pulumi-gcp 7.32.0a1721151794__py3-none-any.whl → 7.33.0__py3-none-any.whl

pulumi_gcp/kms/crypto_key.py

@@ -25,6 +25,7 @@ class CryptoKeyArgs:
                  crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
+                 key_access_justifications_policy: Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  purpose: Optional[pulumi.Input[str]] = None,
@@ -43,6 +44,15 @@ class CryptoKeyArgs:
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 30 days.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
+        :param pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs'] key_access_justifications_policy: The policy used for Key Access Justifications Policy Enforcement. If this
+               field is present and this key is enrolled in Key Access Justifications
+               Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+               sign operations, and the operation will fail if rejected by the policy. The
+               policy is defined by specifying zero or more allowed justification codes.
+               https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+               By default, this field is absent, and all justification codes are allowed.
+               This field is currently in beta and is subject to change.
+               Structure is documented below.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] labels: Labels with user-defined metadata to apply to this resource.
                
                **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
@@ -69,6 +79,8 @@ class CryptoKeyArgs:
             pulumi.set(__self__, "destroy_scheduled_duration", destroy_scheduled_duration)
         if import_only is not None:
             pulumi.set(__self__, "import_only", import_only)
+        if key_access_justifications_policy is not None:
+            pulumi.set(__self__, "key_access_justifications_policy", key_access_justifications_policy)
         if labels is not None:
             pulumi.set(__self__, "labels", labels)
         if name is not None:
@@ -136,6 +148,26 @@ class CryptoKeyArgs:
     def import_only(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "import_only", value)
 
+    @property
+    @pulumi.getter(name="keyAccessJustificationsPolicy")
+    def key_access_justifications_policy(self) -> Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']]:
+        """
+        The policy used for Key Access Justifications Policy Enforcement. If this
+        field is present and this key is enrolled in Key Access Justifications
+        Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+        sign operations, and the operation will fail if rejected by the policy. The
+        policy is defined by specifying zero or more allowed justification codes.
+        https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+        By default, this field is absent, and all justification codes are allowed.
+        This field is currently in beta and is subject to change.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "key_access_justifications_policy")
+
+    @key_access_justifications_policy.setter
+    def key_access_justifications_policy(self, value: Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']]):
+        pulumi.set(self, "key_access_justifications_policy", value)
+
     @property
     @pulumi.getter
     def labels(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
@@ -228,6 +260,7 @@ class _CryptoKeyState:
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  effective_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
+                 key_access_justifications_policy: Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']] = None,
                  key_ring: Optional[pulumi.Input[str]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -245,6 +278,15 @@ class _CryptoKeyState:
                If not specified at creation time, the default duration is 30 days.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] effective_labels: All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
+        :param pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs'] key_access_justifications_policy: The policy used for Key Access Justifications Policy Enforcement. If this
+               field is present and this key is enrolled in Key Access Justifications
+               Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+               sign operations, and the operation will fail if rejected by the policy. The
+               policy is defined by specifying zero or more allowed justification codes.
+               https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+               By default, this field is absent, and all justification codes are allowed.
+               This field is currently in beta and is subject to change.
+               Structure is documented below.
         :param pulumi.Input[str] key_ring: The KeyRing that this key belongs to.
                Format: `'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'`.
                
@@ -282,6 +324,8 @@ class _CryptoKeyState:
             pulumi.set(__self__, "effective_labels", effective_labels)
         if import_only is not None:
             pulumi.set(__self__, "import_only", import_only)
+        if key_access_justifications_policy is not None:
+            pulumi.set(__self__, "key_access_justifications_policy", key_access_justifications_policy)
         if key_ring is not None:
             pulumi.set(__self__, "key_ring", key_ring)
         if labels is not None:
@@ -351,6 +395,26 @@ class _CryptoKeyState:
     def import_only(self, value: Optional[pulumi.Input[bool]]):
         pulumi.set(self, "import_only", value)
 
