pulumi-gcp 7.31.0a1720765508__py3-none-any.whl → 7.31.0a1721039192__py3-none-any.whl

pulumi_gcp/networksecurity/address_group.py

@@ -26,7 +26,8 @@ class AddressGroupArgs:
                  items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  name: Optional[pulumi.Input[str]] = None,
-                 parent: Optional[pulumi.Input[str]] = None):
+                 parent: Optional[pulumi.Input[str]] = None,
+                 purposes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
         """
         The set of arguments for constructing a AddressGroup resource.
         :param pulumi.Input[int] capacity: Capacity of the Address Group.
@@ -46,6 +47,8 @@ class AddressGroupArgs:
                Please refer to the field `effective_labels` for all of the labels present on the resource.
         :param pulumi.Input[str] name: Name of the AddressGroup resource.
         :param pulumi.Input[str] parent: The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] purposes: List of supported purposes of the Address Group.
+               Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
         """
         pulumi.set(__self__, "capacity", capacity)
         pulumi.set(__self__, "location", location)
@@ -60,6 +63,8 @@ class AddressGroupArgs:
             pulumi.set(__self__, "name", name)
         if parent is not None:
             pulumi.set(__self__, "parent", parent)
+        if purposes is not None:
+            pulumi.set(__self__, "purposes", purposes)
 
     @property
     @pulumi.getter
@@ -166,6 +171,19 @@ class AddressGroupArgs:
     def parent(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "parent", value)
 
+    @property
+    @pulumi.getter
+    def purposes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        List of supported purposes of the Address Group.
+        Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
+        """
+        return pulumi.get(self, "purposes")
+
+    @purposes.setter
+    def purposes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "purposes", value)
+
 
 @pulumi.input_type
 class _AddressGroupState:
@@ -180,6 +198,7 @@ class _AddressGroupState:
                  name: Optional[pulumi.Input[str]] = None,
                  parent: Optional[pulumi.Input[str]] = None,
                  pulumi_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 purposes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  type: Optional[pulumi.Input[str]] = None,
                  update_time: Optional[pulumi.Input[str]] = None):
         """
@@ -205,6 +224,8 @@ class _AddressGroupState:
         :param pulumi.Input[str] parent: The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] pulumi_labels: The combination of labels configured directly on the resource
                and default labels configured on the provider.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] purposes: List of supported purposes of the Address Group.
+               Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
         :param pulumi.Input[str] type: The type of the Address Group. Possible values are "IPV4" or "IPV6".
                Possible values are: `IPV4`, `IPV6`.
         :param pulumi.Input[str] update_time: The timestamp when the resource was updated.
@@ -231,6 +252,8 @@ class _AddressGroupState:
             pulumi.set(__self__, "parent", parent)
         if pulumi_labels is not None:
             pulumi.set(__self__, "pulumi_labels", pulumi_labels)
+        if purposes is not None:
+            pulumi.set(__self__, "purposes", purposes)
         if type is not None:
             pulumi.set(__self__, "type", type)
         if update_time is not None:
@@ -367,6 +390,19 @@ class _AddressGroupState:
     def pulumi_labels(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "pulumi_labels", value)
 
+    @property
+    @pulumi.getter
+    def purposes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+        """
+        List of supported purposes of the Address Group.
+        Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
+        """
+        return pulumi.get(self, "purposes")
+
+    @purposes.setter
+    def purposes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+        pulumi.set(self, "purposes", value)
+
     @property
     @pulumi.getter
     def type(self) -> Optional[pulumi.Input[str]]:
@@ -407,6 +443,7 @@ class AddressGroup(pulumi.CustomResource):
                  location: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  parent: Optional[pulumi.Input[str]] = None,
+                 purposes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  type: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         """
@@ -463,6 +500,21 @@ class AddressGroup(pulumi.CustomResource):
             capacity=100,
             items=["208.80.154.224/32"])
         ```
+        ### Network Security Address Groups Cloud Armor
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        default = gcp.networksecurity.AddressGroup("default",
+            name="my-address-groups",
+            parent="projects/my-project-name",
+            location="global",
+            type="IPV4",
+            capacity=100,
+            purposes=["CLOUD_ARMOR"],
+            items=["208.80.154.224/32"])
+        ```
 
         ## Import
 
@@ -493,6 +545,8 @@ class AddressGroup(pulumi.CustomResource):
                - - -
         :param pulumi.Input[str] name: Name of the AddressGroup resource.
         :param pulumi.Input[str] parent: The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] purposes: List of supported purposes of the Address Group.
+               Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
         :param pulumi.Input[str] type: The type of the Address Group. Possible values are "IPV4" or "IPV6".
                Possible values are: `IPV4`, `IPV6`.
         """
@@ -556,6 +610,21 @@ class AddressGroup(pulumi.CustomResource):
             capacity=100,
             items=["208.80.154.224/32"])
         ```
+        ### Network Security Address Groups Cloud Armor
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+
+        default = gcp.networksecurity.AddressGroup("default",
+            name="my-address-groups",
+            parent="projects/my-project-name",
+            location="global",
+            type="IPV4",
+            capacity=100,
+            purposes=["CLOUD_ARMOR"],
+            items=["208.80.154.224/32"])
+        ```
 
