pulumi-gcp 8.14.0a1736836474__py3-none-any.whl → 8.14.0a1736952890__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_gcp/__init__.py +32 -0
- pulumi_gcp/applicationintegration/_inputs.py +3 -3
- pulumi_gcp/applicationintegration/outputs.py +2 -2
- pulumi_gcp/beyondcorp/__init__.py +1 -0
- pulumi_gcp/beyondcorp/_inputs.py +93 -0
- pulumi_gcp/beyondcorp/outputs.py +89 -0
- pulumi_gcp/beyondcorp/security_gateway.py +670 -0
- pulumi_gcp/blockchainnodeengine/_inputs.py +3 -3
- pulumi_gcp/blockchainnodeengine/outputs.py +2 -2
- pulumi_gcp/certificateauthority/_inputs.py +6 -6
- pulumi_gcp/certificateauthority/outputs.py +4 -4
- pulumi_gcp/certificatemanager/_inputs.py +3 -3
- pulumi_gcp/certificatemanager/outputs.py +2 -2
- pulumi_gcp/chronicle/__init__.py +2 -0
- pulumi_gcp/chronicle/_inputs.py +388 -0
- pulumi_gcp/chronicle/data_access_label.py +690 -0
- pulumi_gcp/chronicle/data_access_scope.py +1094 -0
- pulumi_gcp/chronicle/outputs.py +322 -0
- pulumi_gcp/chronicle/watchlist.py +68 -45
- pulumi_gcp/cloudbuild/_inputs.py +3 -3
- pulumi_gcp/cloudbuild/outputs.py +2 -2
- pulumi_gcp/cloudquota/__init__.py +1 -0
- pulumi_gcp/cloudquota/s_quota_adjuster_settings.py +336 -0
- pulumi_gcp/compute/_inputs.py +33 -33
- pulumi_gcp/compute/instance_group_manager.py +9 -9
- pulumi_gcp/compute/outputs.py +22 -22
- pulumi_gcp/compute/region_instance_group_manager.py +9 -9
- pulumi_gcp/datacatalog/_inputs.py +3 -3
- pulumi_gcp/datacatalog/outputs.py +2 -2
- pulumi_gcp/developerconnect/_inputs.py +910 -42
- pulumi_gcp/developerconnect/connection.py +614 -86
- pulumi_gcp/developerconnect/git_repository_link.py +4 -0
- pulumi_gcp/developerconnect/outputs.py +717 -28
- pulumi_gcp/dns/_inputs.py +124 -20
- pulumi_gcp/dns/outputs.py +90 -16
- pulumi_gcp/dns/record_set.py +82 -0
- pulumi_gcp/edgecontainer/_inputs.py +3 -3
- pulumi_gcp/edgecontainer/outputs.py +2 -2
- pulumi_gcp/gkeonprem/_inputs.py +15 -15
- pulumi_gcp/gkeonprem/outputs.py +10 -10
- pulumi_gcp/gkeonprem/v_mware_cluster.py +1 -1
- pulumi_gcp/iap/_inputs.py +9 -3
- pulumi_gcp/iap/outputs.py +6 -2
- pulumi_gcp/iap/settings.py +63 -63
- pulumi_gcp/identityplatform/_inputs.py +9 -9
- pulumi_gcp/identityplatform/outputs.py +6 -6
- pulumi_gcp/integrationconnectors/_inputs.py +6 -6
- pulumi_gcp/integrationconnectors/outputs.py +4 -4
- pulumi_gcp/monitoring/_inputs.py +3 -3
- pulumi_gcp/monitoring/outputs.py +2 -2
- pulumi_gcp/oracledatabase/_inputs.py +3 -3
- pulumi_gcp/oracledatabase/outputs.py +2 -2
- pulumi_gcp/pulumi-plugin.json +1 -1
- pulumi_gcp/sql/_inputs.py +20 -0
- pulumi_gcp/sql/database_instance.py +2 -2
- pulumi_gcp/sql/outputs.py +36 -0
- pulumi_gcp/transcoder/_inputs.py +6 -6
- pulumi_gcp/transcoder/outputs.py +4 -4
- {pulumi_gcp-8.14.0a1736836474.dist-info → pulumi_gcp-8.14.0a1736952890.dist-info}/METADATA +1 -1
- {pulumi_gcp-8.14.0a1736836474.dist-info → pulumi_gcp-8.14.0a1736952890.dist-info}/RECORD +62 -58
- {pulumi_gcp-8.14.0a1736836474.dist-info → pulumi_gcp-8.14.0a1736952890.dist-info}/WHEEL +0 -0
- {pulumi_gcp-8.14.0a1736836474.dist-info → pulumi_gcp-8.14.0a1736952890.dist-info}/top_level.txt +0 -0
|
@@ -0,0 +1,1094 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import copy
|
|
6
|
+
import warnings
|
|
7
|
+
import sys
|
|
8
|
+
import pulumi
|
|
9
|
+
import pulumi.runtime
|
|
10
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
15
|
+
from .. import _utilities
|
|
16
|
+
from . import outputs
|
|
17
|
+
from ._inputs import *
|
|
18
|
+
|
|
19
|
+
__all__ = ['DataAccessScopeArgs', 'DataAccessScope']
|
|
20
|
+
|
|
21
|
+
@pulumi.input_type
|
|
22
|
+
class DataAccessScopeArgs:
|
|
23
|
+
def __init__(__self__, *,
|
|
24
|
+
data_access_scope_id: pulumi.Input[str],
|
|
25
|
+
instance: pulumi.Input[str],
|
|
26
|
+
location: pulumi.Input[str],
|
|
27
|
+
allow_all: Optional[pulumi.Input[bool]] = None,
|
|
28
|
+
allowed_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]] = None,
|
|
29
|
+
denied_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]] = None,
|
|
30
|
+
description: Optional[pulumi.Input[str]] = None,
|
|
31
|
+
project: Optional[pulumi.Input[str]] = None):
|
|
32
|
+
"""
|
|
33
|
+
The set of arguments for constructing a DataAccessScope resource.
|
|
34
|
+
:param pulumi.Input[str] data_access_scope_id: Required. The user provided scope id which will become the last part of the name
|
|
35
|
+
of the scope resource.
|
|
36
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
- - -
|
|
40
|
+
:param pulumi.Input[str] instance: The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
41
|
+
:param pulumi.Input[str] location: The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
42
|
+
:param pulumi.Input[bool] allow_all: Optional. Whether or not the scope allows all labels, allow_all and
|
|
43
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
44
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
45
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
46
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
47
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
48
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
49
|
+
with labels A and B.
|
|
50
|
+
:param pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]] allowed_data_access_labels: The allowed labels for the scope. There has to be at
|
|
51
|
+
least one label allowed for the scope to be valid.
|
|
52
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
53
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
54
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
55
|
+
to see data with labeled with A or B or (A and B).
|
|
56
|
+
Structure is documented below.
|
|
57
|
+
:param pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]] denied_data_access_labels: Optional. The denied labels for the scope.
|
|
58
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
59
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
60
|
+
to see data labeled with A and data labeled with B
|
|
61
|
+
and data with labels A and B.
|
|
62
|
+
Structure is documented below.
|
|
63
|
+
:param pulumi.Input[str] description: Optional. A description of the data access scope for a human reader.
|
|
64
|
+
:param pulumi.Input[str] project: The ID of the project in which the resource belongs.
|
|
65
|
+
If it is not provided, the provider project is used.
