pulumi-snowflake 0.56.0a1721327760__py3-none-any.whl → 0.57.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_snowflake/__init__.py +78 -209
- pulumi_snowflake/_inputs.py +12188 -1362
- pulumi_snowflake/_utilities.py +2 -0
- pulumi_snowflake/account_role.py +226 -0
- pulumi_snowflake/api_authentication_integration_with_authorization_code_grant.py +692 -0
- pulumi_snowflake/api_authentication_integration_with_client_credentials.py +645 -0
- pulumi_snowflake/api_authentication_integration_with_jwt_bearer.py +680 -0
- pulumi_snowflake/cortex_search_service.py +563 -0
- pulumi_snowflake/database.py +854 -232
- pulumi_snowflake/database_old.py +556 -0
- pulumi_snowflake/external_oauth_integration.py +562 -534
- pulumi_snowflake/failover_group.py +2 -2
- pulumi_snowflake/get_cortex_search_services.py +197 -0
- pulumi_snowflake/get_databases.py +71 -62
- pulumi_snowflake/get_network_policies.py +122 -0
- pulumi_snowflake/get_roles.py +37 -31
- pulumi_snowflake/get_schemas.py +115 -38
- pulumi_snowflake/get_security_integrations.py +122 -0
- pulumi_snowflake/get_streamlits.py +159 -0
- pulumi_snowflake/get_warehouses.py +66 -18
- pulumi_snowflake/grant_privileges_to_database_role.py +0 -4
- pulumi_snowflake/managed_account.py +7 -7
- pulumi_snowflake/network_policy.py +103 -19
- pulumi_snowflake/oauth_integration.py +4 -0
- pulumi_snowflake/oauth_integration_for_custom_clients.py +940 -0
- pulumi_snowflake/oauth_integration_for_partner_applications.py +584 -0
- pulumi_snowflake/outputs.py +16178 -2927
- pulumi_snowflake/pulumi-plugin.json +1 -1
- pulumi_snowflake/role.py +44 -72
- pulumi_snowflake/saml2_integration.py +975 -0
- pulumi_snowflake/saml_integration.py +4 -0
- pulumi_snowflake/schema.py +905 -151
- pulumi_snowflake/scim_integration.py +257 -103
- pulumi_snowflake/secondary_database.py +1059 -0
- pulumi_snowflake/sequence.py +6 -6
- pulumi_snowflake/shared_database.py +914 -0
- pulumi_snowflake/streamlit.py +650 -0
- pulumi_snowflake/table.py +0 -120
- pulumi_snowflake/table_constraint.py +2 -2
- pulumi_snowflake/tag_association.py +38 -38
- pulumi_snowflake/unsafe_execute.py +8 -8
- pulumi_snowflake/user_password_policy_attachment.py +32 -0
- pulumi_snowflake/warehouse.py +143 -120
- {pulumi_snowflake-0.56.0a1721327760.dist-info → pulumi_snowflake-0.57.0.dist-info}/METADATA +1 -1
- {pulumi_snowflake-0.56.0a1721327760.dist-info → pulumi_snowflake-0.57.0.dist-info}/RECORD +47 -58
- {pulumi_snowflake-0.56.0a1721327760.dist-info → pulumi_snowflake-0.57.0.dist-info}/WHEEL +1 -1
- pulumi_snowflake/account_grant.py +0 -319
- pulumi_snowflake/database_grant.py +0 -471
- pulumi_snowflake/external_table_grant.py +0 -666
- pulumi_snowflake/failover_group_grant.py +0 -368
- pulumi_snowflake/file_format_grant.py +0 -611
- pulumi_snowflake/function_grant.py +0 -721
- pulumi_snowflake/grant_privileges_to_role.py +0 -821
- pulumi_snowflake/integration_grant.py +0 -416
- pulumi_snowflake/masking_policy_grant.py +0 -518
- pulumi_snowflake/materialized_view_grant.py +0 -665
- pulumi_snowflake/pipe_grant.py +0 -563
- pulumi_snowflake/procedure_grant.py +0 -721
- pulumi_snowflake/resource_monitor_grant.py +0 -363
- pulumi_snowflake/role_grants.py +0 -340
- pulumi_snowflake/role_ownership_grant.py +0 -329
- pulumi_snowflake/row_access_policy_grant.py +0 -516
- pulumi_snowflake/schema_grant.py +0 -603
- pulumi_snowflake/sequence_grant.py +0 -611
- pulumi_snowflake/stage_grant.py +0 -611
- pulumi_snowflake/stream_grant.py +0 -611
- pulumi_snowflake/table_grant.py +0 -653
- pulumi_snowflake/tag_grant.py +0 -508
- pulumi_snowflake/task_grant.py +0 -611
- pulumi_snowflake/user_grant.py +0 -370
- pulumi_snowflake/user_ownership_grant.py +0 -275
- pulumi_snowflake/view_grant.py +0 -685
- pulumi_snowflake/warehouse_grant.py +0 -416
- {pulumi_snowflake-0.56.0a1721327760.dist-info → pulumi_snowflake-0.57.0.dist-info}/top_level.txt +0 -0
|
@@ -8,6 +8,8 @@ import pulumi
|
|
|
8
8
|
import pulumi.runtime
|
|
9
9
|
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
10
10
|
from . import _utilities
|
|
11
|
+
from . import outputs
|
|
12
|
+
from ._inputs import *
|
|
11
13
|
|
|
12
14
|
__all__ = ['ExternalOauthIntegrationArgs', 'ExternalOauthIntegration']
|
|
13
15
|
|
|
@@ -15,67 +17,67 @@ __all__ = ['ExternalOauthIntegrationArgs', 'ExternalOauthIntegration']
|
|
|
15
17
|
class ExternalOauthIntegrationArgs:
|
|
16
18
|
def __init__(__self__, *,
|
|
17
19
|
enabled: pulumi.Input[bool],
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
23
|
-
any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
24
|
-
audience_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
25
|
-
blocked_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
