical=True,
+                        permitted_dns_names=["*.example.com"],
+                        excluded_dns_names=["*.deny.example.com"],
+                        permitted_ip_ranges=["10.0.0.0/8"],
+                        excluded_ip_ranges=["10.1.1.0/24"],
+                        permitted_email_addresses=[".example.com"],
+                        excluded_email_addresses=[".deny.example.com"],
+                        permitted_uris=[".example.com"],
+                        excluded_uris=[".deny.example.com"],
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.base64encode_output(input=cert_key.public_key_pem).apply(lambda invoke: invoke.result),
+                ),
+            ))
         ```
         ### Privateca Certificate With Template
 
@@ -721,107 +716,107 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             name="my-certificate-template",
             description="An updated sample certificate template",
-            identity_constraints={
-                "allowSubjectAltNamesPassthrough": True,
-                "allowSubjectPassthrough": True,
-                "celExpression": {
-                    "description": "Always true",
-                    "expression": "true",
-                    "location": "any.file.anywhere",
-                    "title": "Sample expression",
-                },
-            },
-            passthrough_extensions={
-                "additionalExtensions": [{
-                    "objectIdPaths": [
+            identity_constraints=gcp.certificateauthority.CertificateTemplateIdentityConstraintsArgs(
+                allow_subject_alt_names_passthrough=True,
+                allow_subject_passthrough=True,
+                cel_expression=gcp.certificateauthority.CertificateTemplateIdentityConstraintsCelExpressionArgs(
+                    description="Always true",
+                    expression="true",
+                    location="any.file.anywhere",
+                    title="Sample expression",
+                ),
+            ),
+            passthrough_extensions=gcp.certificateauthority.CertificateTemplatePassthroughExtensionsArgs(
+                additional_extensions=[gcp.certificateauthority.CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs(
+                    object_id_paths=[
                         1,
                         6,
                     ],
-                }],
-                "knownExtensions": ["EXTENDED_KEY_USAGE"],
-            },
-            predefined_values={
-                "additionalExtensions": [{
-                    "objectId": {
-                        "objectIdPaths": [
+                )],
+                known_extensions=["EXTENDED_KEY_USAGE"],
+            ),
+            predefined_values=gcp.certificateauthority.CertificateTemplatePredefinedValuesArgs(
+                additional_extensions=[gcp.certificateauthority.CertificateTemplatePredefinedValuesAdditionalExtensionArgs(
+                    object_id=gcp.certificateauthority.CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs(
+                        object_id_paths=[
                             1,
                             6,
                         ],
-                    },
-                    "value": "c3RyaW5nCg==",
-                    "critical": True,
-                }],
-                "aiaOcspServers": ["string"],
-                "caOptions": {
-                    "isCa": False,
-                    "maxIssuerPathLength": 6,
-                },
-                "keyUsage": {
-                    "baseKeyUsage": {
-                        "certSign": False,
-                        "contentCommitment": True,
-                        "crlSign": False,
-                        "dataEncipherment": True,
-                        "decipherOnly": True,
-                        "digitalSignature": True,
-                        "encipherOnly": True,
-                        "keyAgreement": True,
-                        "keyEncipherment": True,
-                    },
-                    "extendedKeyUsage": {
-                        "clientAuth": True,
-                        "codeSigning": True,
-                        "emailProtection": True,
-                        "ocspSigning": True,
-                        "serverAuth": True,
-                        "timeStamping": True,
-                    },
-                    "unknownExtendedKeyUsages": [{
-                        "objectIdPaths": [
+                    ),
+                    value="c3RyaW5nCg==",
+                    critical=True,
+                )],
+                aia_ocsp_servers=["string"],
+                ca_options=gcp.certificateauthority.CertificateTemplatePredefinedValuesCaOptionsArgs(
+                    is_ca=False,
+                    max_issuer_path_length=6,
+                ),
+                key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageArgs(
+                    base_key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs(
+                        cert_sign=False,
+                        content_commitment=True,
+                        crl_sign=False,
+                        data_encipherment=True,
+                        decipher_only=True,
+                        digital_signature=True,
+                        encipher_only=True,
+                        key_agreement=True,
+                        key_encipherment=True,
+                    ),
+                    extended_key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs(
+                        client_auth=True,
+                        code_signing=True,
+                        email_protection=True,
+                        ocsp_signing=True,
+                        server_auth=True,
+                        time_stamping=True,
+                    ),
+                    unknown_extended_key_usages=[gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs(
+                        object_id_paths=[
                             1,
                             6,
                         ],
-                    }],
-                },
-                "policyIds": [{
-                    "objectIdPaths": [
+                    )],