         ## Import
 
@@ -591,6 +660,7 @@ class AddressGroup(pulumi.CustomResource):
                  location: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  parent: Optional[pulumi.Input[str]] = None,
+                 purposes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  type: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -612,6 +682,7 @@ class AddressGroup(pulumi.CustomResource):
             __props__.__dict__["location"] = location
             __props__.__dict__["name"] = name
             __props__.__dict__["parent"] = parent
+            __props__.__dict__["purposes"] = purposes
             if type is None and not opts.urn:
                 raise TypeError("Missing required property 'type'")
             __props__.__dict__["type"] = type
@@ -641,6 +712,7 @@ class AddressGroup(pulumi.CustomResource):
             name: Optional[pulumi.Input[str]] = None,
             parent: Optional[pulumi.Input[str]] = None,
             pulumi_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            purposes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             type: Optional[pulumi.Input[str]] = None,
             update_time: Optional[pulumi.Input[str]] = None) -> 'AddressGroup':
         """
@@ -671,6 +743,8 @@ class AddressGroup(pulumi.CustomResource):
         :param pulumi.Input[str] parent: The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] pulumi_labels: The combination of labels configured directly on the resource
                and default labels configured on the provider.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] purposes: List of supported purposes of the Address Group.
+               Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
         :param pulumi.Input[str] type: The type of the Address Group. Possible values are "IPV4" or "IPV6".
                Possible values are: `IPV4`, `IPV6`.
         :param pulumi.Input[str] update_time: The timestamp when the resource was updated.
@@ -691,6 +765,7 @@ class AddressGroup(pulumi.CustomResource):
         __props__.__dict__["name"] = name
         __props__.__dict__["parent"] = parent
         __props__.__dict__["pulumi_labels"] = pulumi_labels
+        __props__.__dict__["purposes"] = purposes
         __props__.__dict__["type"] = type
         __props__.__dict__["update_time"] = update_time
         return AddressGroup(resource_name, opts=opts, __props__=__props__)
@@ -786,6 +861,15 @@ class AddressGroup(pulumi.CustomResource):
         """
         return pulumi.get(self, "pulumi_labels")
 
+    @property
+    @pulumi.getter
+    def purposes(self) -> pulumi.Output[Optional[Sequence[str]]]:
+        """
+        List of supported purposes of the Address Group.
+        Each value may be one of: `DEFAULT`, `CLOUD_ARMOR`.
+        """
+        return pulumi.get(self, "purposes")
+
     @property
     @pulumi.getter
     def type(self) -> pulumi.Output[str]:

pulumi_gcp/networksecurity/firewall_endpoint.py

@@ -373,8 +373,8 @@ class FirewallEndpoint(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/organizations.locations.firewallEndpoints)
         * How-to Guides
-            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
             * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
+            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
 
         > **Warning:** If you are using User ADCs (Application Default Credentials) with this resource,
         you must specify a `billing_project_id` and set `user_project_override` to true
@@ -442,8 +442,8 @@ class FirewallEndpoint(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/organizations.locations.firewallEndpoints)
         * How-to Guides
-            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
             * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
+            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
 