20
|
+
external_oauth_issuer: pulumi.Input[str],
|
|
21
|
+
external_oauth_snowflake_user_mapping_attribute: pulumi.Input[str],
|
|
22
|
+
external_oauth_token_user_mapping_claims: pulumi.Input[Sequence[pulumi.Input[str]]],
|
|
23
|
+
external_oauth_type: pulumi.Input[str],
|
|
26
24
|
comment: Optional[pulumi.Input[str]] = None,
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
25
|
+
external_oauth_allowed_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
26
|
+
external_oauth_any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
27
|
+
external_oauth_audience_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
28
|
+
external_oauth_blocked_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
29
|
+
external_oauth_jws_keys_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
30
|
+
external_oauth_rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
31
|
+
external_oauth_rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
32
|
+
external_oauth_scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
33
|
+
external_oauth_scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
34
|
+
name: Optional[pulumi.Input[str]] = None):
|
|
33
35
|
"""
|
|
34
36
|
The set of arguments for constructing a ExternalOauthIntegration resource.
|
|
35
37
|
:param pulumi.Input[bool] enabled: Specifies whether to initiate operation of the integration or suspend it.
|
|
36
|
-
:param pulumi.Input[str]
|
|
37
|
-
:param pulumi.Input[str]
|
|
38
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]]
|
|
39
|
-
:param pulumi.Input[str]
|
|
40
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: Specifies the list of roles that the client can set as the primary role.
|
|
41
|
-
:param pulumi.Input[str] any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token.
|
|
42
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] audience_urls: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
43
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] blocked_roles: Specifies the list of roles that a client cannot set as the primary role. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
|
|
38
|
+
:param pulumi.Input[str] external_oauth_issuer: Specifies the URL to define the OAuth 2.0 authorization server.
|
|
39
|
+
:param pulumi.Input[str] external_oauth_snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
40
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
41
|
+
:param pulumi.Input[str] external_oauth_type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
44
42
|
:param pulumi.Input[str] comment: Specifies a comment for the OAuth integration.
|
|
45
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]]
|
|
43
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_allowed_roles_lists: Specifies the list of roles that the client can set as the primary role.
|
|
44
|
+
:param pulumi.Input[str] external_oauth_any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
45
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_audience_lists: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
46
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_blocked_roles_lists: Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
47
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_jws_keys_urls: Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
48
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
49
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
50
|
+
:param pulumi.Input[str] external_oauth_scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
51
|
+
:param pulumi.Input[str] external_oauth_scope_mapping_attribute: Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
46
52
|
:param pulumi.Input[str] name: Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
47
|
-
:param pulumi.Input[str] rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers.
|
|
48
|
-
:param pulumi.Input[str] rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation.
|
|
49
|
-
:param pulumi.Input[str] scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
50
|
-
:param pulumi.Input[str] scope_mapping_attribute: Specifies the access token claim to map the access token to an account role.
|
|
51
53
|
"""
|
|
52
54
|
pulumi.set(__self__, "enabled", enabled)
|
|
53
|
-
pulumi.set(__self__, "
|
|
54
|
-
pulumi.set(__self__, "
|
|
55
|
-
pulumi.set(__self__, "
|
|
56
|
-
pulumi.set(__self__, "
|
|
57
|
-
if allowed_roles is not None:
|
|
58
|
-
pulumi.set(__self__, "allowed_roles", allowed_roles)
|
|
59
|
-
if any_role_mode is not None:
|
|
60
|
-
pulumi.set(__self__, "any_role_mode", any_role_mode)
|
|
61
|
-
if audience_urls is not None:
|
|
62
|
-
pulumi.set(__self__, "audience_urls", audience_urls)