+                ),
+                policy_ids=[gcp.certificateauthority.CertificateTemplatePredefinedValuesPolicyIdArgs(
+                    object_id_paths=[
                         1,
                         6,
                     ],
-                }],
-            })
+                )],
+            ))
         default_authority = gcp.certificateauthority.Authority("default",
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -849,34 +844,34 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -903,36 +898,36 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "digitalSignature": True,
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            digital_signature=True,
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
             lifetime="86400s",
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -941,37 +936,37 @@ class Certificate(pulumi.CustomResource):
             pool=default.name,
             name="my-certificate",
             lifetime="860s",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                        "postalCode": "94109",
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": False,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.filebase64(input="test-fixtures/rsa_public.pem").result,
-                },
-            },
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                        postal_code="94109",
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=False,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.filebase64(input="test-fixtures/rsa_public.pem").result,
+                ),
+            ),
             opts = pulumi.ResourceOptions(depends_on=[default_authority]))
         ```
         ### Privateca Certificate Custom Ski
@@ -989,36 +984,36 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "digitalSignature": True,
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            digital_signature=True,
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
             lifetime="86400s",
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1027,40 +1022,40 @@ class Certificate(pulumi.CustomResource):
             pool=default.name,
             name="my-certificate",
             lifetime="860s",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                        "postalCode": "94109",
-                    },
-                },
-                "subjectKeyId": {
-                    "keyId": "4cf3372289b1d411b999dbb9ebcd44744b6b2fca",
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": False,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.filebase64(input="test-fixtures/rsa_public.pem").result,
-                },
-            },
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                        postal_code="94109",
+                    ),
+                ),
+                subject_key_id=gcp.certificateauthority.CertificateConfigSubjectKeyIdArgs(
+                    key_id="4cf3372289b1d411b999dbb9ebcd44744b6b2fca",
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=False,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.filebase64(input="test-fixtures/rsa_public.pem").result,
+                ),
+            ),
             opts = pulumi.ResourceOptions(depends_on=[default_authority]))
         ```
 
@@ -1099,7 +1094,7 @@ class Certificate(pulumi.CustomResource):
                the caller must have the necessary permission to use this template. If this is
                omitted, no template will be used. This template must be in the same location
                as the Certificate.
-        :param pulumi.Input[Union['CertificateConfigArgs', 'CertificateConfigArgsDict']] config: The config used to create a self-signed X.509 certificate or CSR.
+        :param pulumi.Input[pulumi.InputType['CertificateConfigArgs']] config: The config used to create a self-signed X.509 certificate or CSR.
                Structure is documented below.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] labels: Labels with user-defined metadata to apply to this resource.
                
@@ -1149,34 +1144,34 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1187,53 +1182,53 @@ class Certificate(pulumi.CustomResource):
             certificate_authority=default_authority.certificate_authority_id,
             lifetime="86000s",
             name="cert-1",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                    },
-                    "subjectAltName": {
-                        "emailAddresses": ["email@example.com"],
-                        "ipAddresses": ["127.0.0.1"],
-                        "uris": ["http://www.ietf.org/rfc/rfc3986.txt"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                    "nameConstraints": {
-                        "critical": True,
-                        "permittedDnsNames": ["*.example.com"],
-                        "excludedDnsNames": ["*.deny.example.com"],
-                        "permittedIpRanges": ["10.0.0.0/8"],
-                        "excludedIpRanges": ["10.1.1.0/24"],
-                        "permittedEmailAddresses": [".example.com"],
-                        "excludedEmailAddresses": [".deny.example.com"],
-                        "permittedUris": [".example.com"],
-                        "excludedUris": [".deny.example.com"],
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.base64encode_output(input=cert_key.public_key_pem).apply(lambda invoke: invoke.result),
-                },
-            })
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectAltNameArgs(
+                        email_addresses=["email@example.com"],
+                        ip_addresses=["127.0.0.1"],
+                        uris=["http://www.ietf.org/rfc/rfc3986.txt"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                    name_constraints=gcp.certificateauthority.CertificateConfigX509ConfigNameConstraintsArgs(
+                        critical=True,
+                        permitted_dns_names=["*.example.com"],
+                        excluded_dns_names=["*.deny.example.com"],
+                        permitted_ip_ranges=["10.0.0.0/8"],
+                        excluded_ip_ranges=["10.1.1.0/24"],