+    @property
+    @pulumi.getter(name="keyAccessJustificationsPolicy")
+    def key_access_justifications_policy(self) -> Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']]:
+        """
+        The policy used for Key Access Justifications Policy Enforcement. If this
+        field is present and this key is enrolled in Key Access Justifications
+        Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+        sign operations, and the operation will fail if rejected by the policy. The
+        policy is defined by specifying zero or more allowed justification codes.
+        https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+        By default, this field is absent, and all justification codes are allowed.
+        This field is currently in beta and is subject to change.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "key_access_justifications_policy")
+
+    @key_access_justifications_policy.setter
+    def key_access_justifications_policy(self, value: Optional[pulumi.Input['CryptoKeyKeyAccessJustificationsPolicyArgs']]):
+        pulumi.set(self, "key_access_justifications_policy", value)
+
     @property
     @pulumi.getter(name="keyRing")
     def key_ring(self) -> Optional[pulumi.Input[str]]:
@@ -487,6 +551,7 @@ class CryptoKey(pulumi.CustomResource):
                  crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
+                 key_access_justifications_policy: Optional[pulumi.Input[Union['CryptoKeyKeyAccessJustificationsPolicyArgs', 'CryptoKeyKeyAccessJustificationsPolicyArgsDict']]] = None,
                  key_ring: Optional[pulumi.Input[str]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -570,6 +635,15 @@ class CryptoKey(pulumi.CustomResource):
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 30 days.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
+        :param pulumi.Input[Union['CryptoKeyKeyAccessJustificationsPolicyArgs', 'CryptoKeyKeyAccessJustificationsPolicyArgsDict']] key_access_justifications_policy: The policy used for Key Access Justifications Policy Enforcement. If this
+               field is present and this key is enrolled in Key Access Justifications
+               Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+               sign operations, and the operation will fail if rejected by the policy. The
+               policy is defined by specifying zero or more allowed justification codes.
+               https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+               By default, this field is absent, and all justification codes are allowed.
+               This field is currently in beta and is subject to change.
+               Structure is documented below.
         :param pulumi.Input[str] key_ring: The KeyRing that this key belongs to.
                Format: `'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'`.
                
@@ -686,6 +760,7 @@ class CryptoKey(pulumi.CustomResource):
                  crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
+                 key_access_justifications_policy: Optional[pulumi.Input[Union['CryptoKeyKeyAccessJustificationsPolicyArgs', 'CryptoKeyKeyAccessJustificationsPolicyArgsDict']]] = None,
                  key_ring: Optional[pulumi.Input[str]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -705,6 +780,7 @@ class CryptoKey(pulumi.CustomResource):
             __props__.__dict__["crypto_key_backend"] = crypto_key_backend
             __props__.__dict__["destroy_scheduled_duration"] = destroy_scheduled_duration
             __props__.__dict__["import_only"] = import_only
+            __props__.__dict__["key_access_justifications_policy"] = key_access_justifications_policy
             if key_ring is None and not opts.urn:
                 raise TypeError("Missing required property 'key_ring'")
             __props__.__dict__["key_ring"] = key_ring
@@ -733,6 +809,7 @@ class CryptoKey(pulumi.CustomResource):
             destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
             effective_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             import_only: Optional[pulumi.Input[bool]] = None,
+            key_access_justifications_policy: Optional[pulumi.Input[Union['CryptoKeyKeyAccessJustificationsPolicyArgs', 'CryptoKeyKeyAccessJustificationsPolicyArgsDict']]] = None,
             key_ring: Optional[pulumi.Input[str]] = None,
             labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             name: Optional[pulumi.Input[str]] = None,
@@ -755,6 +832,15 @@ class CryptoKey(pulumi.CustomResource):
                If not specified at creation time, the default duration is 30 days.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] effective_labels: All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
+        :param pulumi.Input[Union['CryptoKeyKeyAccessJustificationsPolicyArgs', 'CryptoKeyKeyAccessJustificationsPolicyArgsDict']] key_access_justifications_policy: The policy used for Key Access Justifications Policy Enforcement. If this
+               field is present and this key is enrolled in Key Access Justifications
+               Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+               sign operations, and the operation will fail if rejected by the policy. The
+               policy is defined by specifying zero or more allowed justification codes.
+               https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+               By default, this field is absent, and all justification codes are allowed.
+               This field is currently in beta and is subject to change.
+               Structure is documented below.
         :param pulumi.Input[str] key_ring: The KeyRing that this key belongs to.
                Format: `'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'`.
                