|
|
66
|
+
"""
|
|
67
|
+
pulumi.set(__self__, "data_access_scope_id", data_access_scope_id)
|
|
68
|
+
pulumi.set(__self__, "instance", instance)
|
|
69
|
+
pulumi.set(__self__, "location", location)
|
|
70
|
+
if allow_all is not None:
|
|
71
|
+
pulumi.set(__self__, "allow_all", allow_all)
|
|
72
|
+
if allowed_data_access_labels is not None:
|
|
73
|
+
pulumi.set(__self__, "allowed_data_access_labels", allowed_data_access_labels)
|
|
74
|
+
if denied_data_access_labels is not None:
|
|
75
|
+
pulumi.set(__self__, "denied_data_access_labels", denied_data_access_labels)
|
|
76
|
+
if description is not None:
|
|
77
|
+
pulumi.set(__self__, "description", description)
|
|
78
|
+
if project is not None:
|
|
79
|
+
pulumi.set(__self__, "project", project)
|
|
80
|
+
|
|
81
|
+
@property
|
|
82
|
+
@pulumi.getter(name="dataAccessScopeId")
|
|
83
|
+
def data_access_scope_id(self) -> pulumi.Input[str]:
|
|
84
|
+
"""
|
|
85
|
+
Required. The user provided scope id which will become the last part of the name
|
|
86
|
+
of the scope resource.
|
|
87
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
88
|
+
|
|
89
|
+
|
|
90
|
+
- - -
|
|
91
|
+
"""
|
|
92
|
+
return pulumi.get(self, "data_access_scope_id")
|
|
93
|
+
|
|
94
|
+
@data_access_scope_id.setter
|
|
95
|
+
def data_access_scope_id(self, value: pulumi.Input[str]):
|
|
96
|
+
pulumi.set(self, "data_access_scope_id", value)
|
|
97
|
+
|
|
98
|
+
@property
|
|
99
|
+
@pulumi.getter
|
|
100
|
+
def instance(self) -> pulumi.Input[str]:
|
|
101
|
+
"""
|
|
102
|
+
The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
103
|
+
"""
|
|
104
|
+
return pulumi.get(self, "instance")
|
|
105
|
+
|
|
106
|
+
@instance.setter
|
|
107
|
+
def instance(self, value: pulumi.Input[str]):
|
|
108
|
+
pulumi.set(self, "instance", value)
|
|
109
|
+
|
|
110
|
+
@property
|
|
111
|
+
@pulumi.getter
|
|
112
|
+
def location(self) -> pulumi.Input[str]:
|
|
113
|
+
"""
|
|
114
|
+
The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
115
|
+
"""
|
|
116
|
+
return pulumi.get(self, "location")
|
|
117
|
+
|
|
118
|
+
@location.setter
|
|
119
|
+
def location(self, value: pulumi.Input[str]):
|
|
120
|
+
pulumi.set(self, "location", value)
|
|
121
|
+
|
|
122
|
+
@property
|
|
123
|
+
@pulumi.getter(name="allowAll")
|
|
124
|
+
def allow_all(self) -> Optional[pulumi.Input[bool]]:
|
|
125
|
+
"""
|
|
126
|
+
Optional. Whether or not the scope allows all labels, allow_all and
|
|
127
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
128
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
129
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
130
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
131
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
132
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
133
|
+
with labels A and B.
|
|
134
|
+
"""
|
|
135
|
+
return pulumi.get(self, "allow_all")
|
|
136
|
+
|
|
137
|
+
@allow_all.setter
|
|
138
|
+
def allow_all(self, value: Optional[pulumi.Input[bool]]):
|
|
139
|
+
pulumi.set(self, "allow_all", value)
|
|
140
|
+
|
|
141
|
+
@property
|
|
142
|
+
@pulumi.getter(name="allowedDataAccessLabels")
|
|
143
|
+
def allowed_data_access_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]]:
|
|
144
|
+
"""
|
|
145
|
+
The allowed labels for the scope. There has to be at
|
|
146
|
+
least one label allowed for the scope to be valid.
|
|
147
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
148
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
149
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
150
|
+
to see data with labeled with A or B or (A and B).
|
|
151
|
+
Structure is documented below.
|
|
152
|
+
"""
|
|
153
|
+
return pulumi.get(self, "allowed_data_access_labels")
|
|
154
|
+
|
|
155
|
+
@allowed_data_access_labels.setter
|
|
156
|
+
def allowed_data_access_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]]):
|
|
157
|
+
pulumi.set(self, "allowed_data_access_labels", value)
|
|
158
|
+
|
|
159
|
+
@property
|
|
160
|
+
@pulumi.getter(name="deniedDataAccessLabels")
|
|
161
|
+
def denied_data_access_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]]:
|
|
162
|
+
"""
|
|
163
|
+
Optional. The denied labels for the scope.
|
|
164
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
165
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
166
|
+
to see data labeled with A and data labeled with B
|
|
167
|
+
and data with labels A and B.
|
|
168
|
+
Structure is documented below.
|
|
169
|
+
"""
|
|
170
|
+
return pulumi.get(self, "denied_data_access_labels")
|
|
171
|
+
|
|
172
|
+
@denied_data_access_labels.setter
|
|
173
|
+
def denied_data_access_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]]):
|
|
174
|
+
pulumi.set(self, "denied_data_access_labels", value)
|
|
175
|
+
|
|
176
|
+
@property
|
|
177
|
+
@pulumi.getter
|
|
178
|
+
def description(self) -> Optional[pulumi.Input[str]]:
|
|
179
|
+
"""
|
|
180
|
+
Optional. A description of the data access scope for a human reader.
|
|
181
|
+
"""
|
|
182
|
+
return pulumi.get(self, "description")
|
|
183
|
+
|
|
184
|
+
@description.setter
|
|
185
|
+
def description(self, value: Optional[pulumi.Input[str]]):
|
|
186
|
+
pulumi.set(self, "description", value)
|
|
187
|
+
|
|
188
|
+
@property
|
|
189
|
+
@pulumi.getter
|
|
190
|
+
def project(self) -> Optional[pulumi.Input[str]]:
|
|
191
|
+
"""
|
|
192
|
+
The ID of the project in which the resource belongs.
|
|
193
|
+
If it is not provided, the provider project is used.
|
|
194
|
+
"""
|
|
195
|
+
return pulumi.get(self, "project")
|
|
196
|
+
|
|
197
|
+
@project.setter
|
|
198
|
+
def project(self, value: Optional[pulumi.Input[str]]):
|
|
199
|
+
pulumi.set(self, "project", value)
|
|
200
|
+
|
|
201
|
+
|
|
202
|
+
@pulumi.input_type
|
|
203
|
+
class _DataAccessScopeState:
|
|
204
|
+
def __init__(__self__, *,
|
|
205
|
+
allow_all: Optional[pulumi.Input[bool]] = None,
|
|
206
|
+
allowed_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]] = None,
|
|
207
|
+
author: Optional[pulumi.Input[str]] = None,
|
|
208
|
+
create_time: Optional[pulumi.Input[str]] = None,
|
|
209
|
+
data_access_scope_id: Optional[pulumi.Input[str]] = None,
|
|
210
|
+
denied_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]] = None,
|
|
211
|
+
description: Optional[pulumi.Input[str]] = None,
|
|
212
|
+
display_name: Optional[pulumi.Input[str]] = None,
|
|
213
|
+
instance: Optional[pulumi.Input[str]] = None,
|
|
214
|
+
last_editor: Optional[pulumi.Input[str]] = None,
|
|
215
|
+
location: Optional[pulumi.Input[str]] = None,
|
|
216
|
+
name: Optional[pulumi.Input[str]] = None,
|
|
217
|
+
project: Optional[pulumi.Input[str]] = None,
|
|
218
|
+
update_time: Optional[pulumi.Input[str]] = None):
|
|
219
|
+
"""
|
|
220
|
+
Input properties used for looking up and filtering DataAccessScope resources.
|
|
221
|
+
:param pulumi.Input[bool] allow_all: Optional. Whether or not the scope allows all labels, allow_all and
|
|
222
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
223
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
224
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
225
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
226
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
227
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
228
|
+
with labels A and B.