+                        permitted_email_addresses=[".example.com"],
+                        excluded_email_addresses=[".deny.example.com"],
+                        permitted_uris=[".example.com"],
+                        excluded_uris=[".deny.example.com"],
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.base64encode_output(input=cert_key.public_key_pem).apply(lambda invoke: invoke.result),
+                ),
+            ))
         ```
         ### Privateca Certificate With Template
 
@@ -1250,107 +1245,107 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             name="my-certificate-template",
             description="An updated sample certificate template",
-            identity_constraints={
-                "allowSubjectAltNamesPassthrough": True,
-                "allowSubjectPassthrough": True,
-                "celExpression": {
-                    "description": "Always true",
-                    "expression": "true",
-                    "location": "any.file.anywhere",
-                    "title": "Sample expression",
-                },
-            },
-            passthrough_extensions={
-                "additionalExtensions": [{
-                    "objectIdPaths": [
+            identity_constraints=gcp.certificateauthority.CertificateTemplateIdentityConstraintsArgs(
+                allow_subject_alt_names_passthrough=True,
+                allow_subject_passthrough=True,
+                cel_expression=gcp.certificateauthority.CertificateTemplateIdentityConstraintsCelExpressionArgs(
+                    description="Always true",
+                    expression="true",
+                    location="any.file.anywhere",
+                    title="Sample expression",
+                ),
+            ),
+            passthrough_extensions=gcp.certificateauthority.CertificateTemplatePassthroughExtensionsArgs(
+                additional_extensions=[gcp.certificateauthority.CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs(
+                    object_id_paths=[
                         1,
                         6,
                     ],
-                }],
-                "knownExtensions": ["EXTENDED_KEY_USAGE"],
-            },
-            predefined_values={
-                "additionalExtensions": [{
-                    "objectId": {
-                        "objectIdPaths": [
+                )],
+                known_extensions=["EXTENDED_KEY_USAGE"],
+            ),
+            predefined_values=gcp.certificateauthority.CertificateTemplatePredefinedValuesArgs(
+                additional_extensions=[gcp.certificateauthority.CertificateTemplatePredefinedValuesAdditionalExtensionArgs(
+                    object_id=gcp.certificateauthority.CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs(
+                        object_id_paths=[
                             1,
                             6,
                         ],
-                    },
-                    "value": "c3RyaW5nCg==",
-                    "critical": True,
-                }],
-                "aiaOcspServers": ["string"],
-                "caOptions": {
-                    "isCa": False,
-                    "maxIssuerPathLength": 6,
-                },
-                "keyUsage": {
-                    "baseKeyUsage": {
-                        "certSign": False,
-                        "contentCommitment": True,
-                        "crlSign": False,
-                        "dataEncipherment": True,
-                        "decipherOnly": True,
-                        "digitalSignature": True,
-                        "encipherOnly": True,
-                        "keyAgreement": True,
-                        "keyEncipherment": True,
-                    },
-                    "extendedKeyUsage": {
-                        "clientAuth": True,
-                        "codeSigning": True,
-                        "emailProtection": True,
-                        "ocspSigning": True,
-                        "serverAuth": True,
-                        "timeStamping": True,
-                    },
-                    "unknownExtendedKeyUsages": [{
-                        "objectIdPaths": [
+                    ),
+                    value="c3RyaW5nCg==",
+                    critical=True,
+                )],
+                aia_ocsp_servers=["string"],
+                ca_options=gcp.certificateauthority.CertificateTemplatePredefinedValuesCaOptionsArgs(
+                    is_ca=False,
+                    max_issuer_path_length=6,
+                ),
+                key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageArgs(
+                    base_key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs(
+                        cert_sign=False,
+                        content_commitment=True,
+                        crl_sign=False,
+                        data_encipherment=True,
+                        decipher_only=True,
+                        digital_signature=True,
+                        encipher_only=True,
+                        key_agreement=True,
+                        key_encipherment=True,
+                    ),
+                    extended_key_usage=gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs(
+                        client_auth=True,
+                        code_signing=True,
+                        email_protection=True,
+                        ocsp_signing=True,
+                        server_auth=True,
+                        time_stamping=True,
+                    ),
+                    unknown_extended_key_usages=[gcp.certificateauthority.CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs(
+                        object_id_paths=[
                             1,
                             6,
                         ],
-                    }],
-                },
-                "policyIds": [{
-                    "objectIdPaths": [
+                    )],
+                ),
+                policy_ids=[gcp.certificateauthority.CertificateTemplatePredefinedValuesPolicyIdArgs(
+                    object_id_paths=[
                         1,
                         6,
                     ],