@@ -792,6 +878,7 @@ class CryptoKey(pulumi.CustomResource):
         __props__.__dict__["destroy_scheduled_duration"] = destroy_scheduled_duration
         __props__.__dict__["effective_labels"] = effective_labels
         __props__.__dict__["import_only"] = import_only
+        __props__.__dict__["key_access_justifications_policy"] = key_access_justifications_policy
         __props__.__dict__["key_ring"] = key_ring
         __props__.__dict__["labels"] = labels
         __props__.__dict__["name"] = name
@@ -837,6 +924,22 @@ class CryptoKey(pulumi.CustomResource):
         """
         return pulumi.get(self, "import_only")
 
+    @property
+    @pulumi.getter(name="keyAccessJustificationsPolicy")
+    def key_access_justifications_policy(self) -> pulumi.Output['outputs.CryptoKeyKeyAccessJustificationsPolicy']:
+        """
+        The policy used for Key Access Justifications Policy Enforcement. If this
+        field is present and this key is enrolled in Key Access Justifications
+        Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+        sign operations, and the operation will fail if rejected by the policy. The
+        policy is defined by specifying zero or more allowed justification codes.
+        https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+        By default, this field is absent, and all justification codes are allowed.
+        This field is currently in beta and is subject to change.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "key_access_justifications_policy")
+
     @property
     @pulumi.getter(name="keyRing")
     def key_ring(self) -> pulumi.Output[str]:

pulumi_gcp/kms/ekm_connection.py

@@ -320,10 +320,10 @@ class EkmConnection(pulumi.CustomResource):
             location="us-central1",
             key_management_mode="MANUAL",
             service_resolvers=[{
-                "serviceDirectoryService": "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
+                "service_directory_service": "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
                 "hostname": "example-ekm.goog",
-                "serverCertificates": [{
-                    "rawDer": "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
+                "server_certificates": [{
+                    "raw_der": "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
                 }],
             }])
         ```
@@ -396,10 +396,10 @@ class EkmConnection(pulumi.CustomResource):
             location="us-central1",
             key_management_mode="MANUAL",
             service_resolvers=[{
-                "serviceDirectoryService": "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
+                "service_directory_service": "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
                 "hostname": "example-ekm.goog",
-                "serverCertificates": [{
-                    "rawDer": "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
+                "server_certificates": [{
+                    "raw_der": "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
                 }],
             }])
         ```

pulumi_gcp/kms/get_kms_crypto_key.py

@@ -27,7 +27,7 @@ class GetKMSCryptoKeyResult:
     """
     A collection of values returned by getKMSCryptoKey.
     """
-    def __init__(__self__, crypto_key_backend=None, destroy_scheduled_duration=None, effective_labels=None, id=None, import_only=None, key_ring=None, labels=None, name=None, primaries=None, pulumi_labels=None, purpose=None, rotation_period=None, skip_initial_version_creation=None, version_templates=None):
+    def __init__(__self__, crypto_key_backend=None, destroy_scheduled_duration=None, effective_labels=None, id=None, import_only=None, key_access_justifications_policies=None, key_ring=None, labels=None, name=None, primaries=None, pulumi_labels=None, purpose=None, rotation_period=None, skip_initial_version_creation=None, version_templates=None):
         if crypto_key_backend and not isinstance(crypto_key_backend, str):
             raise TypeError("Expected argument 'crypto_key_backend' to be a str")
         pulumi.set(__self__, "crypto_key_backend", crypto_key_backend)
@@ -43,6 +43,9 @@ class GetKMSCryptoKeyResult:
         if import_only and not isinstance(import_only, bool):
             raise TypeError("Expected argument 'import_only' to be a bool")
         pulumi.set(__self__, "import_only", import_only)
+        if key_access_justifications_policies and not isinstance(key_access_justifications_policies, list):
+            raise TypeError("Expected argument 'key_access_justifications_policies' to be a list")
+        pulumi.set(__self__, "key_access_justifications_policies", key_access_justifications_policies)
         if key_ring and not isinstance(key_ring, str):
             raise TypeError("Expected argument 'key_ring' to be a str")
         pulumi.set(__self__, "key_ring", key_ring)
@@ -99,6 +102,11 @@ class GetKMSCryptoKeyResult:
     def import_only(self) -> bool:
         return pulumi.get(self, "import_only")
 