         > **Warning:** If you are using User ADCs (Application Default Credentials) with this resource,
         you must specify a `billing_project_id` and set `user_project_override` to true

pulumi_gcp/networksecurity/firewall_endpoint_association.py

@@ -459,8 +459,8 @@ class FirewallEndpointAssociation(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/projects.locations.firewallEndpointAssociations#FirewallEndpointAssociation)
         * How-to Guides
-            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
             * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
+            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
 
         ## Example Usage
 
@@ -534,8 +534,8 @@ class FirewallEndpointAssociation(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/projects.locations.firewallEndpointAssociations#FirewallEndpointAssociation)
         * How-to Guides
-            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
             * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
+            * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
 
         ## Example Usage
 

pulumi_gcp/networksecurity/security_profile_group.py

@@ -361,8 +361,8 @@ class SecurityProfileGroup(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/organizations.locations.securityProfileGroups)
         * How-to Guides
-            * [Security profile groups overview](https://cloud.google.com/firewall/docs/about-security-profile-groups)
             * [Create and manage security profile groups](https://cloud.google.com/firewall/docs/configure-security-profile-groups)
+            * [Security profile groups overview](https://cloud.google.com/firewall/docs/about-security-profile-groups)
 
         ## Example Usage
 
@@ -429,8 +429,8 @@ class SecurityProfileGroup(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/firewall/docs/reference/network-security/rest/v1/organizations.locations.securityProfileGroups)
         * How-to Guides
-            * [Security profile groups overview](https://cloud.google.com/firewall/docs/about-security-profile-groups)
             * [Create and manage security profile groups](https://cloud.google.com/firewall/docs/configure-security-profile-groups)
+            * [Security profile groups overview](https://cloud.google.com/firewall/docs/about-security-profile-groups)
 
         ## Example Usage
 

pulumi_gcp/orgpolicy/_inputs.py

@@ -39,6 +39,7 @@ if not MYPY:
     class PolicyDryRunSpecArgsDict(TypedDict):
         etag: NotRequired[pulumi.Input[str]]
         """
+        (Output)
         An opaque tag indicating the current version of the policy, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current policy to use when executing a read-modify-write loop. When the policy is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         """
         inherit_from_parent: NotRequired[pulumi.Input[bool]]
@@ -52,9 +53,11 @@ if not MYPY:
         rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['PolicyDryRunSpecRuleArgsDict']]]]
         """
         In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.
+        Structure is documented below.
         """
         update_time: NotRequired[pulumi.Input[str]]
         """
+        (Output)
         Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.
         """
 elif False:
@@ -69,11 +72,14 @@ class PolicyDryRunSpecArgs:
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input['PolicyDryRunSpecRuleArgs']]]] = None,
                  update_time: Optional[pulumi.Input[str]] = None):
         """
-        :param pulumi.Input[str] etag: An opaque tag indicating the current version of the policy, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current policy to use when executing a read-modify-write loop. When the policy is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
+        :param pulumi.Input[str] etag: (Output)
+               An opaque tag indicating the current version of the policy, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current policy to use when executing a read-modify-write loop. When the policy is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         :param pulumi.Input[bool] inherit_from_parent: Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints.
         :param pulumi.Input[bool] reset: Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
         :param pulumi.Input[Sequence[pulumi.Input['PolicyDryRunSpecRuleArgs']]] rules: In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.
-        :param pulumi.Input[str] update_time: Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.
+               Structure is documented below.
+        :param pulumi.Input[str] update_time: (Output)
+               Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.
         """
         if etag is not None:
             pulumi.set(__self__, "etag", etag)
@@ -90,6 +96,7 @@ class PolicyDryRunSpecArgs:
     @pulumi.getter
     def etag(self) -> Optional[pulumi.Input[str]]:
         """
+        (Output)
         An opaque tag indicating the current version of the policy, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current policy to use when executing a read-modify-write loop. When the policy is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         """
         return pulumi.get(self, "etag")
@@ -127,6 +134,7 @@ class PolicyDryRunSpecArgs:
     def rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['PolicyDryRunSpecRuleArgs']]]]:
         """
         In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.
+        Structure is documented below.
         """
         return pulumi.get(self, "rules")
 