-                }],
-            })
+                )],
+            ))
         default_authority = gcp.certificateauthority.Authority("default",
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1378,34 +1373,34 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": False,
-                        },
-                    },
-                },
-            },
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=False,
+                        ),
+                    ),
+                ),
+            ),
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1432,36 +1427,36 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "digitalSignature": True,
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            digital_signature=True,
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
             lifetime="86400s",
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1470,37 +1465,37 @@ class Certificate(pulumi.CustomResource):
             pool=default.name,
             name="my-certificate",
             lifetime="860s",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                        "postalCode": "94109",
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": False,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.filebase64(input="test-fixtures/rsa_public.pem").result,
-                },
-            },
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                        postal_code="94109",
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=False,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.filebase64(input="test-fixtures/rsa_public.pem").result,
+                ),
+            ),
             opts = pulumi.ResourceOptions(depends_on=[default_authority]))
         ```
         ### Privateca Certificate Custom Ski
@@ -1518,36 +1513,36 @@ class Certificate(pulumi.CustomResource):
             location="us-central1",
             pool=default.name,
             certificate_authority_id="my-authority",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "organization": "HashiCorp",
-                        "commonName": "my-certificate-authority",
-                    },
-                    "subjectAltName": {
-                        "dnsNames": ["hashicorp.com"],
-                    },
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": True,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "digitalSignature": True,
-                            "certSign": True,
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-            },
+            config=gcp.certificateauthority.AuthorityConfigArgs(
+                subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
+                        organization="HashiCorp",
+                        common_name="my-certificate-authority",
+                    ),
+                    subject_alt_name=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectAltNameArgs(
+                        dns_names=["hashicorp.com"],
+                    ),
+                ),
+                x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
+                        is_ca=True,
+                    ),
+                    key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            digital_signature=True,
+                            cert_sign=True,
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+            ),
             lifetime="86400s",
-            key_spec={
-                "algorithm": "RSA_PKCS1_4096_SHA256",
-            },
+            key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
+                algorithm="RSA_PKCS1_4096_SHA256",
+            ),
             deletion_protection=False,
             skip_grace_period=True,
             ignore_active_certificates_on_deletion=True)
@@ -1556,40 +1551,40 @@ class Certificate(pulumi.CustomResource):
             pool=default.name,
             name="my-certificate",
             lifetime="860s",
-            config={
-                "subjectConfig": {
-                    "subject": {
-                        "commonName": "san1.example.com",
-                        "countryCode": "us",
-                        "organization": "google",
-                        "organizationalUnit": "enterprise",
-                        "locality": "mountain view",
-                        "province": "california",
-                        "streetAddress": "1600 amphitheatre parkway",
-                        "postalCode": "94109",
-                    },
-                },
-                "subjectKeyId": {
-                    "keyId": "4cf3372289b1d411b999dbb9ebcd44744b6b2fca",
-                },
-                "x509Config": {
-                    "caOptions": {
-                        "isCa": False,
-                    },
-                    "keyUsage": {
-                        "baseKeyUsage": {
-                            "crlSign": True,
-                        },
-                        "extendedKeyUsage": {
-                            "serverAuth": True,
-                        },
-                    },
-                },
-                "publicKey": {
-                    "format": "PEM",
-                    "key": std.filebase64(input="test-fixtures/rsa_public.pem").result,
-                },
-            },
+            config=gcp.certificateauthority.CertificateConfigArgs(
+                subject_config=gcp.certificateauthority.CertificateConfigSubjectConfigArgs(
+                    subject=gcp.certificateauthority.CertificateConfigSubjectConfigSubjectArgs(
+                        common_name="san1.example.com",
+                        country_code="us",
+                        organization="google",
+                        organizational_unit="enterprise",
+                        locality="mountain view",
+                        province="california",
+                        street_address="1600 amphitheatre parkway",
+                        postal_code="94109",
+                    ),
+                ),
+                subject_key_id=gcp.certificateauthority.CertificateConfigSubjectKeyIdArgs(
+                    key_id="4cf3372289b1d411b999dbb9ebcd44744b6b2fca",
+                ),