+    @property
+    @pulumi.getter(name="keyAccessJustificationsPolicies")
+    def key_access_justifications_policies(self) -> Sequence['outputs.GetKMSCryptoKeyKeyAccessJustificationsPolicyResult']:
+        return pulumi.get(self, "key_access_justifications_policies")
+
     @property
     @pulumi.getter(name="keyRing")
     def key_ring(self) -> str:
@@ -164,6 +172,7 @@ class AwaitableGetKMSCryptoKeyResult(GetKMSCryptoKeyResult):
             effective_labels=self.effective_labels,
             id=self.id,
             import_only=self.import_only,
+            key_access_justifications_policies=self.key_access_justifications_policies,
             key_ring=self.key_ring,
             labels=self.labels,
             name=self.name,
@@ -216,6 +225,7 @@ def get_kms_crypto_key(key_ring: Optional[str] = None,
         effective_labels=pulumi.get(__ret__, 'effective_labels'),
         id=pulumi.get(__ret__, 'id'),
         import_only=pulumi.get(__ret__, 'import_only'),
+        key_access_justifications_policies=pulumi.get(__ret__, 'key_access_justifications_policies'),
         key_ring=pulumi.get(__ret__, 'key_ring'),
         labels=pulumi.get(__ret__, 'labels'),
         name=pulumi.get(__ret__, 'name'),

pulumi_gcp/kms/get_kms_secret_ciphertext.py

@@ -123,14 +123,14 @@ def get_kms_secret_ciphertext(crypto_key: Optional[str] = None,
         plaintext="my-secret-password")
     instance = gcp.compute.Instance("instance",
         network_interfaces=[{
-            "accessConfigs": [{}],
+            "access_configs": [{}],
             "network": "default",
         }],
         name="test",
         machine_type="e2-medium",
         zone="us-central1-a",
         boot_disk={
-            "initializeParams": {
+            "initialize_params": {
                 "image": "debian-cloud/debian-11",
             },
         },
@@ -206,14 +206,14 @@ def get_kms_secret_ciphertext_output(crypto_key: Optional[pulumi.Input[str]] = N
         plaintext="my-secret-password")
     instance = gcp.compute.Instance("instance",
         network_interfaces=[{
-            "accessConfigs": [{}],
+            "access_configs": [{}],
             "network": "default",
         }],
         name="test",
         machine_type="e2-medium",
         zone="us-central1-a",
         boot_disk={
-            "initializeParams": {
+            "initialize_params": {
                 "image": "debian-cloud/debian-11",
             },
         },

pulumi_gcp/kms/outputs.py

@@ -18,6 +18,7 @@ from . import outputs
 __all__ = [
     'CryptoKeyIAMBindingCondition',
     'CryptoKeyIAMMemberCondition',
+    'CryptoKeyKeyAccessJustificationsPolicy',
     'CryptoKeyPrimary',
     'CryptoKeyVersionAttestation',
     'CryptoKeyVersionAttestationCertChains',
@@ -31,8 +32,10 @@ __all__ = [
     'KeyRingImportJobAttestation',
     'KeyRingImportJobPublicKey',
     'GetCryptoKeysKeyResult',
+    'GetCryptoKeysKeyKeyAccessJustificationsPolicyResult',
     'GetCryptoKeysKeyPrimaryResult',
     'GetCryptoKeysKeyVersionTemplateResult',
+    'GetKMSCryptoKeyKeyAccessJustificationsPolicyResult',
     'GetKMSCryptoKeyPrimaryResult',
     'GetKMSCryptoKeyVersionPublicKeyResult',
     'GetKMSCryptoKeyVersionTemplateResult',
@@ -137,6 +140,46 @@ class CryptoKeyIAMMemberCondition(dict):
         return pulumi.get(self, "description")
 
