pulumi-gcp 8.18.0a1738650987__py3-none-any.whl → 8.18.0a1738676305__py3-none-any.whl

pulumi_gcp/secretmanager/regional_secret_version.py

@@ -342,6 +342,12 @@ class RegionalSecretVersion(pulumi.CustomResource):
         """
         A regional secret version resource.
 
+        To get more information about RegionalSecretVersion, see:
+
+        * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.locations.secrets.versions)
+        * How-to Guides
+            * [Create and deploy a Regional Secret Version](https://cloud.google.com/secret-manager/regional-secrets/add-secret-version-rs)
+
         ## Example Usage
 
         ### Regional Secret Version Basic
@@ -453,6 +459,12 @@ class RegionalSecretVersion(pulumi.CustomResource):
         """
         A regional secret version resource.
 
+        To get more information about RegionalSecretVersion, see:
+
+        * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.locations.secrets.versions)
+        * How-to Guides
+            * [Create and deploy a Regional Secret Version](https://cloud.google.com/secret-manager/regional-secrets/add-secret-version-rs)
+
         ## Example Usage
 
         ### Regional Secret Version Basic

pulumi_gcp/secretmanager/secret.py

@@ -583,6 +583,8 @@ class Secret(pulumi.CustomResource):
         To get more information about Secret, see:
 
         * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets)
+        * How-to Guides
+            * [Create and deploy a Secret](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets)
 
         ## Example Usage
 
@@ -743,6 +745,8 @@ class Secret(pulumi.CustomResource):
         To get more information about Secret, see:
 
         * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets)
+        * How-to Guides
+            * [Create and deploy a Secret](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets)
 
         ## Example Usage
 

pulumi_gcp/secretmanager/secret_version.py

@@ -306,6 +306,12 @@ class SecretVersion(pulumi.CustomResource):
         """
         A secret version resource.
 
+        To get more information about SecretVersion, see:
+
+        * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets.versions)
+        * How-to Guides
+            * [Create and deploy a Secret Version](https://cloud.google.com/secret-manager/docs/add-secret-version)
+
         ## Example Usage
 
         ### Secret Version Basic
@@ -426,6 +432,12 @@ class SecretVersion(pulumi.CustomResource):
         """
         A secret version resource.
 
+        To get more information about SecretVersion, see:
+
+        * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets.versions)
+        * How-to Guides
+            * [Create and deploy a Secret Version](https://cloud.google.com/secret-manager/docs/add-secret-version)
+
         ## Example Usage
 
         ### Secret Version Basic

pulumi_gcp/securityposture/posture.py

@@ -348,6 +348,8 @@ class Posture(pulumi.CustomResource):
         Every update to a deployed posture creates a new posture revision with an updated revision_id.
 
         To get more information about Posture, see:
+
+        * [API documentation](https://cloud.google.com/security-command-center/docs/reference/securityposture/rest/v1/Posture)
         * How-to Guides
             * [Create and deploy a posture](https://cloud.google.com/security-command-center/docs/how-to-use-security-posture)
 
@@ -499,6 +501,8 @@ class Posture(pulumi.CustomResource):
         Every update to a deployed posture creates a new posture revision with an updated revision_id.
 
         To get more information about Posture, see:
+
+        * [API documentation](https://cloud.google.com/security-command-center/docs/reference/securityposture/rest/v1/Posture)
         * How-to Guides
             * [Create and deploy a posture](https://cloud.google.com/security-command-center/docs/how-to-use-security-posture)
 

pulumi_gcp/securityposture/posture_deployment.py

@@ -459,6 +459,8 @@ class PostureDeployment(pulumi.CustomResource):
         on a resource.
 
         To get more information about PostureDeployment, see:
+
+        * [API documentation](https://cloud.google.com/security-command-center/docs/reference/securityposture/rest/v1/organizations.locations.postureDeployments)
         * How-to Guides
             * [Create and deploy a posture](https://cloud.google.com/security-command-center/docs/how-to-use-security-posture)
 
@@ -505,6 +507,8 @@ class PostureDeployment(pulumi.CustomResource):
         on a resource.
 