|
|
229
|
+
:param pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]] allowed_data_access_labels: The allowed labels for the scope. There has to be at
|
|
230
|
+
least one label allowed for the scope to be valid.
|
|
231
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
232
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
233
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
234
|
+
to see data with labeled with A or B or (A and B).
|
|
235
|
+
Structure is documented below.
|
|
236
|
+
:param pulumi.Input[str] author: Output only. The user who created the data access scope.
|
|
237
|
+
:param pulumi.Input[str] create_time: Output only. The time at which the data access scope was created.
|
|
238
|
+
:param pulumi.Input[str] data_access_scope_id: Required. The user provided scope id which will become the last part of the name
|
|
239
|
+
of the scope resource.
|
|
240
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
241
|
+
|
|
242
|
+
|
|
243
|
+
- - -
|
|
244
|
+
:param pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]] denied_data_access_labels: Optional. The denied labels for the scope.
|
|
245
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
246
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
247
|
+
to see data labeled with A and data labeled with B
|
|
248
|
+
and data with labels A and B.
|
|
249
|
+
Structure is documented below.
|
|
250
|
+
:param pulumi.Input[str] description: Optional. A description of the data access scope for a human reader.
|
|
251
|
+
:param pulumi.Input[str] display_name: Output only. The name to be used for display to customers of the data access scope.
|
|
252
|
+
:param pulumi.Input[str] instance: The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
253
|
+
:param pulumi.Input[str] last_editor: Output only. The user who last updated the data access scope.
|
|
254
|
+
:param pulumi.Input[str] location: The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
255
|
+
:param pulumi.Input[str] name: The unique full name of the data access scope. This unique identifier is generated using values provided for the URL parameters.
|
|
256
|
+
Format:
|
|
257
|
+
projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{data_access_scope_id}
|
|
258
|
+
:param pulumi.Input[str] project: The ID of the project in which the resource belongs.
|
|
259
|
+
If it is not provided, the provider project is used.
|
|
260
|
+
:param pulumi.Input[str] update_time: Output only. The time at which the data access scope was last updated.
|
|
261
|
+
"""
|
|
262
|
+
if allow_all is not None:
|
|
263
|
+
pulumi.set(__self__, "allow_all", allow_all)
|
|
264
|
+
if allowed_data_access_labels is not None:
|
|
265
|
+
pulumi.set(__self__, "allowed_data_access_labels", allowed_data_access_labels)
|
|
266
|
+
if author is not None:
|
|
267
|
+
pulumi.set(__self__, "author", author)
|
|
268
|
+
if create_time is not None:
|
|
269
|
+
pulumi.set(__self__, "create_time", create_time)
|
|
270
|
+
if data_access_scope_id is not None:
|
|
271
|
+
pulumi.set(__self__, "data_access_scope_id", data_access_scope_id)
|
|
272
|
+
if denied_data_access_labels is not None:
|
|
273
|
+
pulumi.set(__self__, "denied_data_access_labels", denied_data_access_labels)
|
|
274
|
+
if description is not None:
|
|
275
|
+
pulumi.set(__self__, "description", description)
|
|
276
|
+
if display_name is not None:
|
|
277
|
+
pulumi.set(__self__, "display_name", display_name)
|
|
278
|
+
if instance is not None:
|
|
279
|
+
pulumi.set(__self__, "instance", instance)
|
|
280
|
+
if last_editor is not None:
|
|
281
|
+
pulumi.set(__self__, "last_editor", last_editor)
|
|
282
|
+
if location is not None:
|
|
283
|
+
pulumi.set(__self__, "location", location)
|
|
284
|
+
if name is not None:
|
|
285
|
+
pulumi.set(__self__, "name", name)
|
|
286
|
+
if project is not None:
|
|
287
|
+
pulumi.set(__self__, "project", project)
|
|
288
|
+
if update_time is not None:
|
|
289
|
+
pulumi.set(__self__, "update_time", update_time)
|
|
290
|
+
|
|
291
|
+
@property
|
|
292
|
+
@pulumi.getter(name="allowAll")
|
|
293
|
+
def allow_all(self) -> Optional[pulumi.Input[bool]]:
|
|
294
|
+
"""
|
|
295
|
+
Optional. Whether or not the scope allows all labels, allow_all and
|
|
296
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
297
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
298
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
299
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
300
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
301
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
302
|
+
with labels A and B.
|
|
303
|
+
"""
|
|
304
|
+
return pulumi.get(self, "allow_all")
|
|
305
|
+
|
|
306
|
+
@allow_all.setter
|
|
307
|
+
def allow_all(self, value: Optional[pulumi.Input[bool]]):
|
|
308
|
+
pulumi.set(self, "allow_all", value)
|
|
309
|
+
|
|
310
|
+
@property
|
|
311
|
+
@pulumi.getter(name="allowedDataAccessLabels")
|
|
312
|
+
def allowed_data_access_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]]:
|
|
313
|
+
"""
|
|
314
|
+
The allowed labels for the scope. There has to be at
|
|
315
|
+
least one label allowed for the scope to be valid.
|
|
316
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
317
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
318
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
319
|
+
to see data with labeled with A or B or (A and B).
|
|
320
|
+
Structure is documented below.
|
|
321
|
+
"""
|
|
322
|
+
return pulumi.get(self, "allowed_data_access_labels")
|
|
323
|
+
|
|
324
|
+
@allowed_data_access_labels.setter
|
|
325
|
+
def allowed_data_access_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeAllowedDataAccessLabelArgs']]]]):
|
|
326
|
+
pulumi.set(self, "allowed_data_access_labels", value)
|
|
327
|
+
|
|
328
|
+
@property
|
|
329
|
+
@pulumi.getter
|
|
330
|
+
def author(self) -> Optional[pulumi.Input[str]]:
|
|
331
|
+
"""
|
|
332
|
+
Output only. The user who created the data access scope.
|
|
333
|
+
"""
|
|
334
|
+
return pulumi.get(self, "author")
|
|
335
|
+
|
|
336
|
+
@author.setter
|
|
337
|
+
def author(self, value: Optional[pulumi.Input[str]]):
|
|
338
|
+
pulumi.set(self, "author", value)
|
|
339
|
+
|
|
340
|
+
@property
|
|
341
|
+
@pulumi.getter(name="createTime")
|
|
342
|
+
def create_time(self) -> Optional[pulumi.Input[str]]:
|
|
343
|
+
"""
|
|
344
|
+
Output only. The time at which the data access scope was created.
|
|
345
|
+
"""
|
|
346
|
+
return pulumi.get(self, "create_time")
|
|
347
|
+
|
|
348
|
+
@create_time.setter
|
|
349
|
+
def create_time(self, value: Optional[pulumi.Input[str]]):
|
|
350
|
+
pulumi.set(self, "create_time", value)
|
|
351
|
+
|
|
352
|
+
@property
|
|
353
|
+
@pulumi.getter(name="dataAccessScopeId")
|
|
354
|
+
def data_access_scope_id(self) -> Optional[pulumi.Input[str]]:
|
|
355
|
+
"""
|
|
356
|
+
Required. The user provided scope id which will become the last part of the name
|
|
357
|
+
of the scope resource.
|
|
358
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
359
|
+
|
|
360
|
+
|
|
361
|
+
- - -
|
|
362
|
+
"""
|
|
363
|
+
return pulumi.get(self, "data_access_scope_id")
|
|
364
|
+
|
|
365
|
+
@data_access_scope_id.setter
|
|
366
|
+
def data_access_scope_id(self, value: Optional[pulumi.Input[str]]):
|
|
367
|
+
pulumi.set(self, "data_access_scope_id", value)
|
|
368
|
+
|
|
369
|
+
@property
|
|
370
|
+
@pulumi.getter(name="deniedDataAccessLabels")
|
|
371
|
+
def denied_data_access_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]]:
|
|
372
|
+
"""
|
|
373
|
+
Optional. The denied labels for the scope.