|
|
63
|
-
if blocked_roles is not None:
|
|
64
|
-
pulumi.set(__self__, "blocked_roles", blocked_roles)
|
|
55
|
+
pulumi.set(__self__, "external_oauth_issuer", external_oauth_issuer)
|
|
56
|
+
pulumi.set(__self__, "external_oauth_snowflake_user_mapping_attribute", external_oauth_snowflake_user_mapping_attribute)
|
|
57
|
+
pulumi.set(__self__, "external_oauth_token_user_mapping_claims", external_oauth_token_user_mapping_claims)
|
|
58
|
+
pulumi.set(__self__, "external_oauth_type", external_oauth_type)
|
|
65
59
|
if comment is not None:
|
|
66
60
|
pulumi.set(__self__, "comment", comment)
|
|
67
|
-
if
|
|
68
|
-
pulumi.set(__self__, "
|
|
61
|
+
if external_oauth_allowed_roles_lists is not None:
|
|
62
|
+
pulumi.set(__self__, "external_oauth_allowed_roles_lists", external_oauth_allowed_roles_lists)
|
|
63
|
+
if external_oauth_any_role_mode is not None:
|
|
64
|
+
pulumi.set(__self__, "external_oauth_any_role_mode", external_oauth_any_role_mode)
|
|
65
|
+
if external_oauth_audience_lists is not None:
|
|
66
|
+
pulumi.set(__self__, "external_oauth_audience_lists", external_oauth_audience_lists)
|
|
67
|
+
if external_oauth_blocked_roles_lists is not None:
|
|
68
|
+
pulumi.set(__self__, "external_oauth_blocked_roles_lists", external_oauth_blocked_roles_lists)
|
|
69
|
+
if external_oauth_jws_keys_urls is not None:
|
|
70
|
+
pulumi.set(__self__, "external_oauth_jws_keys_urls", external_oauth_jws_keys_urls)
|
|
71
|
+
if external_oauth_rsa_public_key is not None:
|
|
72
|
+
pulumi.set(__self__, "external_oauth_rsa_public_key", external_oauth_rsa_public_key)
|
|
73
|
+
if external_oauth_rsa_public_key2 is not None:
|
|
74
|
+
pulumi.set(__self__, "external_oauth_rsa_public_key2", external_oauth_rsa_public_key2)
|
|
75
|
+
if external_oauth_scope_delimiter is not None:
|
|
76
|
+
pulumi.set(__self__, "external_oauth_scope_delimiter", external_oauth_scope_delimiter)
|
|
77
|
+
if external_oauth_scope_mapping_attribute is not None:
|
|
78
|
+
pulumi.set(__self__, "external_oauth_scope_mapping_attribute", external_oauth_scope_mapping_attribute)
|
|
69
79
|
if name is not None:
|
|
70
80
|
pulumi.set(__self__, "name", name)
|
|
71
|
-
if rsa_public_key is not None:
|
|
72
|
-
pulumi.set(__self__, "rsa_public_key", rsa_public_key)
|
|
73
|
-
if rsa_public_key2 is not None:
|
|
74
|
-
pulumi.set(__self__, "rsa_public_key2", rsa_public_key2)
|
|
75
|
-
if scope_delimiter is not None:
|
|
76
|
-
pulumi.set(__self__, "scope_delimiter", scope_delimiter)
|
|
77
|
-
if scope_mapping_attribute is not None:
|
|
78
|
-
pulumi.set(__self__, "scope_mapping_attribute", scope_mapping_attribute)
|
|
79
81
|
|
|
80
82
|
@property
|
|
81
83
|
@pulumi.getter
|
|
@@ -90,464 +92,496 @@ class ExternalOauthIntegrationArgs:
|
|
|
90
92
|
pulumi.set(self, "enabled", value)
|
|
91
93
|
|
|
92
94
|
@property
|
|
93
|
-
@pulumi.getter
|
|
94
|
-
def
|
|
95
|
+
@pulumi.getter(name="externalOauthIssuer")
|
|
96
|
+
def external_oauth_issuer(self) -> pulumi.Input[str]:
|
|
95
97
|
"""
|
|
96
98
|
Specifies the URL to define the OAuth 2.0 authorization server.
|
|
97
99
|
"""
|
|
98
|
-
return pulumi.get(self, "
|
|
100
|
+
return pulumi.get(self, "external_oauth_issuer")
|
|
99
101
|
|
|
100
|
-
@
|
|
101
|
-
def
|
|
102
|
-
pulumi.set(self, "
|
|
102
|
+
@external_oauth_issuer.setter
|
|
103
|
+
def external_oauth_issuer(self, value: pulumi.Input[str]):
|
|
104
|
+
pulumi.set(self, "external_oauth_issuer", value)
|
|
103
105
|
|
|
104
106
|
@property
|
|
105
|
-
@pulumi.getter(name="
|
|
106
|
-
def
|
|
107
|
+
@pulumi.getter(name="externalOauthSnowflakeUserMappingAttribute")
|
|
108
|
+
def external_oauth_snowflake_user_mapping_attribute(self) -> pulumi.Input[str]:
|
|
107
109
|
"""
|
|
108
|
-
Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record.
|
|
110
|
+
Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
109
111
|
"""
|
|
110
|
-
return pulumi.get(self, "
|
|
112
|
+
return pulumi.get(self, "external_oauth_snowflake_user_mapping_attribute")
|
|
111
113
|
|
|
112
|
-
@
|
|
113
|
-
def
|
|
114
|
-
pulumi.set(self, "
|
|
114
|
+
@external_oauth_snowflake_user_mapping_attribute.setter
|
|
115
|
+
def external_oauth_snowflake_user_mapping_attribute(self, value: pulumi.Input[str]):
|
|
116
|
+
pulumi.set(self, "external_oauth_snowflake_user_mapping_attribute", value)
|
|
115
117
|
|
|
116
118
|
@property
|
|
117
|
-
@pulumi.getter(name="
|
|
118
|
-
def
|
|
119
|
+
@pulumi.getter(name="externalOauthTokenUserMappingClaims")
|
|
120
|
+
def external_oauth_token_user_mapping_claims(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
|
|
119
121
|
"""
|
|
120
|
-
Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record.