         To get more information about PostureDeployment, see:
+
+        * [API documentation](https://cloud.google.com/security-command-center/docs/reference/securityposture/rest/v1/organizations.locations.postureDeployments)
         * How-to Guides
             * [Create and deploy a posture](https://cloud.google.com/security-command-center/docs/how-to-use-security-posture)
 

pulumi_gcp/serviceaccount/get_s.py

@@ -27,16 +27,22 @@ class GetSResult:
     """
     A collection of values returned by getS.
     """
-    def __init__(__self__, accounts=None, id=None, project=None):
+    def __init__(__self__, accounts=None, id=None, prefix=None, project=None, regex=None):
         if accounts and not isinstance(accounts, list):
             raise TypeError("Expected argument 'accounts' to be a list")
         pulumi.set(__self__, "accounts", accounts)
         if id and not isinstance(id, str):
             raise TypeError("Expected argument 'id' to be a str")
         pulumi.set(__self__, "id", id)
+        if prefix and not isinstance(prefix, str):
+            raise TypeError("Expected argument 'prefix' to be a str")
+        pulumi.set(__self__, "prefix", prefix)
         if project and not isinstance(project, str):
             raise TypeError("Expected argument 'project' to be a str")
         pulumi.set(__self__, "project", project)
+        if regex and not isinstance(regex, str):
+            raise TypeError("Expected argument 'regex' to be a str")
+        pulumi.set(__self__, "regex", regex)
 
     @property
     @pulumi.getter
@@ -54,11 +60,21 @@ class GetSResult:
         """
         return pulumi.get(self, "id")
 
+    @property
+    @pulumi.getter
+    def prefix(self) -> Optional[str]:
+        return pulumi.get(self, "prefix")
+
     @property
     @pulumi.getter
     def project(self) -> Optional[str]:
         return pulumi.get(self, "project")
 
+    @property
+    @pulumi.getter
+    def regex(self) -> Optional[str]:
+        return pulumi.get(self, "regex")
+
 
 class AwaitableGetSResult(GetSResult):
     # pylint: disable=using-constant-test
@@ -68,10 +84,14 @@ class AwaitableGetSResult(GetSResult):
         return GetSResult(
             accounts=self.accounts,
             id=self.id,
-            project=self.project)
+            prefix=self.prefix,
+            project=self.project,
+            regex=self.regex)
 
 
-def get_s(project: Optional[str] = None,
+def get_s(prefix: Optional[str] = None,
+          project: Optional[str] = None,
+          regex: Optional[str] = None,
           opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetSResult:
     """
     Gets a list of all service accounts from a project.
@@ -80,7 +100,7 @@ def get_s(project: Optional[str] = None,
 
     ## Example Usage
 
-    Example service accounts.
+    Get all service accounts from a project
 
     ```python
     import pulumi
@@ -89,19 +109,55 @@ def get_s(project: Optional[str] = None,
     example = gcp.serviceaccount.get_s(project="example-project")
     ```
 