 
+@pulumi.output_type
+class CryptoKeyKeyAccessJustificationsPolicy(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "allowedAccessReasons":
+            suggest = "allowed_access_reasons"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in CryptoKeyKeyAccessJustificationsPolicy. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        CryptoKeyKeyAccessJustificationsPolicy.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        CryptoKeyKeyAccessJustificationsPolicy.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 allowed_access_reasons: Optional[Sequence[str]] = None):
+        """
+        :param Sequence[str] allowed_access_reasons: The list of allowed reasons for access to this CryptoKey. Zero allowed
+               access reasons means all encrypt, decrypt, and sign operations for
+               this CryptoKey will fail.
+        """
+        if allowed_access_reasons is not None:
+            pulumi.set(__self__, "allowed_access_reasons", allowed_access_reasons)
+
+    @property
+    @pulumi.getter(name="allowedAccessReasons")
+    def allowed_access_reasons(self) -> Optional[Sequence[str]]:
+        """
+        The list of allowed reasons for access to this CryptoKey. Zero allowed
+        access reasons means all encrypt, decrypt, and sign operations for
+        this CryptoKey will fail.
+        """
+        return pulumi.get(self, "allowed_access_reasons")
+
+
 @pulumi.output_type
 class CryptoKeyPrimary(dict):
     def __init__(__self__, *,
@@ -872,6 +915,7 @@ class GetCryptoKeysKeyResult(dict):
                  effective_labels: Mapping[str, str],
                  id: str,
                  import_only: bool,
+                 key_access_justifications_policies: Sequence['outputs.GetCryptoKeysKeyKeyAccessJustificationsPolicyResult'],
                  labels: Mapping[str, str],
                  primaries: Sequence['outputs.GetCryptoKeysKeyPrimaryResult'],
                  pulumi_labels: Mapping[str, str],
@@ -887,6 +931,14 @@ class GetCryptoKeysKeyResult(dict):
         :param str destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 30 days.
         :param bool import_only: Whether this key may contain imported versions only.
+        :param Sequence['GetCryptoKeysKeyKeyAccessJustificationsPolicyArgs'] key_access_justifications_policies: The policy used for Key Access Justifications Policy Enforcement. If this
+               field is present and this key is enrolled in Key Access Justifications
+               Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+               sign operations, and the operation will fail if rejected by the policy. The
+               policy is defined by specifying zero or more allowed justification codes.
+               https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+               By default, this field is absent, and all justification codes are allowed.
+               This field is currently in beta and is subject to change.
         :param Mapping[str, str] labels: Labels with user-defined metadata to apply to this resource.
                
                
@@ -916,6 +968,7 @@ class GetCryptoKeysKeyResult(dict):
         pulumi.set(__self__, "effective_labels", effective_labels)
         pulumi.set(__self__, "id", id)
         pulumi.set(__self__, "import_only", import_only)
+        pulumi.set(__self__, "key_access_justifications_policies", key_access_justifications_policies)
         pulumi.set(__self__, "labels", labels)
         pulumi.set(__self__, "primaries", primaries)
         pulumi.set(__self__, "pulumi_labels", pulumi_labels)
@@ -964,6 +1017,21 @@ class GetCryptoKeysKeyResult(dict):
         """
         return pulumi.get(self, "import_only")
 
+    @property
+    @pulumi.getter(name="keyAccessJustificationsPolicies")
+    def key_access_justifications_policies(self) -> Sequence['outputs.GetCryptoKeysKeyKeyAccessJustificationsPolicyResult']:
+        """
+        The policy used for Key Access Justifications Policy Enforcement. If this
+        field is present and this key is enrolled in Key Access Justifications
+        Policy Enforcement, the policy will be evaluated in encrypt, decrypt, and
+        sign operations, and the operation will fail if rejected by the policy. The
+        policy is defined by specifying zero or more allowed justification codes.
+        https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
+        By default, this field is absent, and all justification codes are allowed.
+        This field is currently in beta and is subject to change.
+        """
+        return pulumi.get(self, "key_access_justifications_policies")
+
     @property
     @pulumi.getter
     def labels(self) -> Mapping[str, str]:
@@ -1051,6 +1119,28 @@ class GetCryptoKeysKeyResult(dict):
         return pulumi.get(self, "name")
 