|
|
122
|
+
Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
121
123
|
"""
|
|
122
|
-
return pulumi.get(self, "
|
|
124
|
+
return pulumi.get(self, "external_oauth_token_user_mapping_claims")
|
|
123
125
|
|
|
124
|
-
@
|
|
125
|
-
def
|
|
126
|
-
pulumi.set(self, "
|
|
126
|
+
@external_oauth_token_user_mapping_claims.setter
|
|
127
|
+
def external_oauth_token_user_mapping_claims(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
|
|
128
|
+
pulumi.set(self, "external_oauth_token_user_mapping_claims", value)
|
|
127
129
|
|
|
128
130
|
@property
|
|
129
|
-
@pulumi.getter
|
|
130
|
-
def
|
|
131
|
+
@pulumi.getter(name="externalOauthType")
|
|
132
|
+
def external_oauth_type(self) -> pulumi.Input[str]:
|
|
131
133
|
"""
|
|
132
|
-
Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server.
|
|
134
|
+
Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
133
135
|
"""
|
|
134
|
-
return pulumi.get(self, "
|
|
136
|
+
return pulumi.get(self, "external_oauth_type")
|
|
135
137
|
|
|
136
|
-
@
|
|
137
|
-
def
|
|
138
|
-
pulumi.set(self, "
|
|
138
|
+
@external_oauth_type.setter
|
|
139
|
+
def external_oauth_type(self, value: pulumi.Input[str]):
|
|
140
|
+
pulumi.set(self, "external_oauth_type", value)
|
|
139
141
|
|
|
140
142
|
@property
|
|
141
|
-
@pulumi.getter
|
|
142
|
-
def
|
|
143
|
+
@pulumi.getter
|
|
144
|
+
def comment(self) -> Optional[pulumi.Input[str]]:
|
|
143
145
|
"""
|
|
144
|
-
Specifies
|
|
146
|
+
Specifies a comment for the OAuth integration.
|
|
145
147
|
"""
|
|
146
|
-
return pulumi.get(self, "
|
|
148
|
+
return pulumi.get(self, "comment")
|
|
147
149
|
|
|
148
|
-
@
|
|
149
|
-
def
|
|
150
|
-
pulumi.set(self, "
|
|
150
|
+
@comment.setter
|
|
151
|
+
def comment(self, value: Optional[pulumi.Input[str]]):
|
|
152
|
+
pulumi.set(self, "comment", value)
|
|
151
153
|
|
|
152
154
|
@property
|
|
153
|
-
@pulumi.getter(name="
|
|
154
|
-
def
|
|
155
|
+
@pulumi.getter(name="externalOauthAllowedRolesLists")
|
|
156
|
+
def external_oauth_allowed_roles_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
155
157
|
"""
|
|
156
|
-
Specifies
|
|
158
|
+
Specifies the list of roles that the client can set as the primary role.
|
|
157
159
|
"""
|
|
158
|
-
return pulumi.get(self, "
|
|
160
|
+
return pulumi.get(self, "external_oauth_allowed_roles_lists")
|
|
159
161
|
|
|
160
|
-
@
|
|
161
|
-
def
|
|
162
|
-
pulumi.set(self, "
|
|
162
|
+
@external_oauth_allowed_roles_lists.setter
|
|
163
|
+
def external_oauth_allowed_roles_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
164
|
+
pulumi.set(self, "external_oauth_allowed_roles_lists", value)
|
|
163
165
|
|
|
164
166
|
@property
|
|
165
|
-
@pulumi.getter(name="
|
|
166
|
-
def
|
|
167
|
+
@pulumi.getter(name="externalOauthAnyRoleMode")
|
|
168
|
+
def external_oauth_any_role_mode(self) -> Optional[pulumi.Input[str]]:
|
|
167
169
|
"""
|
|
168
|
-
Specifies
|
|
170
|
+
Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
169
171
|
"""
|
|
170
|
-
return pulumi.get(self, "
|
|
172
|
+
return pulumi.get(self, "external_oauth_any_role_mode")
|
|
171
173
|
|
|
172
|
-
@
|
|
173
|
-
def
|
|
174
|
-
pulumi.set(self, "
|
|
174
|
+
@external_oauth_any_role_mode.setter
|
|
175
|
+
def external_oauth_any_role_mode(self, value: Optional[pulumi.Input[str]]):
|
|
176
|
+
pulumi.set(self, "external_oauth_any_role_mode", value)
|
|
175
177
|
|
|
176
178
|
@property
|
|
177
|
-
@pulumi.getter(name="
|
|
178
|
-
def
|
|
179
|
+
@pulumi.getter(name="externalOauthAudienceLists")
|
|
180
|
+
def external_oauth_audience_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
179
181
|
"""
|
|
180
|
-
Specifies
|
|
182
|
+
Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
181
183
|
"""
|
|
182
|
-
return pulumi.get(self, "
|
|
184
|
+
return pulumi.get(self, "external_oauth_audience_lists")
|
|
183
185
|
|
|
184
|
-
@
|
|
185
|
-
def
|
|
186
|
-
pulumi.set(self, "
|
|
186
|
+
@external_oauth_audience_lists.setter
|
|
187
|
+
def external_oauth_audience_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
188
|
+
pulumi.set(self, "external_oauth_audience_lists", value)
|
|
187
189
|
|
|
188
190
|
@property
|
|
189
|
-
@pulumi.getter
|
|
190
|
-
def
|
|
191
|
+
@pulumi.getter(name="externalOauthBlockedRolesLists")
|
|
192
|
+
def external_oauth_blocked_roles_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
191
193
|
"""
|
|
192
|
-
Specifies a
|
|
194
|
+
Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
193
195
|
"""
|
|
194
|
-
return pulumi.get(self, "
|
|
196
|
+
return pulumi.get(self, "external_oauth_blocked_roles_lists")
|
|
195
197
|
|
|
196
|
-
@
|
|
197
|
-
def
|
|
198
|
-
pulumi.set(self, "
|
|
198
|
+
@external_oauth_blocked_roles_lists.setter
|
|
199
|
+
def external_oauth_blocked_roles_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
200
|
+
pulumi.set(self, "external_oauth_blocked_roles_lists", value)
|
|
199
201
|
|
|
200
202
|
@property
|
|
201
|
-
@pulumi.getter(name="
|
|
202
|
-
def
|
|
203
|
+
@pulumi.getter(name="externalOauthJwsKeysUrls")
|
|
204
|
+
def external_oauth_jws_keys_urls(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
203
205
|
"""
|
|
204
|
-
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3.