+    Get all service accounts that are prefixed with `"foo"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    foo = gcp.serviceaccount.get_s(prefix="foo")
+    ```
+
+    Get all service accounts that contain `"bar"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    bar = gcp.serviceaccount.get_s(regex=".*bar.*")
+    ```
+
+    Get all service accounts that are prefixed with `"foo"` and contain `"bar"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    foo_bar = gcp.serviceaccount.get_s(prefix="foo",
+        regex=".*bar.*")
+    ```
+
 
+    :param str prefix: A prefix for filtering. It's applied with the `account_id`.
     :param str project: The ID of the project. If it is not provided, the provider project is used.
+    :param str regex: A regular expression for filtering. It's applied with the `email`. Further information about the syntax can be found [here](https://github.com/google/re2/wiki/Syntax).
     """
     __args__ = dict()
+    __args__['prefix'] = prefix
     __args__['project'] = project
+    __args__['regex'] = regex
     opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
     __ret__ = pulumi.runtime.invoke('gcp:serviceaccount/getS:getS', __args__, opts=opts, typ=GetSResult).value
 
     return AwaitableGetSResult(
         accounts=pulumi.get(__ret__, 'accounts'),
         id=pulumi.get(__ret__, 'id'),
-        project=pulumi.get(__ret__, 'project'))
-def get_s_output(project: Optional[pulumi.Input[Optional[str]]] = None,
+        prefix=pulumi.get(__ret__, 'prefix'),
+        project=pulumi.get(__ret__, 'project'),
+        regex=pulumi.get(__ret__, 'regex'))
+def get_s_output(prefix: Optional[pulumi.Input[Optional[str]]] = None,
+                 project: Optional[pulumi.Input[Optional[str]]] = None,
+                 regex: Optional[pulumi.Input[Optional[str]]] = None,
                  opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetSResult]:
     """
     Gets a list of all service accounts from a project.
@@ -110,7 +166,7 @@ def get_s_output(project: Optional[pulumi.Input[Optional[str]]] = None,
 
     ## Example Usage
 
-    Example service accounts.
+    Get all service accounts from a project
 
     ```python
     import pulumi
@@ -119,14 +175,48 @@ def get_s_output(project: Optional[pulumi.Input[Optional[str]]] = None,
     example = gcp.serviceaccount.get_s(project="example-project")
     ```
 
+    Get all service accounts that are prefixed with `"foo"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    foo = gcp.serviceaccount.get_s(prefix="foo")
+    ```
+
+    Get all service accounts that contain `"bar"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    bar = gcp.serviceaccount.get_s(regex=".*bar.*")
+    ```
+
+    Get all service accounts that are prefixed with `"foo"` and contain `"bar"`
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    foo_bar = gcp.serviceaccount.get_s(prefix="foo",
+        regex=".*bar.*")
+    ```
+
 
+    :param str prefix: A prefix for filtering. It's applied with the `account_id`.
     :param str project: The ID of the project. If it is not provided, the provider project is used.
+    :param str regex: A regular expression for filtering. It's applied with the `email`. Further information about the syntax can be found [here](https://github.com/google/re2/wiki/Syntax).
     """
     __args__ = dict()
+    __args__['prefix'] = prefix
     __args__['project'] = project
+    __args__['regex'] = regex
     opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
     __ret__ = pulumi.runtime.invoke_output('gcp:serviceaccount/getS:getS', __args__, opts=opts, typ=GetSResult)
     return __ret__.apply(lambda __response__: GetSResult(
         accounts=pulumi.get(__response__, 'accounts'),
         id=pulumi.get(__response__, 'id'),
-        project=pulumi.get(__response__, 'project')))
+        prefix=pulumi.get(__response__, 'prefix'),
+        project=pulumi.get(__response__, 'project'),
+        regex=pulumi.get(__response__, 'regex')))

pulumi_gcp/spanner/_inputs.py

@@ -15,6 +15,8 @@ else:
 from .. import _utilities
 
 __all__ = [
+    'BackupScheduleEncryptionConfigArgs',
+    'BackupScheduleEncryptionConfigArgsDict',
     'BackupScheduleFullBackupSpecArgs',
     'BackupScheduleFullBackupSpecArgsDict',
     'BackupScheduleIncrementalBackupSpecArgs',
@@ -53,6 +55,72 @@ __all__ = [
 