|
|
374
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
375
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
376
|
+
to see data labeled with A and data labeled with B
|
|
377
|
+
and data with labels A and B.
|
|
378
|
+
Structure is documented below.
|
|
379
|
+
"""
|
|
380
|
+
return pulumi.get(self, "denied_data_access_labels")
|
|
381
|
+
|
|
382
|
+
@denied_data_access_labels.setter
|
|
383
|
+
def denied_data_access_labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DataAccessScopeDeniedDataAccessLabelArgs']]]]):
|
|
384
|
+
pulumi.set(self, "denied_data_access_labels", value)
|
|
385
|
+
|
|
386
|
+
@property
|
|
387
|
+
@pulumi.getter
|
|
388
|
+
def description(self) -> Optional[pulumi.Input[str]]:
|
|
389
|
+
"""
|
|
390
|
+
Optional. A description of the data access scope for a human reader.
|
|
391
|
+
"""
|
|
392
|
+
return pulumi.get(self, "description")
|
|
393
|
+
|
|
394
|
+
@description.setter
|
|
395
|
+
def description(self, value: Optional[pulumi.Input[str]]):
|
|
396
|
+
pulumi.set(self, "description", value)
|
|
397
|
+
|
|
398
|
+
@property
|
|
399
|
+
@pulumi.getter(name="displayName")
|
|
400
|
+
def display_name(self) -> Optional[pulumi.Input[str]]:
|
|
401
|
+
"""
|
|
402
|
+
Output only. The name to be used for display to customers of the data access scope.
|
|
403
|
+
"""
|
|
404
|
+
return pulumi.get(self, "display_name")
|
|
405
|
+
|
|
406
|
+
@display_name.setter
|
|
407
|
+
def display_name(self, value: Optional[pulumi.Input[str]]):
|
|
408
|
+
pulumi.set(self, "display_name", value)
|
|
409
|
+
|
|
410
|
+
@property
|
|
411
|
+
@pulumi.getter
|
|
412
|
+
def instance(self) -> Optional[pulumi.Input[str]]:
|
|
413
|
+
"""
|
|
414
|
+
The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
415
|
+
"""
|
|
416
|
+
return pulumi.get(self, "instance")
|
|
417
|
+
|
|
418
|
+
@instance.setter
|
|
419
|
+
def instance(self, value: Optional[pulumi.Input[str]]):
|
|
420
|
+
pulumi.set(self, "instance", value)
|
|
421
|
+
|
|
422
|
+
@property
|
|
423
|
+
@pulumi.getter(name="lastEditor")
|
|
424
|
+
def last_editor(self) -> Optional[pulumi.Input[str]]:
|
|
425
|
+
"""
|
|
426
|
+
Output only. The user who last updated the data access scope.
|
|
427
|
+
"""
|
|
428
|
+
return pulumi.get(self, "last_editor")
|
|
429
|
+
|
|
430
|
+
@last_editor.setter
|
|
431
|
+
def last_editor(self, value: Optional[pulumi.Input[str]]):
|
|
432
|
+
pulumi.set(self, "last_editor", value)
|
|
433
|
+
|
|
434
|
+
@property
|
|
435
|
+
@pulumi.getter
|
|
436
|
+
def location(self) -> Optional[pulumi.Input[str]]:
|
|
437
|
+
"""
|
|
438
|
+
The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
439
|
+
"""
|
|
440
|
+
return pulumi.get(self, "location")
|
|
441
|
+
|
|
442
|
+
@location.setter
|
|
443
|
+
def location(self, value: Optional[pulumi.Input[str]]):
|
|
444
|
+
pulumi.set(self, "location", value)
|
|
445
|
+
|
|
446
|
+
@property
|
|
447
|
+
@pulumi.getter
|
|
448
|
+
def name(self) -> Optional[pulumi.Input[str]]:
|
|
449
|
+
"""
|
|
450
|
+
The unique full name of the data access scope. This unique identifier is generated using values provided for the URL parameters.
|
|
451
|
+
Format:
|
|
452
|
+
projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{data_access_scope_id}
|
|
453
|
+
"""
|
|
454
|
+
return pulumi.get(self, "name")
|
|
455
|
+
|
|
456
|
+
@name.setter
|
|
457
|
+
def name(self, value: Optional[pulumi.Input[str]]):
|
|
458
|
+
pulumi.set(self, "name", value)
|
|
459
|
+
|
|
460
|
+
@property
|
|
461
|
+
@pulumi.getter
|
|
462
|
+
def project(self) -> Optional[pulumi.Input[str]]:
|
|
463
|
+
"""
|
|
464
|
+
The ID of the project in which the resource belongs.
|
|
465
|
+
If it is not provided, the provider project is used.
|
|
466
|
+
"""
|
|
467
|
+
return pulumi.get(self, "project")
|
|
468
|
+
|
|
469
|
+
@project.setter
|
|
470
|
+
def project(self, value: Optional[pulumi.Input[str]]):
|
|
471
|
+
pulumi.set(self, "project", value)
|
|
472
|
+
|
|
473
|
+
@property
|
|
474
|
+
@pulumi.getter(name="updateTime")
|
|
475
|
+
def update_time(self) -> Optional[pulumi.Input[str]]:
|
|
476
|
+
"""
|
|
477
|
+
Output only. The time at which the data access scope was last updated.