+                x509_config=gcp.certificateauthority.CertificateConfigX509ConfigArgs(
+                    ca_options=gcp.certificateauthority.CertificateConfigX509ConfigCaOptionsArgs(
+                        is_ca=False,
+                    ),
+                    key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageArgs(
+                        base_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs(
+                            crl_sign=True,
+                        ),
+                        extended_key_usage=gcp.certificateauthority.CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
+                            server_auth=True,
+                        ),
+                    ),
+                ),
+                public_key=gcp.certificateauthority.CertificateConfigPublicKeyArgs(
+                    format="PEM",
+                    key=std.filebase64(input="test-fixtures/rsa_public.pem").result,
+                ),
+            ),
             opts = pulumi.ResourceOptions(depends_on=[default_authority]))
         ```
 
@@ -1634,7 +1629,7 @@ class Certificate(pulumi.CustomResource):
                  opts: Optional[pulumi.ResourceOptions] = None,
                  certificate_authority: Optional[pulumi.Input[str]] = None,
                  certificate_template: Optional[pulumi.Input[str]] = None,
-                 config: Optional[pulumi.Input[Union['CertificateConfigArgs', 'CertificateConfigArgsDict']]] = None,
+                 config: Optional[pulumi.Input[pulumi.InputType['CertificateConfigArgs']]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  lifetime: Optional[pulumi.Input[str]] = None,
                  location: Optional[pulumi.Input[str]] = None,
@@ -1687,9 +1682,9 @@ class Certificate(pulumi.CustomResource):
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             certificate_authority: Optional[pulumi.Input[str]] = None,
-            certificate_descriptions: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CertificateCertificateDescriptionArgs', 'CertificateCertificateDescriptionArgsDict']]]]] = None,
+            certificate_descriptions: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['CertificateCertificateDescriptionArgs']]]]] = None,
             certificate_template: Optional[pulumi.Input[str]] = None,
-            config: Optional[pulumi.Input[Union['CertificateConfigArgs', 'CertificateConfigArgsDict']]] = None,
+            config: Optional[pulumi.Input[pulumi.InputType['CertificateConfigArgs']]] = None,
             create_time: Optional[pulumi.Input[str]] = None,
             effective_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             issuer_certificate_authority: Optional[pulumi.Input[str]] = None,
@@ -1703,7 +1698,7 @@ class Certificate(pulumi.CustomResource):
             pool: Optional[pulumi.Input[str]] = None,
             project: Optional[pulumi.Input[str]] = None,
             pulumi_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
-            revocation_details: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CertificateRevocationDetailArgs', 'CertificateRevocationDetailArgsDict']]]]] = None,
+            revocation_details: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['CertificateRevocationDetailArgs']]]]] = None,
             update_time: Optional[pulumi.Input[str]] = None) -> 'Certificate':
         """
         Get an existing Certificate resource's state with the given name, id, and optional extra
@@ -1716,14 +1711,14 @@ class Certificate(pulumi.CustomResource):
                a Certificate Authority with resource name `projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca`,
                argument `pool` should be set to `projects/my-project/locations/us-central1/caPools/my-pool`, argument `certificate_authority`
                should be set to `my-ca`.
-        :param pulumi.Input[Sequence[pulumi.Input[Union['CertificateCertificateDescriptionArgs', 'CertificateCertificateDescriptionArgsDict']]]] certificate_descriptions: Output only. Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['CertificateCertificateDescriptionArgs']]]] certificate_descriptions: Output only. Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
                Structure is documented below.
         :param pulumi.Input[str] certificate_template: The resource name for a CertificateTemplate used to issue this certificate,
                in the format `projects/*/locations/*/certificateTemplates/*`. If this is specified,
                the caller must have the necessary permission to use this template. If this is
                omitted, no template will be used. This template must be in the same location
                as the Certificate.
-        :param pulumi.Input[Union['CertificateConfigArgs', 'CertificateConfigArgsDict']] config: The config used to create a self-signed X.509 certificate or CSR.
+        :param pulumi.Input[pulumi.InputType['CertificateConfigArgs']] config: The config used to create a self-signed X.509 certificate or CSR.
                Structure is documented below.
         :param pulumi.Input[str] create_time: The time that this resource was created on the server.
                This is in RFC3339 text format.
@@ -1750,7 +1745,7 @@ class Certificate(pulumi.CustomResource):
                If it is not provided, the provider project is used.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] pulumi_labels: The combination of labels configured directly on the resource
                and default labels configured on the provider.
-        :param pulumi.Input[Sequence[pulumi.Input[Union['CertificateRevocationDetailArgs', 'CertificateRevocationDetailArgsDict']]]] revocation_details: Output only. Details regarding the revocation of this Certificate. This Certificate is
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['CertificateRevocationDetailArgs']]]] revocation_details: Output only. Details regarding the revocation of this Certificate. This Certificate is
                considered revoked if and only if this field is present.
                Structure is documented below.
         :param pulumi.Input[str] update_time: Output only. The time at which this CertificateAuthority was updated.