 MYPY = False
 
+if not MYPY:
+    class BackupScheduleEncryptionConfigArgsDict(TypedDict):
+        encryption_type: pulumi.Input[str]
+        """
+        The encryption type of backups created by the backup schedule.
+        Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
+        If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
+        If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+        Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
+        """
+        kms_key_name: NotRequired[pulumi.Input[str]]
+        """
+        The resource name of the Cloud KMS key to use for encryption.
+        Format: 'projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}'
+        """
+elif False:
+    BackupScheduleEncryptionConfigArgsDict: TypeAlias = Mapping[str, Any]
+
+@pulumi.input_type
+class BackupScheduleEncryptionConfigArgs:
+    def __init__(__self__, *,
+                 encryption_type: pulumi.Input[str],
+                 kms_key_name: Optional[pulumi.Input[str]] = None):
+        """
+        :param pulumi.Input[str] encryption_type: The encryption type of backups created by the backup schedule.
+               Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
+               If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
+               If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+               Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
+        :param pulumi.Input[str] kms_key_name: The resource name of the Cloud KMS key to use for encryption.
+               Format: 'projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}'
+        """
+        pulumi.set(__self__, "encryption_type", encryption_type)
+        if kms_key_name is not None:
+            pulumi.set(__self__, "kms_key_name", kms_key_name)
+
+    @property
+    @pulumi.getter(name="encryptionType")
+    def encryption_type(self) -> pulumi.Input[str]:
+        """
+        The encryption type of backups created by the backup schedule.
+        Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
+        If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
+        If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+        Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
+        """
+        return pulumi.get(self, "encryption_type")
+
+    @encryption_type.setter
+    def encryption_type(self, value: pulumi.Input[str]):
+        pulumi.set(self, "encryption_type", value)
+
+    @property
+    @pulumi.getter(name="kmsKeyName")
+    def kms_key_name(self) -> Optional[pulumi.Input[str]]:
+        """
+        The resource name of the Cloud KMS key to use for encryption.
+        Format: 'projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}'
+        """
+        return pulumi.get(self, "kms_key_name")
+
+    @kms_key_name.setter
+    def kms_key_name(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "kms_key_name", value)
+
+
 if not MYPY:
     class BackupScheduleFullBackupSpecArgsDict(TypedDict):
         pass

pulumi_gcp/spanner/backup_schedule.py

@@ -24,6 +24,7 @@ class BackupScheduleArgs:
                  database: pulumi.Input[str],
                  instance: pulumi.Input[str],
                  retention_duration: pulumi.Input[str],
+                 encryption_config: Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']] = None,
                  full_backup_spec: Optional[pulumi.Input['BackupScheduleFullBackupSpecArgs']] = None,
                  incremental_backup_spec: Optional[pulumi.Input['BackupScheduleIncrementalBackupSpecArgs']] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -39,6 +40,8 @@ class BackupScheduleArgs:
         :param pulumi.Input[str] retention_duration: At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
                A duration in seconds with up to nine fractional digits, ending with 's'. Example: '3.5s'.
                You can set this to a value up to 366 days.
+        :param pulumi.Input['BackupScheduleEncryptionConfigArgs'] encryption_config: Configuration for the encryption of the backup schedule.
+               Structure is documented below.
         :param pulumi.Input['BackupScheduleFullBackupSpecArgs'] full_backup_spec: The schedule creates only full backups..
         :param pulumi.Input['BackupScheduleIncrementalBackupSpecArgs'] incremental_backup_spec: The schedule creates incremental backup chains.
         :param pulumi.Input[str] name: A unique identifier for the backup schedule, which cannot be changed after
@@ -51,6 +54,8 @@ class BackupScheduleArgs:
         pulumi.set(__self__, "database", database)
         pulumi.set(__self__, "instance", instance)
         pulumi.set(__self__, "retention_duration", retention_duration)
+        if encryption_config is not None:
+            pulumi.set(__self__, "encryption_config", encryption_config)
         if full_backup_spec is not None:
             pulumi.set(__self__, "full_backup_spec", full_backup_spec)
         if incremental_backup_spec is not None:
@@ -103,6 +108,19 @@ class BackupScheduleArgs:
     def retention_duration(self, value: pulumi.Input[str]):
         pulumi.set(self, "retention_duration", value)
 