|
|
478
|
+
"""
|
|
479
|
+
return pulumi.get(self, "update_time")
|
|
480
|
+
|
|
481
|
+
@update_time.setter
|
|
482
|
+
def update_time(self, value: Optional[pulumi.Input[str]]):
|
|
483
|
+
pulumi.set(self, "update_time", value)
|
|
484
|
+
|
|
485
|
+
|
|
486
|
+
class DataAccessScope(pulumi.CustomResource):
|
|
487
|
+
@overload
|
|
488
|
+
def __init__(__self__,
|
|
489
|
+
resource_name: str,
|
|
490
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
491
|
+
allow_all: Optional[pulumi.Input[bool]] = None,
|
|
492
|
+
allowed_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeAllowedDataAccessLabelArgs', 'DataAccessScopeAllowedDataAccessLabelArgsDict']]]]] = None,
|
|
493
|
+
data_access_scope_id: Optional[pulumi.Input[str]] = None,
|
|
494
|
+
denied_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeDeniedDataAccessLabelArgs', 'DataAccessScopeDeniedDataAccessLabelArgsDict']]]]] = None,
|
|
495
|
+
description: Optional[pulumi.Input[str]] = None,
|
|
496
|
+
instance: Optional[pulumi.Input[str]] = None,
|
|
497
|
+
location: Optional[pulumi.Input[str]] = None,
|
|
498
|
+
project: Optional[pulumi.Input[str]] = None,
|
|
499
|
+
__props__=None):
|
|
500
|
+
"""
|
|
501
|
+
## Example Usage
|
|
502
|
+
|
|
503
|
+
### Chronicle Dataaccessscope With Logtype
|
|
504
|
+
|
|
505
|
+
```python
|
|
506
|
+
import pulumi
|
|
507
|
+
import pulumi_gcp as gcp
|
|
508
|
+
|
|
509
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
510
|
+
location="us",
|
|
511
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
512
|
+
data_access_scope_id="scope-id",
|
|
513
|
+
description="scope-description",
|
|
514
|
+
allowed_data_access_labels=[
|
|
515
|
+
{
|
|
516
|
+
"log_type": "GCP_CLOUDAUDIT",
|
|
517
|
+
},
|
|
518
|
+
{
|
|
519
|
+
"log_type": "GITHUB",
|
|
520
|
+
},
|
|
521
|
+
])
|
|
522
|
+
```
|
|
523
|
+
### Chronicle Dataaccessscope With Dataaccesslabel
|
|
524
|
+
|
|
525
|
+
```python
|
|
526
|
+
import pulumi
|
|
527
|
+
import pulumi_gcp as gcp
|
|
528
|
+
|
|
529
|
+
custom_data_access_label = gcp.chronicle.DataAccessLabel("custom_data_access_label",
|
|
530
|
+
location="us",
|
|
531
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
532
|
+
data_access_label_id="label-id",
|
|
533
|
+
udm_query="principal.hostname=\\"google.com\\"")
|
|
534
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
535
|
+
location="us",
|
|
536
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
537
|
+
data_access_scope_id="scope-id",
|
|
538
|
+
description="scope-description",
|
|
539
|
+
allowed_data_access_labels=[{
|
|
540
|
+
"data_access_label": google_chronicle_data_access_label["customDataAccessLabel"]["dataAccessLabelId"],
|
|
541
|
+
}])
|
|
542
|
+
```
|
|
543
|
+
### Chronicle Dataaccessscope With Asset Namespace
|
|
544
|
+
|
|
545
|
+
```python
|
|
546
|
+
import pulumi
|
|
547
|
+
import pulumi_gcp as gcp
|
|
548
|
+
|
|
549
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
550
|
+
location="us",
|
|
551
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
552
|
+
data_access_scope_id="scope-id",
|
|
553
|
+
description="scope-description",
|
|
554
|
+
allowed_data_access_labels=[{
|
|
555
|
+
"asset_namespace": "my-namespace",
|
|
556
|
+
}])
|
|
557
|
+
```
|
|
558
|
+
### Chronicle Dataaccessscope With Ingestion Label
|
|
559
|
+
|
|
560
|
+
```python
|
|
561
|
+
import pulumi
|
|
562
|
+
import pulumi_gcp as gcp
|
|
563
|
+
|
|
564
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
565
|
+
location="us",
|
|
566
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
567
|
+
data_access_scope_id="scope-id",
|
|
568
|
+
description="scope-description",
|
|
569
|
+
allowed_data_access_labels=[{
|
|
570
|
+
"ingestion_label": {
|
|
571
|
+
"ingestion_label_key": "ingestion_key",
|
|
572
|
+
"ingestion_label_value": "ingestion_value",
|
|
573
|
+
},
|
|
574
|
+
}])
|
|
575
|
+
```
|
|
576
|
+
### Chronicle Dataaccessscope With Denied Labels
|
|
577
|
+
|
|
578
|
+
```python
|
|
579
|
+
import pulumi
|
|
580
|
+
import pulumi_gcp as gcp
|
|
581
|
+
|
|
582
|
+
custom_data_access_label = gcp.chronicle.DataAccessLabel("custom_data_access_label",
|
|
583
|
+
location="us",
|
|
584
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
585
|
+
data_access_label_id="label-id",
|
|
586
|
+
udm_query="principal.hostname=\\"google.com\\"")
|
|
587
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
588
|
+
location="us",
|
|
589
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
590
|
+
data_access_scope_id="scope-id",
|
|
591
|
+
description="scope-description",
|
|
592
|
+
allow_all=True,
|
|
593
|
+
denied_data_access_labels=[
|
|
594
|
+
{
|
|
595
|
+
"log_type": "GCP_CLOUDAUDIT",
|
|
596
|
+
},
|
|
597
|
+
{
|
|
598
|
+
"data_access_label": google_chronicle_data_access_label["customDataAccessLabel"]["dataAccessLabelId"],
|
|
599
|
+
},
|
|
600
|
+
{
|
|
601
|
+
"ingestion_label": {
|
|
602
|
+
"ingestion_label_key": "ingestion_key",
|
|
603
|
+
"ingestion_label_value": "ingestion_value",
|
|
604
|
+
},
|
|
605
|
+
},
|
|
606
|
+
{
|
|
607
|
+
"asset_namespace": "my-namespace",
|
|
608
|
+
},
|
|
609
|
+
])
|
|
610
|
+
```
|
|
611
|
+
|
|
612
|
+
## Import
|
|
613
|
+
|
|
614
|
+
DataAccessScope can be imported using any of these accepted formats:
|
|
615
|
+
|
|
616
|
+
* `projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}`
|
|
617
|
+
|
|
618
|
+
* `{{project}}/{{location}}/{{instance}}/{{data_access_scope_id}}`
|
|
619
|
+
|
|
620
|
+
* `{{location}}/{{instance}}/{{data_access_scope_id}}`
|
|
621
|
+
|
|
622
|
+
When using the `pulumi import` command, DataAccessScope can be imported using one of the formats above. For example:
|
|
623
|
+
|
|
624
|
+
```sh
|
|
625
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}
|
|
626
|
+
```
|
|
627
|
+
|
|
628
|
+
```sh
|
|
629
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default {{project}}/{{location}}/{{instance}}/{{data_access_scope_id}}
|
|
630
|
+
```
|
|
631
|
+
|
|
632
|
+
```sh
|
|
633
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default {{location}}/{{instance}}/{{data_access_scope_id}}
|
|
634
|
+
```
|
|
635
|
+
|
|
636
|
+
:param str resource_name: The name of the resource.
|
|
637
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
638
|
+
:param pulumi.Input[bool] allow_all: Optional. Whether or not the scope allows all labels, allow_all and
|
|
639
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
640
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
641
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
642
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
643
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
644
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
645
|
+
with labels A and B.
|
|
646
|
+
:param pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeAllowedDataAccessLabelArgs', 'DataAccessScopeAllowedDataAccessLabelArgsDict']]]] allowed_data_access_labels: The allowed labels for the scope. There has to be at
|
|
647
|
+
least one label allowed for the scope to be valid.
|
|
648
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
649
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
650
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
651
|
+
to see data with labeled with A or B or (A and B).
|
|
652
|
+
Structure is documented below.
|
|
653
|
+
:param pulumi.Input[str] data_access_scope_id: Required. The user provided scope id which will become the last part of the name
|
|
654
|
+
of the scope resource.
|
|
655
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
656
|
+
|
|
657
|
+
|
|
658
|
+
- - -
|
|
659
|
+
:param pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeDeniedDataAccessLabelArgs', 'DataAccessScopeDeniedDataAccessLabelArgsDict']]]] denied_data_access_labels: Optional. The denied labels for the scope.
|
|
660
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
661
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
662
|
+
to see data labeled with A and data labeled with B
|
|
663
|
+
and data with labels A and B.
|
|
664
|
+
Structure is documented below.
|
|
665
|
+
:param pulumi.Input[str] description: Optional. A description of the data access scope for a human reader.
|
|
666
|
+
:param pulumi.Input[str] instance: The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
667
|
+
:param pulumi.Input[str] location: The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
668
|
+
:param pulumi.Input[str] project: The ID of the project in which the resource belongs.
|
|
669
|
+
If it is not provided, the provider project is used.
|
|
670
|
+
"""
|
|
671
|
+
...