@@ -138,6 +146,7 @@ class PolicyDryRunSpecArgs:
     @pulumi.getter(name="updateTime")
     def update_time(self) -> Optional[pulumi.Input[str]]:
         """
+        (Output)
         Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.
         """
         return pulumi.get(self, "update_time")
@@ -156,6 +165,7 @@ if not MYPY:
         condition: NotRequired[pulumi.Input['PolicyDryRunSpecRuleConditionArgsDict']]
         """
         A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+        Structure is documented below.
         """
         deny_all: NotRequired[pulumi.Input[str]]
         """
@@ -167,7 +177,8 @@ if not MYPY:
         """
         values: NotRequired[pulumi.Input['PolicyDryRunSpecRuleValuesArgsDict']]
         """
-        List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+        Structure is documented below.
         """
 elif False:
     PolicyDryRunSpecRuleArgsDict: TypeAlias = Mapping[str, Any]
@@ -183,9 +194,11 @@ class PolicyDryRunSpecRuleArgs:
         """
         :param pulumi.Input[str] allow_all: Setting this to `"TRUE"` means that all values are allowed. This field can be set only in Policies for list constraints.
         :param pulumi.Input['PolicyDryRunSpecRuleConditionArgs'] condition: A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+               Structure is documented below.
         :param pulumi.Input[str] deny_all: Setting this to `"TRUE"` means that all values are denied. This field can be set only in Policies for list constraints.
         :param pulumi.Input[str] enforce: If `"TRUE"`, then the `Policy` is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
-        :param pulumi.Input['PolicyDryRunSpecRuleValuesArgs'] values: List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        :param pulumi.Input['PolicyDryRunSpecRuleValuesArgs'] values: List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+               Structure is documented below.
         """
         if allow_all is not None:
             pulumi.set(__self__, "allow_all", allow_all)
@@ -215,6 +228,7 @@ class PolicyDryRunSpecRuleArgs:
     def condition(self) -> Optional[pulumi.Input['PolicyDryRunSpecRuleConditionArgs']]:
         """
         A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+        Structure is documented below.
         """
         return pulumi.get(self, "condition")
 
@@ -250,7 +264,8 @@ class PolicyDryRunSpecRuleArgs:
     @pulumi.getter
     def values(self) -> Optional[pulumi.Input['PolicyDryRunSpecRuleValuesArgs']]:
         """
-        List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+        Structure is documented below.
         """
         return pulumi.get(self, "values")
 
@@ -407,6 +422,7 @@ if not MYPY:
     class PolicySpecArgsDict(TypedDict):
         etag: NotRequired[pulumi.Input[str]]
         """
+        (Output)
         An opaque tag indicating the current version of the `Policy`, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the `Policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current `Policy` to use when executing a read-modify-write loop. When the `Policy` is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         """
         inherit_from_parent: NotRequired[pulumi.Input[bool]]
@@ -420,9 +436,11 @@ if not MYPY:
         rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['PolicySpecRuleArgsDict']]]]
         """
         Up to 10 PolicyRules are allowed. In Policies for boolean constraints, the following requirements apply: - There must be one and only one PolicyRule where condition is unset. - BooleanPolicyRules with conditions must set `enforced` to the opposite of the PolicyRule without a condition. - During policy evaluation, PolicyRules with conditions that are true for a target resource take precedence.
+        Structure is documented below.
         """
         update_time: NotRequired[pulumi.Input[str]]
         """
+        (Output)
         Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that `Policy`.
         """
 elif False:
@@ -437,11 +455,14 @@ class PolicySpecArgs:
                  rules: Optional[pulumi.Input[Sequence[pulumi.Input['PolicySpecRuleArgs']]]] = None,
                  update_time: Optional[pulumi.Input[str]] = None):
         """
-        :param pulumi.Input[str] etag: An opaque tag indicating the current version of the `Policy`, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the `Policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current `Policy` to use when executing a read-modify-write loop. When the `Policy` is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
+        :param pulumi.Input[str] etag: (Output)
+               An opaque tag indicating the current version of the `Policy`, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the `Policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current `Policy` to use when executing a read-modify-write loop. When the `Policy` is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         :param pulumi.Input[bool] inherit_from_parent: Determines the inheritance behavior for this `Policy`. If `inherit_from_parent` is true, PolicyRules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this Policy becomes the new root for evaluation. This field can be set only for Policies which configure list constraints.
         :param pulumi.Input[bool] reset: Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific `Constraint` at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
         :param pulumi.Input[Sequence[pulumi.Input['PolicySpecRuleArgs']]] rules: Up to 10 PolicyRules are allowed. In Policies for boolean constraints, the following requirements apply: - There must be one and only one PolicyRule where condition is unset. - BooleanPolicyRules with conditions must set `enforced` to the opposite of the PolicyRule without a condition. - During policy evaluation, PolicyRules with conditions that are true for a target resource take precedence.
-        :param pulumi.Input[str] update_time: Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that `Policy`.
+               Structure is documented below.
+        :param pulumi.Input[str] update_time: (Output)
+               Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that `Policy`.
         """
         if etag is not None:
             pulumi.set(__self__, "etag", etag)
@@ -458,6 +479,7 @@ class PolicySpecArgs:
     @pulumi.getter
     def etag(self) -> Optional[pulumi.Input[str]]:
         """
+        (Output)
         An opaque tag indicating the current version of the `Policy`, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the `Policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current `Policy` to use when executing a read-modify-write loop. When the `Policy` is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
         """
         return pulumi.get(self, "etag")
@@ -495,6 +517,7 @@ class PolicySpecArgs:
     def rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['PolicySpecRuleArgs']]]]:
         """
         Up to 10 PolicyRules are allowed. In Policies for boolean constraints, the following requirements apply: - There must be one and only one PolicyRule where condition is unset. - BooleanPolicyRules with conditions must set `enforced` to the opposite of the PolicyRule without a condition. - During policy evaluation, PolicyRules with conditions that are true for a target resource take precedence.
+        Structure is documented below.
         """
         return pulumi.get(self, "rules")
 