+    @property
+    @pulumi.getter(name="encryptionConfig")
+    def encryption_config(self) -> Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']]:
+        """
+        Configuration for the encryption of the backup schedule.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "encryption_config")
+
+    @encryption_config.setter
+    def encryption_config(self, value: Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']]):
+        pulumi.set(self, "encryption_config", value)
+
     @property
     @pulumi.getter(name="fullBackupSpec")
     def full_backup_spec(self) -> Optional[pulumi.Input['BackupScheduleFullBackupSpecArgs']]:
@@ -171,6 +189,7 @@ class BackupScheduleArgs:
 class _BackupScheduleState:
     def __init__(__self__, *,
                  database: Optional[pulumi.Input[str]] = None,
+                 encryption_config: Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']] = None,
                  full_backup_spec: Optional[pulumi.Input['BackupScheduleFullBackupSpecArgs']] = None,
                  incremental_backup_spec: Optional[pulumi.Input['BackupScheduleIncrementalBackupSpecArgs']] = None,
                  instance: Optional[pulumi.Input[str]] = None,
@@ -184,6 +203,8 @@ class _BackupScheduleState:
                
                
                - - -
+        :param pulumi.Input['BackupScheduleEncryptionConfigArgs'] encryption_config: Configuration for the encryption of the backup schedule.
+               Structure is documented below.
         :param pulumi.Input['BackupScheduleFullBackupSpecArgs'] full_backup_spec: The schedule creates only full backups..
         :param pulumi.Input['BackupScheduleIncrementalBackupSpecArgs'] incremental_backup_spec: The schedule creates incremental backup chains.
         :param pulumi.Input[str] instance: The instance to create the database on.
@@ -199,6 +220,8 @@ class _BackupScheduleState:
         """
         if database is not None:
             pulumi.set(__self__, "database", database)
+        if encryption_config is not None:
+            pulumi.set(__self__, "encryption_config", encryption_config)
         if full_backup_spec is not None:
             pulumi.set(__self__, "full_backup_spec", full_backup_spec)
         if incremental_backup_spec is not None:
@@ -229,6 +252,19 @@ class _BackupScheduleState:
     def database(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "database", value)
 
+    @property
+    @pulumi.getter(name="encryptionConfig")
+    def encryption_config(self) -> Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']]:
+        """
+        Configuration for the encryption of the backup schedule.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "encryption_config")
+
+    @encryption_config.setter
+    def encryption_config(self, value: Optional[pulumi.Input['BackupScheduleEncryptionConfigArgs']]):
+        pulumi.set(self, "encryption_config", value)
+
     @property
     @pulumi.getter(name="fullBackupSpec")
     def full_backup_spec(self) -> Optional[pulumi.Input['BackupScheduleFullBackupSpecArgs']]:
@@ -325,6 +361,7 @@ class BackupSchedule(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  database: Optional[pulumi.Input[str]] = None,
+                 encryption_config: Optional[pulumi.Input[Union['BackupScheduleEncryptionConfigArgs', 'BackupScheduleEncryptionConfigArgsDict']]] = None,
                  full_backup_spec: Optional[pulumi.Input[Union['BackupScheduleFullBackupSpecArgs', 'BackupScheduleFullBackupSpecArgsDict']]] = None,
                  incremental_backup_spec: Optional[pulumi.Input[Union['BackupScheduleIncrementalBackupSpecArgs', 'BackupScheduleIncrementalBackupSpecArgsDict']]] = None,
                  instance: Optional[pulumi.Input[str]] = None,
@@ -381,7 +418,10 @@ class BackupSchedule(pulumi.CustomResource):
                     "text": "0 12 * * *",
                 },
             },
-            full_backup_spec={})
+            full_backup_spec={},
+            encryption_config={
+                "encryption_type": "USE_DATABASE_ENCRYPTION",
+            })
         ```
         ### Spanner Backup Schedule Daily Incremental
 
