pulumi-gcp 8.20.0a1739946722__py3-none-any.whl → 8.20.1__py3-none-any.whl

pulumi_gcp/gkebackup/get_backup_plan_iam_policy.py

@@ -108,7 +108,7 @@ def get_backup_plan_iam_policy(location: Optional[str] = None,
     """
     Retrieves the current IAM policy data for backupplan
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -149,7 +149,7 @@ def get_backup_plan_iam_policy_output(location: Optional[pulumi.Input[Optional[s
     """
     Retrieves the current IAM policy data for backupplan
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/gkebackup/get_restore_plan_iam_policy.py

@@ -108,7 +108,7 @@ def get_restore_plan_iam_policy(location: Optional[str] = None,
     """
     Retrieves the current IAM policy data for restoreplan
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -149,7 +149,7 @@ def get_restore_plan_iam_policy_output(location: Optional[pulumi.Input[Optional[
     """
     Retrieves the current IAM policy data for restoreplan
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/gkehub/get_feature_iam_policy.py

@@ -108,7 +108,7 @@ def get_feature_iam_policy(location: Optional[str] = None,
     """
     Retrieves the current IAM policy data for feature
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -148,7 +148,7 @@ def get_feature_iam_policy_output(location: Optional[pulumi.Input[Optional[str]]
     """
     Retrieves the current IAM policy data for feature
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/gkehub/get_membership_iam_policy.py

@@ -108,7 +108,7 @@ def get_membership_iam_policy(location: Optional[str] = None,
     """
     Retrieves the current IAM policy data for membership
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -149,7 +149,7 @@ def get_membership_iam_policy_output(location: Optional[pulumi.Input[Optional[st
     """
     Retrieves the current IAM policy data for membership
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/gkehub/get_scope_iam_policy.py

@@ -98,7 +98,7 @@ def get_scope_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for scope
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -130,7 +130,7 @@ def get_scope_iam_policy_output(project: Optional[pulumi.Input[Optional[str]]] =
     """
     Retrieves the current IAM policy data for scope
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/healthcare/get_consent_store_iam_policy.py

@@ -98,7 +98,7 @@ def get_consent_store_iam_policy(consent_store_id: Optional[str] = None,
     """
     Retrieves the current IAM policy data for consentstore
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -132,7 +132,7 @@ def get_consent_store_iam_policy_output(consent_store_id: Optional[pulumi.Input[
     """
     Retrieves the current IAM policy data for consentstore
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iam/organizations_policy_binding.py

@@ -512,12 +512,15 @@ class OrganizationsPolicyBinding(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_time as time
 
         pab_policy = gcp.iam.PrincipalAccessBoundaryPolicy("pab_policy",
             organization="123456789",
             location="global",
             display_name="test org binding",
             principal_access_boundary_policy_id="my-pab-policy")
+        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s,
+        opts = pulumi.ResourceOptions(depends_on=[pab_policy]))
         my_org_binding = gcp.iam.OrganizationsPolicyBinding("my-org-binding",
             organization="123456789",
             location="global",
@@ -527,7 +530,8 @@ class OrganizationsPolicyBinding(pulumi.CustomResource):
             policy=pab_policy.principal_access_boundary_policy_id.apply(lambda principal_access_boundary_policy_id: f"organizations/123456789/locations/global/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}"),
             target={
                 "principal_set": "//cloudresourcemanager.googleapis.com/organizations/123456789",
-            })
+            },
+            opts = pulumi.ResourceOptions(depends_on=[wait60_seconds]))
         ```
 
         ## Import
@@ -596,12 +600,15 @@ class OrganizationsPolicyBinding(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_time as time
 
         pab_policy = gcp.iam.PrincipalAccessBoundaryPolicy("pab_policy",
             organization="123456789",
             location="global",
             display_name="test org binding",
             principal_access_boundary_policy_id="my-pab-policy")
+        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s,
+        opts = pulumi.ResourceOptions(depends_on=[pab_policy]))
         my_org_binding = gcp.iam.OrganizationsPolicyBinding("my-org-binding",
             organization="123456789",
             location="global",
@@ -611,7 +618,8 @@ class OrganizationsPolicyBinding(pulumi.CustomResource):
             policy=pab_policy.principal_access_boundary_policy_id.apply(lambda principal_access_boundary_policy_id: f"organizations/123456789/locations/global/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}"),
             target={
                 "principal_set": "//cloudresourcemanager.googleapis.com/organizations/123456789",
-            })
+            },
+            opts = pulumi.ResourceOptions(depends_on=[wait60_seconds]))
         ```
 