|
|
672
|
+
@overload
|
|
673
|
+
def __init__(__self__,
|
|
674
|
+
resource_name: str,
|
|
675
|
+
args: DataAccessScopeArgs,
|
|
676
|
+
opts: Optional[pulumi.ResourceOptions] = None):
|
|
677
|
+
"""
|
|
678
|
+
## Example Usage
|
|
679
|
+
|
|
680
|
+
### Chronicle Dataaccessscope With Logtype
|
|
681
|
+
|
|
682
|
+
```python
|
|
683
|
+
import pulumi
|
|
684
|
+
import pulumi_gcp as gcp
|
|
685
|
+
|
|
686
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
687
|
+
location="us",
|
|
688
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
689
|
+
data_access_scope_id="scope-id",
|
|
690
|
+
description="scope-description",
|
|
691
|
+
allowed_data_access_labels=[
|
|
692
|
+
{
|
|
693
|
+
"log_type": "GCP_CLOUDAUDIT",
|
|
694
|
+
},
|
|
695
|
+
{
|
|
696
|
+
"log_type": "GITHUB",
|
|
697
|
+
},
|
|
698
|
+
])
|
|
699
|
+
```
|
|
700
|
+
### Chronicle Dataaccessscope With Dataaccesslabel
|
|
701
|
+
|
|
702
|
+
```python
|
|
703
|
+
import pulumi
|
|
704
|
+
import pulumi_gcp as gcp
|
|
705
|
+
|
|
706
|
+
custom_data_access_label = gcp.chronicle.DataAccessLabel("custom_data_access_label",
|
|
707
|
+
location="us",
|
|
708
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
709
|
+
data_access_label_id="label-id",
|
|
710
|
+
udm_query="principal.hostname=\\"google.com\\"")
|
|
711
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
712
|
+
location="us",
|
|
713
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
714
|
+
data_access_scope_id="scope-id",
|
|
715
|
+
description="scope-description",
|
|
716
|
+
allowed_data_access_labels=[{
|
|
717
|
+
"data_access_label": google_chronicle_data_access_label["customDataAccessLabel"]["dataAccessLabelId"],
|
|
718
|
+
}])
|
|
719
|
+
```
|
|
720
|
+
### Chronicle Dataaccessscope With Asset Namespace
|
|
721
|
+
|
|
722
|
+
```python
|
|
723
|
+
import pulumi
|
|
724
|
+
import pulumi_gcp as gcp
|
|
725
|
+
|
|
726
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
727
|
+
location="us",
|
|
728
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
729
|
+
data_access_scope_id="scope-id",
|
|
730
|
+
description="scope-description",
|
|
731
|
+
allowed_data_access_labels=[{
|
|
732
|
+
"asset_namespace": "my-namespace",
|
|
733
|
+
}])
|
|
734
|
+
```
|
|
735
|
+
### Chronicle Dataaccessscope With Ingestion Label
|
|
736
|
+
|
|
737
|
+
```python
|
|
738
|
+
import pulumi
|
|
739
|
+
import pulumi_gcp as gcp
|
|
740
|
+
|
|
741
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
742
|
+
location="us",
|
|
743
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
744
|
+
data_access_scope_id="scope-id",
|
|
745
|
+
description="scope-description",
|
|
746
|
+
allowed_data_access_labels=[{
|
|
747
|
+
"ingestion_label": {
|
|
748
|
+
"ingestion_label_key": "ingestion_key",
|
|
749
|
+
"ingestion_label_value": "ingestion_value",
|
|
750
|
+
},
|
|
751
|
+
}])
|
|
752
|
+
```
|
|
753
|
+
### Chronicle Dataaccessscope With Denied Labels
|
|
754
|
+
|
|
755
|
+
```python
|
|
756
|
+
import pulumi
|
|
757
|
+
import pulumi_gcp as gcp
|
|
758
|
+
|
|
759
|
+
custom_data_access_label = gcp.chronicle.DataAccessLabel("custom_data_access_label",
|
|
760
|
+
location="us",
|
|
761
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
762
|
+
data_access_label_id="label-id",
|
|
763
|
+
udm_query="principal.hostname=\\"google.com\\"")
|
|
764
|
+
example = gcp.chronicle.DataAccessScope("example",
|
|
765
|
+
location="us",
|
|
766
|
+
instance="00000000-0000-0000-0000-000000000000",
|
|
767
|
+
data_access_scope_id="scope-id",
|
|
768
|
+
description="scope-description",
|
|
769
|
+
allow_all=True,
|
|
770
|
+
denied_data_access_labels=[
|
|
771
|
+
{
|
|
772
|
+
"log_type": "GCP_CLOUDAUDIT",
|
|
773
|
+
},
|
|
774
|
+
{
|
|
775
|
+
"data_access_label": google_chronicle_data_access_label["customDataAccessLabel"]["dataAccessLabelId"],
|
|
776
|
+
},
|
|
777
|
+
{
|
|
778
|
+
"ingestion_label": {
|
|
779
|
+
"ingestion_label_key": "ingestion_key",
|
|
780
|
+
"ingestion_label_value": "ingestion_value",
|
|
781
|
+
},
|
|
782
|
+
},
|
|
783
|
+
{
|
|
784
|
+
"asset_namespace": "my-namespace",
|
|
785
|
+
},
|
|
786
|
+
])
|
|
787
|
+
```
|
|
788
|
+
|
|
789
|
+
## Import
|
|
790
|
+
|
|
791
|
+
DataAccessScope can be imported using any of these accepted formats:
|
|
792
|
+
|
|
793
|
+
* `projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}`
|
|
794
|
+
|
|
795
|
+
* `{{project}}/{{location}}/{{instance}}/{{data_access_scope_id}}`
|
|
796
|
+
|
|
797
|
+
* `{{location}}/{{instance}}/{{data_access_scope_id}}`
|
|
798
|
+
|
|
799
|
+
When using the `pulumi import` command, DataAccessScope can be imported using one of the formats above. For example:
|
|
800
|
+
|
|
801
|
+
```sh
|
|
802
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}
|
|
803
|
+
```
|
|
804
|
+
|
|
805
|
+
```sh
|
|
806
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default {{project}}/{{location}}/{{instance}}/{{data_access_scope_id}}
|
|
807
|
+
```
|
|
808
|
+
|
|
809
|
+
```sh
|
|
810
|
+
$ pulumi import gcp:chronicle/dataAccessScope:DataAccessScope default {{location}}/{{instance}}/{{data_access_scope_id}}
|
|
811
|
+
```
|
|
812
|
+
|
|
813
|
+
:param str resource_name: The name of the resource.
|
|
814
|
+
:param DataAccessScopeArgs args: The arguments to use to populate this resource's properties.
|
|
815
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
816
|
+
"""
|
|
817
|
+
...