@@ -414,7 +454,10 @@ class BackupSchedule(pulumi.CustomResource):
                     "text": "0 12 * * *",
                 },
             },
-            incremental_backup_spec={})
+            incremental_backup_spec={},
+            encryption_config={
+                "encryption_type": "GOOGLE_DEFAULT_ENCRYPTION",
+            })
         ```
 
         ## Import
@@ -447,6 +490,8 @@ class BackupSchedule(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[Union['BackupScheduleEncryptionConfigArgs', 'BackupScheduleEncryptionConfigArgsDict']] encryption_config: Configuration for the encryption of the backup schedule.
+               Structure is documented below.
         :param pulumi.Input[Union['BackupScheduleFullBackupSpecArgs', 'BackupScheduleFullBackupSpecArgsDict']] full_backup_spec: The schedule creates only full backups..
         :param pulumi.Input[Union['BackupScheduleIncrementalBackupSpecArgs', 'BackupScheduleIncrementalBackupSpecArgsDict']] incremental_backup_spec: The schedule creates incremental backup chains.
         :param pulumi.Input[str] instance: The instance to create the database on.
@@ -514,7 +559,10 @@ class BackupSchedule(pulumi.CustomResource):
                     "text": "0 12 * * *",
                 },
             },
-            full_backup_spec={})
+            full_backup_spec={},
+            encryption_config={
+                "encryption_type": "USE_DATABASE_ENCRYPTION",
+            })
         ```
         ### Spanner Backup Schedule Daily Incremental
 
@@ -547,7 +595,10 @@ class BackupSchedule(pulumi.CustomResource):
                     "text": "0 12 * * *",
                 },
             },
-            incremental_backup_spec={})
+            incremental_backup_spec={},
+            encryption_config={
+                "encryption_type": "GOOGLE_DEFAULT_ENCRYPTION",
+            })
         ```
 
         ## Import
@@ -590,6 +641,7 @@ class BackupSchedule(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  database: Optional[pulumi.Input[str]] = None,
+                 encryption_config: Optional[pulumi.Input[Union['BackupScheduleEncryptionConfigArgs', 'BackupScheduleEncryptionConfigArgsDict']]] = None,
                  full_backup_spec: Optional[pulumi.Input[Union['BackupScheduleFullBackupSpecArgs', 'BackupScheduleFullBackupSpecArgsDict']]] = None,
                  incremental_backup_spec: Optional[pulumi.Input[Union['BackupScheduleIncrementalBackupSpecArgs', 'BackupScheduleIncrementalBackupSpecArgsDict']]] = None,
                  instance: Optional[pulumi.Input[str]] = None,
@@ -609,6 +661,7 @@ class BackupSchedule(pulumi.CustomResource):
             if database is None and not opts.urn:
                 raise TypeError("Missing required property 'database'")
             __props__.__dict__["database"] = database
+            __props__.__dict__["encryption_config"] = encryption_config
             __props__.__dict__["full_backup_spec"] = full_backup_spec
             __props__.__dict__["incremental_backup_spec"] = incremental_backup_spec
             if instance is None and not opts.urn:
@@ -631,6 +684,7 @@ class BackupSchedule(pulumi.CustomResource):
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             database: Optional[pulumi.Input[str]] = None,
+            encryption_config: Optional[pulumi.Input[Union['BackupScheduleEncryptionConfigArgs', 'BackupScheduleEncryptionConfigArgsDict']]] = None,
             full_backup_spec: Optional[pulumi.Input[Union['BackupScheduleFullBackupSpecArgs', 'BackupScheduleFullBackupSpecArgsDict']]] = None,
             incremental_backup_spec: Optional[pulumi.Input[Union['BackupScheduleIncrementalBackupSpecArgs', 'BackupScheduleIncrementalBackupSpecArgsDict']]] = None,
             instance: Optional[pulumi.Input[str]] = None,
@@ -649,6 +703,8 @@ class BackupSchedule(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[Union['BackupScheduleEncryptionConfigArgs', 'BackupScheduleEncryptionConfigArgsDict']] encryption_config: Configuration for the encryption of the backup schedule.
+               Structure is documented below.
         :param pulumi.Input[Union['BackupScheduleFullBackupSpecArgs', 'BackupScheduleFullBackupSpecArgsDict']] full_backup_spec: The schedule creates only full backups..
         :param pulumi.Input[Union['BackupScheduleIncrementalBackupSpecArgs', 'BackupScheduleIncrementalBackupSpecArgsDict']] incremental_backup_spec: The schedule creates incremental backup chains.
         :param pulumi.Input[str] instance: The instance to create the database on.
@@ -667,6 +723,7 @@ class BackupSchedule(pulumi.CustomResource):
         __props__ = _BackupScheduleState.__new__(_BackupScheduleState)
 