         ## Import

pulumi_gcp/iam/projects_policy_binding.py

@@ -505,6 +505,7 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_time as time
 
         project = gcp.organizations.get_project()
         pab_policy = gcp.iam.PrincipalAccessBoundaryPolicy("pab_policy",
@@ -512,6 +513,8 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
             location="global",
             display_name="test project binding",
             principal_access_boundary_policy_id="my-pab-policy")
+        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s,
+        opts = pulumi.ResourceOptions(depends_on=[pab_policy]))
         my_project_binding = gcp.iam.ProjectsPolicyBinding("my-project-binding",
             project=project.project_id,
             location="global",
@@ -521,7 +524,8 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
             policy=pab_policy.principal_access_boundary_policy_id.apply(lambda principal_access_boundary_policy_id: f"organizations/123456789/locations/global/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}"),
             target={
                 "principal_set": f"//cloudresourcemanager.googleapis.com/projects/{project.project_id}",
-            })
+            },
+            opts = pulumi.ResourceOptions(depends_on=[wait60_seconds]))
         ```
 
         ## Import
@@ -595,6 +599,7 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
         ```python
         import pulumi
         import pulumi_gcp as gcp
+        import pulumi_time as time
 
         project = gcp.organizations.get_project()
         pab_policy = gcp.iam.PrincipalAccessBoundaryPolicy("pab_policy",
@@ -602,6 +607,8 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
             location="global",
             display_name="test project binding",
             principal_access_boundary_policy_id="my-pab-policy")
+        wait60_seconds = time.index.Sleep("wait_60_seconds", create_duration=60s,
+        opts = pulumi.ResourceOptions(depends_on=[pab_policy]))
         my_project_binding = gcp.iam.ProjectsPolicyBinding("my-project-binding",
             project=project.project_id,
             location="global",
@@ -611,7 +618,8 @@ class ProjectsPolicyBinding(pulumi.CustomResource):
             policy=pab_policy.principal_access_boundary_policy_id.apply(lambda principal_access_boundary_policy_id: f"organizations/123456789/locations/global/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}"),
             target={
                 "principal_set": f"//cloudresourcemanager.googleapis.com/projects/{project.project_id}",
-            })
+            },
+            opts = pulumi.ResourceOptions(depends_on=[wait60_seconds]))
         ```
 