 
+@pulumi.output_type
+class GetCryptoKeysKeyKeyAccessJustificationsPolicyResult(dict):
+    def __init__(__self__, *,
+                 allowed_access_reasons: Sequence[str]):
+        """
+        :param Sequence[str] allowed_access_reasons: The list of allowed reasons for access to this CryptoKey. Zero allowed
+               access reasons means all encrypt, decrypt, and sign operations for
+               this CryptoKey will fail.
+        """
+        pulumi.set(__self__, "allowed_access_reasons", allowed_access_reasons)
+
+    @property
+    @pulumi.getter(name="allowedAccessReasons")
+    def allowed_access_reasons(self) -> Sequence[str]:
+        """
+        The list of allowed reasons for access to this CryptoKey. Zero allowed
+        access reasons means all encrypt, decrypt, and sign operations for
+        this CryptoKey will fail.
+        """
+        return pulumi.get(self, "allowed_access_reasons")
+
+
 @pulumi.output_type
 class GetCryptoKeysKeyPrimaryResult(dict):
     def __init__(__self__, *,
@@ -1111,6 +1201,28 @@ class GetCryptoKeysKeyVersionTemplateResult(dict):
         return pulumi.get(self, "protection_level")
 
 
+@pulumi.output_type
+class GetKMSCryptoKeyKeyAccessJustificationsPolicyResult(dict):
+    def __init__(__self__, *,
+                 allowed_access_reasons: Sequence[str]):
+        """
+        :param Sequence[str] allowed_access_reasons: The list of allowed reasons for access to this CryptoKey. Zero allowed
+               access reasons means all encrypt, decrypt, and sign operations for
+               this CryptoKey will fail.
+        """
+        pulumi.set(__self__, "allowed_access_reasons", allowed_access_reasons)
+
+    @property
+    @pulumi.getter(name="allowedAccessReasons")
+    def allowed_access_reasons(self) -> Sequence[str]:
+        """
+        The list of allowed reasons for access to this CryptoKey. Zero allowed
+        access reasons means all encrypt, decrypt, and sign operations for
+        this CryptoKey will fail.
+        """
+        return pulumi.get(self, "allowed_access_reasons")
+
+
 @pulumi.output_type
 class GetKMSCryptoKeyPrimaryResult(dict):
     def __init__(__self__, *,

pulumi_gcp/kms/secret_ciphertext.py

@@ -209,14 +209,14 @@ class SecretCiphertext(pulumi.CustomResource):
             plaintext="my-secret-password")
         instance = gcp.compute.Instance("instance",
             network_interfaces=[{
-                "accessConfigs": [{}],
+                "access_configs": [{}],
                 "network": "default",
             }],
             name="my-instance",
             machine_type="e2-medium",
             zone="us-central1-a",
             boot_disk={
-                "initializeParams": {
+                "initialize_params": {
                     "image": "debian-cloud/debian-11",
                 },
             },
@@ -281,14 +281,14 @@ class SecretCiphertext(pulumi.CustomResource):
             plaintext="my-secret-password")
         instance = gcp.compute.Instance("instance",
             network_interfaces=[{
-                "accessConfigs": [{}],
+                "access_configs": [{}],
                 "network": "default",
             }],
             name="my-instance",
             machine_type="e2-medium",
             zone="us-central1-a",
             boot_disk={
-                "initializeParams": {
+                "initialize_params": {
                     "image": "debian-cloud/debian-11",
                 },
             },

pulumi_gcp/logging/folder_bucket_config.py

@@ -330,7 +330,7 @@ class FolderBucketConfig(pulumi.CustomResource):
             retention_days=30,
             bucket_id="_Default",
             index_configs=[{
-                "fieldPath": "jsonPayload.request.status",
+                "field_path": "jsonPayload.request.status",
                 "type": "INDEX_TYPE_STRING",
             }])
         ```
@@ -387,7 +387,7 @@ class FolderBucketConfig(pulumi.CustomResource):
             retention_days=30,
             bucket_id="_Default",
             index_configs=[{
-                "fieldPath": "jsonPayload.request.status",
+                "field_path": "jsonPayload.request.status",
                 "type": "INDEX_TYPE_STRING",
             }])
         ```