         __props__.__dict__["database"] = database
+        __props__.__dict__["encryption_config"] = encryption_config
         __props__.__dict__["full_backup_spec"] = full_backup_spec
         __props__.__dict__["incremental_backup_spec"] = incremental_backup_spec
         __props__.__dict__["instance"] = instance
@@ -687,6 +744,15 @@ class BackupSchedule(pulumi.CustomResource):
         """
         return pulumi.get(self, "database")
 
+    @property
+    @pulumi.getter(name="encryptionConfig")
+    def encryption_config(self) -> pulumi.Output['outputs.BackupScheduleEncryptionConfig']:
+        """
+        Configuration for the encryption of the backup schedule.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "encryption_config")
+
     @property
     @pulumi.getter(name="fullBackupSpec")
     def full_backup_spec(self) -> pulumi.Output[Optional['outputs.BackupScheduleFullBackupSpec']]:

pulumi_gcp/spanner/outputs.py

@@ -16,6 +16,7 @@ from .. import _utilities
 from . import outputs
 
 __all__ = [
+    'BackupScheduleEncryptionConfig',
     'BackupScheduleFullBackupSpec',
     'BackupScheduleIncrementalBackupSpec',
     'BackupScheduleSpec',
@@ -43,6 +44,65 @@ __all__ = [
     'GetInstanceAutoscalingConfigAutoscalingTargetResult',
 ]
 
+@pulumi.output_type
+class BackupScheduleEncryptionConfig(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "encryptionType":
+            suggest = "encryption_type"
+        elif key == "kmsKeyName":
+            suggest = "kms_key_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in BackupScheduleEncryptionConfig. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        BackupScheduleEncryptionConfig.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        BackupScheduleEncryptionConfig.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 encryption_type: str,
+                 kms_key_name: Optional[str] = None):
+        """
+        :param str encryption_type: The encryption type of backups created by the backup schedule.
+               Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
+               If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
+               If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+               Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
+        :param str kms_key_name: The resource name of the Cloud KMS key to use for encryption.
+               Format: 'projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}'
+        """
+        pulumi.set(__self__, "encryption_type", encryption_type)
+        if kms_key_name is not None:
+            pulumi.set(__self__, "kms_key_name", kms_key_name)
+
+    @property
+    @pulumi.getter(name="encryptionType")
+    def encryption_type(self) -> str:
+        """
+        The encryption type of backups created by the backup schedule.
+        Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
+        If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
+        If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+        Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
+        """
+        return pulumi.get(self, "encryption_type")
+
+    @property
+    @pulumi.getter(name="kmsKeyName")
+    def kms_key_name(self) -> Optional[str]:
+        """
+        The resource name of the Cloud KMS key to use for encryption.
+        Format: 'projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}'
+        """
+        return pulumi.get(self, "kms_key_name")
+
+
 @pulumi.output_type
 class BackupScheduleFullBackupSpec(dict):
     def __init__(__self__):