         ## Import

pulumi_gcp/iam/workforce_pool_provider.py

@@ -99,7 +99,7 @@ class WorkforcePoolProviderArgs:
         :param pulumi.Input['WorkforcePoolProviderExtraAttributesOauth2ClientArgs'] extra_attributes_oauth2_client: The configuration for OAuth 2.0 client used to get the additional user
                attributes. This should be used when users can't get the desired claims
                in authentication credentials. Currently this configuration is only
-               supported with OIDC protocol.
+               supported with SAML and OIDC protocol.
                Structure is documented below.
         :param pulumi.Input['WorkforcePoolProviderOidcArgs'] oidc: Represents an OpenId Connect 1.0 identity provider.
                Structure is documented below.
@@ -283,7 +283,7 @@ class WorkforcePoolProviderArgs:
         The configuration for OAuth 2.0 client used to get the additional user
         attributes. This should be used when users can't get the desired claims
         in authentication credentials. Currently this configuration is only
-        supported with OIDC protocol.
+        supported with SAML and OIDC protocol.
         Structure is documented below.
         """
         return pulumi.get(self, "extra_attributes_oauth2_client")
@@ -391,7 +391,7 @@ class _WorkforcePoolProviderState:
         :param pulumi.Input['WorkforcePoolProviderExtraAttributesOauth2ClientArgs'] extra_attributes_oauth2_client: The configuration for OAuth 2.0 client used to get the additional user
                attributes. This should be used when users can't get the desired claims
                in authentication credentials. Currently this configuration is only
-               supported with OIDC protocol.
+               supported with SAML and OIDC protocol.
                Structure is documented below.
         :param pulumi.Input[str] location: The location for the resource.
         :param pulumi.Input[str] name: Output only. The resource name of the provider.
@@ -557,7 +557,7 @@ class _WorkforcePoolProviderState:
         The configuration for OAuth 2.0 client used to get the additional user
         attributes. This should be used when users can't get the desired claims
         in authentication credentials. Currently this configuration is only
-        supported with OIDC protocol.
+        supported with SAML and OIDC protocol.
         Structure is documented below.
         """
         return pulumi.get(self, "extra_attributes_oauth2_client")
@@ -737,7 +737,20 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                 "google.subject": "assertion.sub",
             },
             saml={
-                "idp_metadata_xml": "<?xml version=\\"1.0\\"?><md:EntityDescriptor xmlns:md=\\"urn:oasis:names:tc:SAML:2.0:metadata\\" entityID=\\"https://test.com\\"><md:IDPSSODescriptor protocolSupportEnumeration=\\"urn:oasis:names:tc:SAML:2.0:protocol\\"> <md:KeyDescriptor use=\\"signing\\"><ds:KeyInfo xmlns:ds=\\"http://www.w3.org/2000/09/xmldsig#\\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\" Location=\\"https://test.com/sso\\"/></md:IDPSSODescriptor></md:EntityDescriptor>",
+                "idp_metadata_xml": "<?xml version=\\"1.0\\"?><md:EntityDescriptor xmlns:md=\\"urn:oasis:names:tc:SAML:2.0:metadata\\" entityID=\\"https://sts.windows.net/826602fe-2101-470c-9d71-ee1343668989\\"><md:IDPSSODescriptor protocolSupportEnumeration=\\"urn:oasis:names:tc:SAML:2.0:protocol\\"> <md:KeyDescriptor use=\\"signing\\"><ds:KeyInfo xmlns:ds=\\"http://www.w3.org/2000/09/xmldsig#\\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\" Location=\\"https://test.com/sso\\"/></md:IDPSSODescriptor></md:EntityDescriptor>",
+            },
+            extra_attributes_oauth2_client={
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
+                "client_id": "client-id",
+                "client_secret": {
+                    "value": {
+                        "plain_text": "client-secret",
+                    },
+                },
+                "attributes_type": "AZURE_AD_GROUPS_MAIL",
+                "query_parameters": {
+                    "filter": "mail:gcp",
+                },
             },
             display_name="Display name",
             description="A sample SAML workforce pool provider.",
@@ -793,7 +806,7 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                 "google.subject": "assertion.sub",
             },
             oidc={
-                "issuer_uri": "https://accounts.thirdparty.com",
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
                 "client_id": "client-id",
                 "client_secret": {
                     "value": {
@@ -809,6 +822,19 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                     ],
                 },
             },
+            extra_attributes_oauth2_client={
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
+                "client_id": "client-id",
+                "client_secret": {
+                    "value": {
+                        "plain_text": "client-secret",
+                    },
+                },
+                "attributes_type": "AZURE_AD_GROUPS_MAIL",
+                "query_parameters": {
+                    "filter": "mail:sales",
+                },
+            },
             display_name="Display name",