|
|
206
|
+
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
205
207
|
"""
|
|
206
|
-
return pulumi.get(self, "
|
|
208
|
+
return pulumi.get(self, "external_oauth_jws_keys_urls")
|
|
207
209
|
|
|
208
|
-
@
|
|
209
|
-
def
|
|
210
|
-
pulumi.set(self, "
|
|
210
|
+
@external_oauth_jws_keys_urls.setter
|
|
211
|
+
def external_oauth_jws_keys_urls(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
212
|
+
pulumi.set(self, "external_oauth_jws_keys_urls", value)
|
|
211
213
|
|
|
212
214
|
@property
|
|
213
|
-
@pulumi.getter
|
|
214
|
-
def
|
|
215
|
+
@pulumi.getter(name="externalOauthRsaPublicKey")
|
|
216
|
+
def external_oauth_rsa_public_key(self) -> Optional[pulumi.Input[str]]:
|
|
215
217
|
"""
|
|
216
|
-
Specifies
|
|
218
|
+
Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
217
219
|
"""
|
|
218
|
-
return pulumi.get(self, "
|
|
220
|
+
return pulumi.get(self, "external_oauth_rsa_public_key")
|
|
219
221
|
|
|
220
|
-
@
|
|
221
|
-
def
|
|
222
|
-
pulumi.set(self, "
|
|
222
|
+
@external_oauth_rsa_public_key.setter
|
|
223
|
+
def external_oauth_rsa_public_key(self, value: Optional[pulumi.Input[str]]):
|
|
224
|
+
pulumi.set(self, "external_oauth_rsa_public_key", value)
|
|
223
225
|
|
|
224
226
|
@property
|
|
225
|
-
@pulumi.getter(name="
|
|
226
|
-
def
|
|
227
|
+
@pulumi.getter(name="externalOauthRsaPublicKey2")
|
|
228
|
+
def external_oauth_rsa_public_key2(self) -> Optional[pulumi.Input[str]]:
|
|
227
229
|
"""
|
|
228
|
-
Specifies a
|
|
230
|
+
Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
229
231
|
"""
|
|
230
|
-
return pulumi.get(self, "
|
|
232
|
+
return pulumi.get(self, "external_oauth_rsa_public_key2")
|
|
231
233
|
|
|
232
|
-
@
|
|
233
|
-
def
|
|
234
|
-
pulumi.set(self, "
|
|
234
|
+
@external_oauth_rsa_public_key2.setter
|
|
235
|
+
def external_oauth_rsa_public_key2(self, value: Optional[pulumi.Input[str]]):
|
|
236
|
+
pulumi.set(self, "external_oauth_rsa_public_key2", value)
|
|
235
237
|
|
|
236
238
|
@property
|
|
237
|
-
@pulumi.getter(name="
|
|
238
|
-
def
|
|
239
|
+
@pulumi.getter(name="externalOauthScopeDelimiter")
|
|
240
|
+
def external_oauth_scope_delimiter(self) -> Optional[pulumi.Input[str]]:
|
|
239
241
|
"""
|
|
240
|
-
Specifies
|
|
242
|
+
Specifies the scope delimiter in the authorization token.