|
|
818
|
+
def __init__(__self__, resource_name: str, *args, **kwargs):
|
|
819
|
+
resource_args, opts = _utilities.get_resource_args_opts(DataAccessScopeArgs, pulumi.ResourceOptions, *args, **kwargs)
|
|
820
|
+
if resource_args is not None:
|
|
821
|
+
__self__._internal_init(resource_name, opts, **resource_args.__dict__)
|
|
822
|
+
else:
|
|
823
|
+
__self__._internal_init(resource_name, *args, **kwargs)
|
|
824
|
+
|
|
825
|
+
def _internal_init(__self__,
|
|
826
|
+
resource_name: str,
|
|
827
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
828
|
+
allow_all: Optional[pulumi.Input[bool]] = None,
|
|
829
|
+
allowed_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeAllowedDataAccessLabelArgs', 'DataAccessScopeAllowedDataAccessLabelArgsDict']]]]] = None,
|
|
830
|
+
data_access_scope_id: Optional[pulumi.Input[str]] = None,
|
|
831
|
+
denied_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeDeniedDataAccessLabelArgs', 'DataAccessScopeDeniedDataAccessLabelArgsDict']]]]] = None,
|
|
832
|
+
description: Optional[pulumi.Input[str]] = None,
|
|
833
|
+
instance: Optional[pulumi.Input[str]] = None,
|
|
834
|
+
location: Optional[pulumi.Input[str]] = None,
|
|
835
|
+
project: Optional[pulumi.Input[str]] = None,
|
|
836
|
+
__props__=None):
|
|
837
|
+
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
838
|
+
if not isinstance(opts, pulumi.ResourceOptions):
|
|
839
|
+
raise TypeError('Expected resource options to be a ResourceOptions instance')
|
|
840
|
+
if opts.id is None:
|
|
841
|
+
if __props__ is not None:
|
|
842
|
+
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
843
|
+
__props__ = DataAccessScopeArgs.__new__(DataAccessScopeArgs)
|
|
844
|
+
|
|
845
|
+
__props__.__dict__["allow_all"] = allow_all
|
|
846
|
+
__props__.__dict__["allowed_data_access_labels"] = allowed_data_access_labels
|
|
847
|
+
if data_access_scope_id is None and not opts.urn:
|
|
848
|
+
raise TypeError("Missing required property 'data_access_scope_id'")
|
|
849
|
+
__props__.__dict__["data_access_scope_id"] = data_access_scope_id
|
|
850
|
+
__props__.__dict__["denied_data_access_labels"] = denied_data_access_labels
|
|
851
|
+
__props__.__dict__["description"] = description
|
|
852
|
+
if instance is None and not opts.urn:
|
|
853
|
+
raise TypeError("Missing required property 'instance'")
|
|
854
|
+
__props__.__dict__["instance"] = instance
|
|
855
|
+
if location is None and not opts.urn:
|
|
856
|
+
raise TypeError("Missing required property 'location'")
|
|
857
|
+
__props__.__dict__["location"] = location
|
|
858
|
+
__props__.__dict__["project"] = project
|
|
859
|
+
__props__.__dict__["author"] = None
|
|
860
|
+
__props__.__dict__["create_time"] = None
|
|
861
|
+
__props__.__dict__["display_name"] = None
|
|
862
|
+
__props__.__dict__["last_editor"] = None
|
|
863
|
+
__props__.__dict__["name"] = None
|
|
864
|
+
__props__.__dict__["update_time"] = None
|
|
865
|
+
super(DataAccessScope, __self__).__init__(
|
|
866
|
+
'gcp:chronicle/dataAccessScope:DataAccessScope',
|
|
867
|
+
resource_name,
|
|
868
|
+
__props__,
|
|
869
|
+
opts)
|
|
870
|
+
|
|
871
|
+
@staticmethod
|
|
872
|
+
def get(resource_name: str,
|
|
873
|
+
id: pulumi.Input[str],
|
|
874
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
875
|
+
allow_all: Optional[pulumi.Input[bool]] = None,
|
|
876
|
+
allowed_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeAllowedDataAccessLabelArgs', 'DataAccessScopeAllowedDataAccessLabelArgsDict']]]]] = None,
|
|
877
|
+
author: Optional[pulumi.Input[str]] = None,
|
|
878
|
+
create_time: Optional[pulumi.Input[str]] = None,
|
|
879
|
+
data_access_scope_id: Optional[pulumi.Input[str]] = None,
|
|
880
|
+
denied_data_access_labels: Optional[pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeDeniedDataAccessLabelArgs', 'DataAccessScopeDeniedDataAccessLabelArgsDict']]]]] = None,
|
|
881
|
+
description: Optional[pulumi.Input[str]] = None,
|
|
882
|
+
display_name: Optional[pulumi.Input[str]] = None,
|
|
883
|
+
instance: Optional[pulumi.Input[str]] = None,
|
|
884
|
+
last_editor: Optional[pulumi.Input[str]] = None,
|
|
885
|
+
location: Optional[pulumi.Input[str]] = None,
|
|
886
|
+
name: Optional[pulumi.Input[str]] = None,
|
|
887
|
+
project: Optional[pulumi.Input[str]] = None,
|
|
888
|
+
update_time: Optional[pulumi.Input[str]] = None) -> 'DataAccessScope':
|
|
889
|
+
"""
|
|
890
|
+
Get an existing DataAccessScope resource's state with the given name, id, and optional extra
|
|
891
|
+
properties used to qualify the lookup.
|
|
892
|
+
|
|
893
|
+
:param str resource_name: The unique name of the resulting resource.
|
|
894
|
+
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
895
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
896
|
+
:param pulumi.Input[bool] allow_all: Optional. Whether or not the scope allows all labels, allow_all and
|
|
897
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
898
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
899
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
900
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
901
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
902
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
903
|
+
with labels A and B.
|
|
904
|
+
:param pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeAllowedDataAccessLabelArgs', 'DataAccessScopeAllowedDataAccessLabelArgsDict']]]] allowed_data_access_labels: The allowed labels for the scope. There has to be at
|
|
905
|
+
least one label allowed for the scope to be valid.
|
|
906
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
907
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
908
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
909
|
+
to see data with labeled with A or B or (A and B).
|
|
910
|
+
Structure is documented below.
|
|
911
|
+
:param pulumi.Input[str] author: Output only. The user who created the data access scope.
|
|
912
|
+
:param pulumi.Input[str] create_time: Output only. The time at which the data access scope was created.
|
|
913
|
+
:param pulumi.Input[str] data_access_scope_id: Required. The user provided scope id which will become the last part of the name
|
|
914
|
+
of the scope resource.
|
|
915
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
916
|
+
|
|
917
|
+
|
|
918
|
+
- - -
|
|
919
|
+
:param pulumi.Input[Sequence[pulumi.Input[Union['DataAccessScopeDeniedDataAccessLabelArgs', 'DataAccessScopeDeniedDataAccessLabelArgsDict']]]] denied_data_access_labels: Optional. The denied labels for the scope.
|
|
920
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
921
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
922
|
+
to see data labeled with A and data labeled with B
|
|
923
|
+
and data with labels A and B.
|
|
924
|
+
Structure is documented below.
|
|
925
|
+
:param pulumi.Input[str] description: Optional. A description of the data access scope for a human reader.
|
|
926
|
+
:param pulumi.Input[str] display_name: Output only. The name to be used for display to customers of the data access scope.
|
|
927
|
+
:param pulumi.Input[str] instance: The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
928
|
+
:param pulumi.Input[str] last_editor: Output only. The user who last updated the data access scope.
|
|
929
|
+
:param pulumi.Input[str] location: The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
930
|
+
:param pulumi.Input[str] name: The unique full name of the data access scope. This unique identifier is generated using values provided for the URL parameters.
|
|
931
|
+
Format:
|
|
932
|
+
projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{data_access_scope_id}
|
|
933
|
+
:param pulumi.Input[str] project: The ID of the project in which the resource belongs.
|
|
934
|
+
If it is not provided, the provider project is used.
|
|
935
|
+
:param pulumi.Input[str] update_time: Output only. The time at which the data access scope was last updated.
|
|
936
|
+
"""
|
|
937
|
+
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
938
|
+
|
|
939
|
+
__props__ = _DataAccessScopeState.__new__(_DataAccessScopeState)
|
|
940
|
+
|
|
941
|
+
__props__.__dict__["allow_all"] = allow_all
|
|
942
|
+
__props__.__dict__["allowed_data_access_labels"] = allowed_data_access_labels
|
|
943
|
+
__props__.__dict__["author"] = author
|
|
944
|
+
__props__.__dict__["create_time"] = create_time
|
|
945
|
+
__props__.__dict__["data_access_scope_id"] = data_access_scope_id
|
|
946
|
+
__props__.__dict__["denied_data_access_labels"] = denied_data_access_labels
|
|
947
|
+
__props__.__dict__["description"] = description
|
|
948
|
+
__props__.__dict__["display_name"] = display_name
|
|
949
|
+
__props__.__dict__["instance"] = instance
|
|
950
|
+
__props__.__dict__["last_editor"] = last_editor
|
|
951
|
+
__props__.__dict__["location"] = location
|
|
952
|
+
__props__.__dict__["name"] = name
|
|
953
|
+
__props__.__dict__["project"] = project
|
|
954
|
+
__props__.__dict__["update_time"] = update_time
|
|
955
|
+
return DataAccessScope(resource_name, opts=opts, __props__=__props__)
|
|
956
|
+
|
|
957
|
+
@property
|
|
958
|
+
@pulumi.getter(name="allowAll")
|
|
959
|
+
def allow_all(self) -> pulumi.Output[Optional[bool]]:
|
|
960
|
+
"""
|
|
961
|
+
Optional. Whether or not the scope allows all labels, allow_all and
|
|
962
|
+
allowed_data_access_labels are mutually exclusive and one of them must be
|
|
963
|
+
present. denied_data_access_labels can still be used along with allow_all.