             description="A sample OIDC workforce pool provider.",
             disabled=False,
@@ -974,7 +1000,7 @@ class WorkforcePoolProvider(pulumi.CustomResource):
         :param pulumi.Input[Union['WorkforcePoolProviderExtraAttributesOauth2ClientArgs', 'WorkforcePoolProviderExtraAttributesOauth2ClientArgsDict']] extra_attributes_oauth2_client: The configuration for OAuth 2.0 client used to get the additional user
                attributes. This should be used when users can't get the desired claims
                in authentication credentials. Currently this configuration is only
-               supported with OIDC protocol.
+               supported with SAML and OIDC protocol.
                Structure is documented below.
         :param pulumi.Input[str] location: The location for the resource.
         :param pulumi.Input[Union['WorkforcePoolProviderOidcArgs', 'WorkforcePoolProviderOidcArgsDict']] oidc: Represents an OpenId Connect 1.0 identity provider.
@@ -1051,7 +1077,20 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                 "google.subject": "assertion.sub",
             },
             saml={
-                "idp_metadata_xml": "<?xml version=\\"1.0\\"?><md:EntityDescriptor xmlns:md=\\"urn:oasis:names:tc:SAML:2.0:metadata\\" entityID=\\"https://test.com\\"><md:IDPSSODescriptor protocolSupportEnumeration=\\"urn:oasis:names:tc:SAML:2.0:protocol\\"> <md:KeyDescriptor use=\\"signing\\"><ds:KeyInfo xmlns:ds=\\"http://www.w3.org/2000/09/xmldsig#\\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\" Location=\\"https://test.com/sso\\"/></md:IDPSSODescriptor></md:EntityDescriptor>",
+                "idp_metadata_xml": "<?xml version=\\"1.0\\"?><md:EntityDescriptor xmlns:md=\\"urn:oasis:names:tc:SAML:2.0:metadata\\" entityID=\\"https://sts.windows.net/826602fe-2101-470c-9d71-ee1343668989\\"><md:IDPSSODescriptor protocolSupportEnumeration=\\"urn:oasis:names:tc:SAML:2.0:protocol\\"> <md:KeyDescriptor use=\\"signing\\"><ds:KeyInfo xmlns:ds=\\"http://www.w3.org/2000/09/xmldsig#\\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\\" Location=\\"https://test.com/sso\\"/></md:IDPSSODescriptor></md:EntityDescriptor>",
+            },
+            extra_attributes_oauth2_client={
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
+                "client_id": "client-id",
+                "client_secret": {
+                    "value": {
+                        "plain_text": "client-secret",
+                    },
+                },
+                "attributes_type": "AZURE_AD_GROUPS_MAIL",
+                "query_parameters": {
+                    "filter": "mail:gcp",
+                },
             },
             display_name="Display name",
             description="A sample SAML workforce pool provider.",
@@ -1107,7 +1146,7 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                 "google.subject": "assertion.sub",
             },
             oidc={
-                "issuer_uri": "https://accounts.thirdparty.com",
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
                 "client_id": "client-id",
                 "client_secret": {
                     "value": {
@@ -1123,6 +1162,19 @@ class WorkforcePoolProvider(pulumi.CustomResource):
                     ],
                 },
             },
+            extra_attributes_oauth2_client={
+                "issuer_uri": "https://login.microsoftonline.com/826602fe-2101-470c-9d71-ee1343668989/v2.0",
+                "client_id": "client-id",
+                "client_secret": {
+                    "value": {
+                        "plain_text": "client-secret",
+                    },
+                },
+                "attributes_type": "AZURE_AD_GROUPS_MAIL",
+                "query_parameters": {
+                    "filter": "mail:sales",
+                },
+            },
             display_name="Display name",
             description="A sample OIDC workforce pool provider.",
             disabled=False,
@@ -1370,7 +1422,7 @@ class WorkforcePoolProvider(pulumi.CustomResource):
         :param pulumi.Input[Union['WorkforcePoolProviderExtraAttributesOauth2ClientArgs', 'WorkforcePoolProviderExtraAttributesOauth2ClientArgsDict']] extra_attributes_oauth2_client: The configuration for OAuth 2.0 client used to get the additional user
                attributes. This should be used when users can't get the desired claims
                in authentication credentials. Currently this configuration is only
-               supported with OIDC protocol.
+               supported with SAML and OIDC protocol.
                Structure is documented below.
         :param pulumi.Input[str] location: The location for the resource.
         :param pulumi.Input[str] name: Output only. The resource name of the provider.
@@ -1508,7 +1560,7 @@ class WorkforcePoolProvider(pulumi.CustomResource):
         The configuration for OAuth 2.0 client used to get the additional user
         attributes. This should be used when users can't get the desired claims
         in authentication credentials. Currently this configuration is only
-        supported with OIDC protocol.
+        supported with SAML and OIDC protocol.
         Structure is documented below.
         """
         return pulumi.get(self, "extra_attributes_oauth2_client")