|
|
241
243
|
"""
|
|
242
|
-
return pulumi.get(self, "
|
|
244
|
+
return pulumi.get(self, "external_oauth_scope_delimiter")
|
|
243
245
|
|
|
244
|
-
@
|
|
245
|
-
def
|
|
246
|
-
pulumi.set(self, "
|
|
246
|
+
@external_oauth_scope_delimiter.setter
|
|
247
|
+
def external_oauth_scope_delimiter(self, value: Optional[pulumi.Input[str]]):
|
|
248
|
+
pulumi.set(self, "external_oauth_scope_delimiter", value)
|
|
247
249
|
|
|
248
250
|
@property
|
|
249
|
-
@pulumi.getter(name="
|
|
250
|
-
def
|
|
251
|
+
@pulumi.getter(name="externalOauthScopeMappingAttribute")
|
|
252
|
+
def external_oauth_scope_mapping_attribute(self) -> Optional[pulumi.Input[str]]:
|
|
251
253
|
"""
|
|
252
|
-
Specifies the
|
|
254
|
+
Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
253
255
|
"""
|
|
254
|
-
return pulumi.get(self, "
|
|
256
|
+
return pulumi.get(self, "external_oauth_scope_mapping_attribute")
|
|
255
257
|
|
|
256
|
-
@
|
|
257
|
-
def
|
|
258
|
-
pulumi.set(self, "
|
|
258
|
+
@external_oauth_scope_mapping_attribute.setter
|
|
259
|
+
def external_oauth_scope_mapping_attribute(self, value: Optional[pulumi.Input[str]]):
|
|
260
|
+
pulumi.set(self, "external_oauth_scope_mapping_attribute", value)
|
|
259
261
|
|
|
260
262
|
@property
|
|
261
|
-
@pulumi.getter
|
|
262
|
-
def
|
|
263
|
+
@pulumi.getter
|
|
264
|
+
def name(self) -> Optional[pulumi.Input[str]]:
|
|
263
265
|
"""
|
|
264
|
-
Specifies the
|
|
266
|
+
Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
265
267
|
"""
|
|
266
|
-
return pulumi.get(self, "
|
|
268
|
+
return pulumi.get(self, "name")
|
|
267
269
|
|
|
268
|
-
@
|
|
269
|
-
def
|
|
270
|
-
pulumi.set(self, "
|
|
270
|
+
@name.setter
|
|
271
|
+
def name(self, value: Optional[pulumi.Input[str]]):
|
|
272
|
+
pulumi.set(self, "name", value)
|
|
271
273
|
|
|
272
274
|
|
|
273
275
|
@pulumi.input_type
|
|
274
276
|
class _ExternalOauthIntegrationState:
|
|
275
277
|
def __init__(__self__, *,
|
|
276
|
-
allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
277
|
-
any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
278
|
-
audience_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
279
|
-
blocked_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
280
278
|
comment: Optional[pulumi.Input[str]] = None,
|
|
281
|
-
|
|
279
|
+
describe_outputs: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationDescribeOutputArgs']]]] = None,
|
|
282
280
|
enabled: Optional[pulumi.Input[bool]] = None,
|
|
283
|
-
|
|
284
|
-
|
|
281
|
+
external_oauth_allowed_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
282
|
+
external_oauth_any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
283
|
+
external_oauth_audience_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
284
|
+
external_oauth_blocked_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
285
|
+
external_oauth_issuer: Optional[pulumi.Input[str]] = None,
|
|
286
|
+
external_oauth_jws_keys_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
287
|
+
external_oauth_rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
288
|
+
external_oauth_rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
289
|
+
external_oauth_scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
290
|
+
external_oauth_scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
291
|
+
external_oauth_snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
292
|
+
external_oauth_token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
293
|
+
external_oauth_type: Optional[pulumi.Input[str]] = None,
|
|
285
294
|
name: Optional[pulumi.Input[str]] = None,
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
289
|
-
scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
290
|
-
snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
291
|
-
token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
292
|
-
type: Optional[pulumi.Input[str]] = None):
|
|
295
|
+
related_parameters: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationRelatedParameterArgs']]]] = None,
|
|
296
|
+
show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationShowOutputArgs']]]] = None):
|
|
293
297
|
"""
|
|
294
298
|
Input properties used for looking up and filtering ExternalOauthIntegration resources.
|
|
295
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: Specifies the list of roles that the client can set as the primary role.
|
|
296
|
-
:param pulumi.Input[str] any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token.
|
|
297
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] audience_urls: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
298
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] blocked_roles: Specifies the list of roles that a client cannot set as the primary role. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
|
|
299
299
|
:param pulumi.Input[str] comment: Specifies a comment for the OAuth integration.
|
|
300
|
-
:param pulumi.Input[
|
|
300
|
+
:param pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationDescribeOutputArgs']]] describe_outputs: Outputs the result of `DESCRIBE SECURITY INTEGRATIONS` for the given security integration.
|
|
301
301
|
:param pulumi.Input[bool] enabled: Specifies whether to initiate operation of the integration or suspend it.
|
|
302
|
-
:param pulumi.Input[str]
|
|
303
|
-
:param pulumi.Input[
|
|
302
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_allowed_roles_lists: Specifies the list of roles that the client can set as the primary role.
|
|
303
|
+
:param pulumi.Input[str] external_oauth_any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
304
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_audience_lists: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
305
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_blocked_roles_lists: Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
306
|
+
:param pulumi.Input[str] external_oauth_issuer: Specifies the URL to define the OAuth 2.0 authorization server.
|
|
307
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_jws_keys_urls: Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
308
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
309
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
310
|
+
:param pulumi.Input[str] external_oauth_scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
311
|
+
:param pulumi.Input[str] external_oauth_scope_mapping_attribute: Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
312
|
+
:param pulumi.Input[str] external_oauth_snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
313
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
314
|
+
:param pulumi.Input[str] external_oauth_type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
304
315
|
:param pulumi.Input[str] name: Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
305
|
-
:param pulumi.Input[
|
|
306
|
-
:param pulumi.Input[
|
|
307
|
-
|
|
308
|
-
:param pulumi.Input[str] scope_mapping_attribute: Specifies the access token claim to map the access token to an account role.