@@ -506,6 +529,7 @@ class PolicySpecArgs:
     @pulumi.getter(name="updateTime")
     def update_time(self) -> Optional[pulumi.Input[str]]:
         """
+        (Output)
         Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that `Policy`.
         """
         return pulumi.get(self, "update_time")
@@ -524,6 +548,7 @@ if not MYPY:
         condition: NotRequired[pulumi.Input['PolicySpecRuleConditionArgsDict']]
         """
         A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+        Structure is documented below.
         """
         deny_all: NotRequired[pulumi.Input[str]]
         """
@@ -535,7 +560,8 @@ if not MYPY:
         """
         values: NotRequired[pulumi.Input['PolicySpecRuleValuesArgsDict']]
         """
-        List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+        Structure is documented below.
         """
 elif False:
     PolicySpecRuleArgsDict: TypeAlias = Mapping[str, Any]
@@ -551,9 +577,11 @@ class PolicySpecRuleArgs:
         """
         :param pulumi.Input[str] allow_all: Setting this to `"TRUE"` means that all values are allowed. This field can be set only in Policies for list constraints.
         :param pulumi.Input['PolicySpecRuleConditionArgs'] condition: A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+               Structure is documented below.
         :param pulumi.Input[str] deny_all: Setting this to `"TRUE"` means that all values are denied. This field can be set only in Policies for list constraints.
         :param pulumi.Input[str] enforce: If `"TRUE"`, then the `Policy` is enforced. If `"FALSE"`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
-        :param pulumi.Input['PolicySpecRuleValuesArgs'] values: List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        :param pulumi.Input['PolicySpecRuleValuesArgs'] values: List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+               Structure is documented below.
         """
         if allow_all is not None:
             pulumi.set(__self__, "allow_all", allow_all)
@@ -583,6 +611,7 @@ class PolicySpecRuleArgs:
     def condition(self) -> Optional[pulumi.Input['PolicySpecRuleConditionArgs']]:
         """
         A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
+        Structure is documented below.
         """
         return pulumi.get(self, "condition")
 
@@ -618,7 +647,8 @@ class PolicySpecRuleArgs:
     @pulumi.getter
     def values(self) -> Optional[pulumi.Input['PolicySpecRuleValuesArgs']]:
         """
-        List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+        List of values to be used for this policy rule. This field can be set only in policies for list constraints.
+        Structure is documented below.
         """
         return pulumi.get(self, "values")