pulumi_gcp/iap/get_app_engine_service_iam_policy.py

@@ -108,7 +108,7 @@ def get_app_engine_service_iam_policy(app_id: Optional[str] = None,
     """
     Retrieves the current IAM policy data for appengineservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -146,7 +146,7 @@ def get_app_engine_service_iam_policy_output(app_id: Optional[pulumi.Input[str]]
     """
     Retrieves the current IAM policy data for appengineservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_app_engine_version_iam_policy.py

@@ -118,7 +118,7 @@ def get_app_engine_version_iam_policy(app_id: Optional[str] = None,
     """
     Retrieves the current IAM policy data for appengineversion
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -161,7 +161,7 @@ def get_app_engine_version_iam_policy_output(app_id: Optional[pulumi.Input[str]]
     """
     Retrieves the current IAM policy data for appengineversion
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_tunnel_dest_group_iam_policy.py

@@ -108,7 +108,7 @@ def get_tunnel_dest_group_iam_policy(dest_group: Optional[str] = None,
     """
     Retrieves the current IAM policy data for tunneldestgroup
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -148,7 +148,7 @@ def get_tunnel_dest_group_iam_policy_output(dest_group: Optional[pulumi.Input[st
     """
     Retrieves the current IAM policy data for tunneldestgroup
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_tunnel_iam_policy.py

@@ -88,7 +88,7 @@ def get_tunnel_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for tunnel
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -116,7 +116,7 @@ def get_tunnel_iam_policy_output(project: Optional[pulumi.Input[Optional[str]]]
     """
     Retrieves the current IAM policy data for tunnel
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_tunnel_instance_iam_policy.py

@@ -108,7 +108,7 @@ def get_tunnel_instance_iam_policy(instance: Optional[str] = None,
     """
     Retrieves the current IAM policy data for tunnelinstance
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -145,7 +145,7 @@ def get_tunnel_instance_iam_policy_output(instance: Optional[pulumi.Input[str]]
     """
     Retrieves the current IAM policy data for tunnelinstance
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_web_backend_service_iam_policy.py

@@ -98,7 +98,7 @@ def get_web_backend_service_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for webbackendservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -131,7 +131,7 @@ def get_web_backend_service_iam_policy_output(project: Optional[pulumi.Input[Opt
     """
     Retrieves the current IAM policy data for webbackendservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_web_iam_policy.py

@@ -88,7 +88,7 @@ def get_web_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for web
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -116,7 +116,7 @@ def get_web_iam_policy_output(project: Optional[pulumi.Input[Optional[str]]] = N
     """
     Retrieves the current IAM policy data for web
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_web_region_backend_service_iam_policy.py

@@ -108,7 +108,7 @@ def get_web_region_backend_service_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for webregionbackendservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -145,7 +145,7 @@ def get_web_region_backend_service_iam_policy_output(project: Optional[pulumi.In
     """
     Retrieves the current IAM policy data for webregionbackendservice
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_web_type_app_engine_iam_policy.py

@@ -98,7 +98,7 @@ def get_web_type_app_engine_iam_policy(app_id: Optional[str] = None,
     """
     Retrieves the current IAM policy data for webtypeappengine
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -131,7 +131,7 @@ def get_web_type_app_engine_iam_policy_output(app_id: Optional[pulumi.Input[str]
     """
     Retrieves the current IAM policy data for webtypeappengine
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/iap/get_web_type_compute_iam_policy.py

@@ -88,7 +88,7 @@ def get_web_type_compute_iam_policy(project: Optional[str] = None,
     """
     Retrieves the current IAM policy data for webtypecompute
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -116,7 +116,7 @@ def get_web_type_compute_iam_policy_output(project: Optional[pulumi.Input[Option
     """
     Retrieves the current IAM policy data for webtypecompute
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/kms/get_ekm_connection_iam_policy.py

@@ -108,7 +108,7 @@ def get_ekm_connection_iam_policy(location: Optional[str] = None,
     """
     Retrieves the current IAM policy data for ekmconnection
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -150,7 +150,7 @@ def get_ekm_connection_iam_policy_output(location: Optional[pulumi.Input[Optiona
     """
     Retrieves the current IAM policy data for ekmconnection
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi

pulumi_gcp/logging/get_log_view_iam_policy.py

@@ -118,7 +118,7 @@ def get_log_view_iam_policy(bucket: Optional[str] = None,
     """
     Retrieves the current IAM policy data for logview
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi
@@ -162,7 +162,7 @@ def get_log_view_iam_policy_output(bucket: Optional[pulumi.Input[str]] = None,
     """
     Retrieves the current IAM policy data for logview
 
-    ## example
+    ## Example Usage
 
     ```python
     import pulumi