|
|
309
|
-
:param pulumi.Input[str] snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record.
|
|
310
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record.
|
|
311
|
-
:param pulumi.Input[str] type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server.
|
|
312
|
-
"""
|
|
313
|
-
if allowed_roles is not None:
|
|
314
|
-
pulumi.set(__self__, "allowed_roles", allowed_roles)
|
|
315
|
-
if any_role_mode is not None:
|
|
316
|
-
pulumi.set(__self__, "any_role_mode", any_role_mode)
|
|
317
|
-
if audience_urls is not None:
|
|
318
|
-
pulumi.set(__self__, "audience_urls", audience_urls)
|
|
319
|
-
if blocked_roles is not None:
|
|
320
|
-
pulumi.set(__self__, "blocked_roles", blocked_roles)
|
|
316
|
+
:param pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationRelatedParameterArgs']]] related_parameters: Paramteres related to this security integration.
|
|
317
|
+
:param pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationShowOutputArgs']]] show_outputs: Outputs the result of `SHOW SECURITY INTEGRATIONS` for the given security integration.
|
|
318
|
+
"""
|
|
321
319
|
if comment is not None:
|
|
322
320
|
pulumi.set(__self__, "comment", comment)
|
|
323
|
-
if
|
|
324
|
-
pulumi.set(__self__, "
|
|
321
|
+
if describe_outputs is not None:
|
|
322
|
+
pulumi.set(__self__, "describe_outputs", describe_outputs)
|
|
325
323
|
if enabled is not None:
|
|
326
324
|
pulumi.set(__self__, "enabled", enabled)
|
|
327
|
-
if
|
|
328
|
-
pulumi.set(__self__, "
|
|
329
|
-
if
|
|
330
|
-
pulumi.set(__self__, "
|
|
325
|
+
if external_oauth_allowed_roles_lists is not None:
|
|
326
|
+
pulumi.set(__self__, "external_oauth_allowed_roles_lists", external_oauth_allowed_roles_lists)
|
|
327
|
+
if external_oauth_any_role_mode is not None:
|
|
328
|
+
pulumi.set(__self__, "external_oauth_any_role_mode", external_oauth_any_role_mode)
|
|
329
|
+
if external_oauth_audience_lists is not None:
|
|
330
|
+
pulumi.set(__self__, "external_oauth_audience_lists", external_oauth_audience_lists)
|
|
331
|
+
if external_oauth_blocked_roles_lists is not None:
|
|
332
|
+
pulumi.set(__self__, "external_oauth_blocked_roles_lists", external_oauth_blocked_roles_lists)
|
|
333
|
+
if external_oauth_issuer is not None:
|
|
334
|
+
pulumi.set(__self__, "external_oauth_issuer", external_oauth_issuer)
|
|
335
|
+
if external_oauth_jws_keys_urls is not None:
|
|
336
|
+
pulumi.set(__self__, "external_oauth_jws_keys_urls", external_oauth_jws_keys_urls)
|
|
337
|
+
if external_oauth_rsa_public_key is not None:
|
|
338
|
+
pulumi.set(__self__, "external_oauth_rsa_public_key", external_oauth_rsa_public_key)
|
|
339
|
+
if external_oauth_rsa_public_key2 is not None:
|
|
340
|
+
pulumi.set(__self__, "external_oauth_rsa_public_key2", external_oauth_rsa_public_key2)
|
|
341
|
+
if external_oauth_scope_delimiter is not None:
|
|
342
|
+
pulumi.set(__self__, "external_oauth_scope_delimiter", external_oauth_scope_delimiter)
|
|
343
|
+
if external_oauth_scope_mapping_attribute is not None:
|
|
344
|
+
pulumi.set(__self__, "external_oauth_scope_mapping_attribute", external_oauth_scope_mapping_attribute)
|
|
345
|
+
if external_oauth_snowflake_user_mapping_attribute is not None:
|
|
346
|
+
pulumi.set(__self__, "external_oauth_snowflake_user_mapping_attribute", external_oauth_snowflake_user_mapping_attribute)
|
|
347
|
+
if external_oauth_token_user_mapping_claims is not None:
|
|
348
|
+
pulumi.set(__self__, "external_oauth_token_user_mapping_claims", external_oauth_token_user_mapping_claims)
|
|
349
|
+
if external_oauth_type is not None:
|
|
350
|
+
pulumi.set(__self__, "external_oauth_type", external_oauth_type)
|
|
331
351
|
if name is not None:
|
|
332
352
|
pulumi.set(__self__, "name", name)
|
|
333
|
-
if
|
|
334
|
-
pulumi.set(__self__, "
|
|
335
|
-
if
|
|
336
|
-
pulumi.set(__self__, "
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
if snowflake_user_mapping_attribute is not None:
|
|
342
|
-
pulumi.set(__self__, "snowflake_user_mapping_attribute", snowflake_user_mapping_attribute)
|
|
343
|
-
if token_user_mapping_claims is not None:
|
|
344
|
-
pulumi.set(__self__, "token_user_mapping_claims", token_user_mapping_claims)
|
|
345
|
-
if type is not None:
|
|
346
|
-
pulumi.set(__self__, "type", type)
|
|
347
|
-
|
|
348
|
-
@property
|
|
349
|
-
@pulumi.getter(name="allowedRoles")
|
|
350
|
-
def allowed_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
353
|
+
if related_parameters is not None:
|
|
354
|
+
pulumi.set(__self__, "related_parameters", related_parameters)
|
|
355
|
+
if show_outputs is not None:
|
|
356
|
+
pulumi.set(__self__, "show_outputs", show_outputs)
|
|
357
|
+
|
|
358
|
+
@property
|
|
359
|
+
@pulumi.getter
|
|
360
|
+
def comment(self) -> Optional[pulumi.Input[str]]:
|
|
351
361
|
"""
|
|
352
|
-
Specifies
|
|
362
|
+
Specifies a comment for the OAuth integration.