|
|
964
|
+
When combined with denied_data_access_labels, access will be granted to all
|
|
965
|
+
data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
|
|
966
|
+
A customer with scope with denied labels A and B and allow_all will be able
|
|
967
|
+
to see all data except data labeled with A and data labeled with B and data
|
|
968
|
+
with labels A and B.
|
|
969
|
+
"""
|
|
970
|
+
return pulumi.get(self, "allow_all")
|
|
971
|
+
|
|
972
|
+
@property
|
|
973
|
+
@pulumi.getter(name="allowedDataAccessLabels")
|
|
974
|
+
def allowed_data_access_labels(self) -> pulumi.Output[Optional[Sequence['outputs.DataAccessScopeAllowedDataAccessLabel']]]:
|
|
975
|
+
"""
|
|
976
|
+
The allowed labels for the scope. There has to be at
|
|
977
|
+
least one label allowed for the scope to be valid.
|
|
978
|
+
The logical operator for evaluation of the allowed labels is OR.
|
|
979
|
+
Either allow_all or allowed_data_access_labels needs to be provided.
|
|
980
|
+
E.g.: A customer with scope with allowed labels A and B will be able
|
|
981
|
+
to see data with labeled with A or B or (A and B).
|
|
982
|
+
Structure is documented below.
|
|
983
|
+
"""
|
|
984
|
+
return pulumi.get(self, "allowed_data_access_labels")
|
|
985
|
+
|
|
986
|
+
@property
|
|
987
|
+
@pulumi.getter
|
|
988
|
+
def author(self) -> pulumi.Output[str]:
|
|
989
|
+
"""
|
|
990
|
+
Output only. The user who created the data access scope.
|
|
991
|
+
"""
|
|
992
|
+
return pulumi.get(self, "author")
|
|
993
|
+
|
|
994
|
+
@property
|
|
995
|
+
@pulumi.getter(name="createTime")
|
|
996
|
+
def create_time(self) -> pulumi.Output[str]:
|
|
997
|
+
"""
|
|
998
|
+
Output only. The time at which the data access scope was created.
|
|
999
|
+
"""
|
|
1000
|
+
return pulumi.get(self, "create_time")
|
|
1001
|
+
|
|
1002
|
+
@property
|
|
1003
|
+
@pulumi.getter(name="dataAccessScopeId")
|
|
1004
|
+
def data_access_scope_id(self) -> pulumi.Output[str]:
|
|
1005
|
+
"""
|
|
1006
|
+
Required. The user provided scope id which will become the last part of the name
|
|
1007
|
+
of the scope resource.
|
|
1008
|
+
Needs to be compliant with https://google.aip.dev/122
|
|
1009
|
+
|
|
1010
|
+
|
|
1011
|
+
- - -
|
|
1012
|
+
"""
|
|
1013
|
+
return pulumi.get(self, "data_access_scope_id")
|
|
1014
|
+
|
|
1015
|
+
@property
|
|
1016
|
+
@pulumi.getter(name="deniedDataAccessLabels")
|
|
1017
|
+
def denied_data_access_labels(self) -> pulumi.Output[Optional[Sequence['outputs.DataAccessScopeDeniedDataAccessLabel']]]:
|
|
1018
|
+
"""
|
|
1019
|
+
Optional. The denied labels for the scope.
|
|
1020
|
+
The logical operator for evaluation of the denied labels is AND.
|
|
1021
|
+
E.g.: A customer with scope with denied labels A and B won't be able
|
|
1022
|
+
to see data labeled with A and data labeled with B
|
|
1023
|
+
and data with labels A and B.
|
|
1024
|
+
Structure is documented below.
|
|
1025
|
+
"""
|
|
1026
|
+
return pulumi.get(self, "denied_data_access_labels")
|
|
1027
|
+
|
|
1028
|
+
@property
|
|
1029
|
+
@pulumi.getter
|
|
1030
|
+
def description(self) -> pulumi.Output[Optional[str]]:
|
|
1031
|
+
"""
|
|
1032
|
+
Optional. A description of the data access scope for a human reader.
|
|
1033
|
+
"""
|
|
1034
|
+
return pulumi.get(self, "description")
|
|
1035
|
+
|
|
1036
|
+
@property
|
|
1037
|
+
@pulumi.getter(name="displayName")
|
|
1038
|
+
def display_name(self) -> pulumi.Output[str]:
|
|
1039
|
+
"""
|
|
1040
|
+
Output only. The name to be used for display to customers of the data access scope.
|
|
1041
|
+
"""
|
|
1042
|
+
return pulumi.get(self, "display_name")
|
|
1043
|
+
|
|
1044
|
+
@property
|
|
1045
|
+
@pulumi.getter
|
|
1046
|
+
def instance(self) -> pulumi.Output[str]:
|
|
1047
|
+
"""
|
|
1048
|
+
The unique identifier for the Chronicle instance, which is the same as the customer ID.
|
|
1049
|
+
"""
|
|
1050
|
+
return pulumi.get(self, "instance")
|
|
1051
|
+
|
|
1052
|
+
@property
|
|
1053
|
+
@pulumi.getter(name="lastEditor")
|
|
1054
|
+
def last_editor(self) -> pulumi.Output[str]:
|
|
1055
|
+
"""
|
|
1056
|
+
Output only. The user who last updated the data access scope.
|
|
1057
|
+
"""
|
|
1058
|
+
return pulumi.get(self, "last_editor")
|
|
1059
|
+
|
|
1060
|
+
@property
|
|
1061
|
+
@pulumi.getter
|
|
1062
|
+
def location(self) -> pulumi.Output[str]:
|
|
1063
|
+
"""
|
|
1064
|
+
The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
|
|
1065
|
+
"""
|
|
1066
|
+
return pulumi.get(self, "location")
|
|
1067
|
+
|
|
1068
|
+
@property
|
|
1069
|
+
@pulumi.getter
|
|
1070
|
+
def name(self) -> pulumi.Output[str]:
|
|
1071
|
+
"""
|
|
1072
|
+
The unique full name of the data access scope. This unique identifier is generated using values provided for the URL parameters.
|
|
1073
|
+
Format:
|
|
1074
|
+
projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{data_access_scope_id}
|
|
1075
|
+
"""
|
|
1076
|
+
return pulumi.get(self, "name")
|
|
1077
|
+
|
|
1078
|
+
@property
|
|
1079
|
+
@pulumi.getter
|
|
1080
|
+
def project(self) -> pulumi.Output[str]:
|
|
1081
|
+
"""
|
|
1082
|
+
The ID of the project in which the resource belongs.
|
|
1083
|
+
If it is not provided, the provider project is used.
|
|
1084
|
+
"""
|
|
1085
|
+
return pulumi.get(self, "project")
|
|
1086
|
+
|
|
1087
|
+
@property
|
|
1088
|
+
@pulumi.getter(name="updateTime")
|
|
1089
|
+
def update_time(self) -> pulumi.Output[str]:
|
|
1090
|
+
"""
|
|
1091
|
+
Output only. The time at which the data access scope was last updated.
|
|
1092
|
+
"""
|
|
1093
|
+
return pulumi.get(self, "update_time")
|
|
1094
|
+
|