|
|
353
363
|
"""
|
|
354
|
-
return pulumi.get(self, "
|
|
364
|
+
return pulumi.get(self, "comment")
|
|
355
365
|
|
|
356
|
-
@
|
|
357
|
-
def
|
|
358
|
-
pulumi.set(self, "
|
|
366
|
+
@comment.setter
|
|
367
|
+
def comment(self, value: Optional[pulumi.Input[str]]):
|
|
368
|
+
pulumi.set(self, "comment", value)
|
|
359
369
|
|
|
360
370
|
@property
|
|
361
|
-
@pulumi.getter(name="
|
|
362
|
-
def
|
|
371
|
+
@pulumi.getter(name="describeOutputs")
|
|
372
|
+
def describe_outputs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationDescribeOutputArgs']]]]:
|
|
363
373
|
"""
|
|
364
|
-
|
|
374
|
+
Outputs the result of `DESCRIBE SECURITY INTEGRATIONS` for the given security integration.
|
|
365
375
|
"""
|
|
366
|
-
return pulumi.get(self, "
|
|
376
|
+
return pulumi.get(self, "describe_outputs")
|
|
367
377
|
|
|
368
|
-
@
|
|
369
|
-
def
|
|
370
|
-
pulumi.set(self, "
|
|
378
|
+
@describe_outputs.setter
|
|
379
|
+
def describe_outputs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationDescribeOutputArgs']]]]):
|
|
380
|
+
pulumi.set(self, "describe_outputs", value)
|
|
371
381
|
|
|
372
382
|
@property
|
|
373
|
-
@pulumi.getter
|
|
374
|
-
def
|
|
383
|
+
@pulumi.getter
|
|
384
|
+
def enabled(self) -> Optional[pulumi.Input[bool]]:
|
|
375
385
|
"""
|
|
376
|
-
Specifies
|
|
386
|
+
Specifies whether to initiate operation of the integration or suspend it.
|
|
377
387
|
"""
|
|
378
|
-
return pulumi.get(self, "
|
|
388
|
+
return pulumi.get(self, "enabled")
|
|
379
389
|
|
|
380
|
-
@
|
|
381
|
-
def
|
|
382
|
-
pulumi.set(self, "
|
|
390
|
+
@enabled.setter
|
|
391
|
+
def enabled(self, value: Optional[pulumi.Input[bool]]):
|
|
392
|
+
pulumi.set(self, "enabled", value)
|
|
383
393
|
|
|
384
394
|
@property
|
|
385
|
-
@pulumi.getter(name="
|
|
386
|
-
def
|
|
395
|
+
@pulumi.getter(name="externalOauthAllowedRolesLists")
|
|
396
|
+
def external_oauth_allowed_roles_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
387
397
|
"""
|
|
388
|
-
Specifies the list of roles that
|
|
398
|
+
Specifies the list of roles that the client can set as the primary role.
|
|
389
399
|
"""
|
|
390
|
-
return pulumi.get(self, "
|
|
400
|
+
return pulumi.get(self, "external_oauth_allowed_roles_lists")
|
|
391
401
|
|
|
392
|
-
@
|
|
393
|
-
def
|
|
394
|
-
pulumi.set(self, "
|
|
402
|
+
@external_oauth_allowed_roles_lists.setter
|
|
403
|
+
def external_oauth_allowed_roles_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
404
|
+
pulumi.set(self, "external_oauth_allowed_roles_lists", value)
|
|
395
405
|
|
|
396
406
|
@property
|
|
397
|
-
@pulumi.getter
|
|
398
|
-
def
|
|
407
|
+
@pulumi.getter(name="externalOauthAnyRoleMode")
|
|
408
|
+
def external_oauth_any_role_mode(self) -> Optional[pulumi.Input[str]]:
|
|
399
409
|
"""
|
|
400
|
-
Specifies a
|
|
410
|
+
Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
401
411
|
"""
|
|
402
|
-
return pulumi.get(self, "
|
|
412
|
+
return pulumi.get(self, "external_oauth_any_role_mode")
|
|
403
413
|
|
|
404
|
-
@
|
|
405
|
-
def
|
|
406
|
-
pulumi.set(self, "
|
|
414
|
+
@external_oauth_any_role_mode.setter
|
|
415
|
+
def external_oauth_any_role_mode(self, value: Optional[pulumi.Input[str]]):
|
|
416
|
+
pulumi.set(self, "external_oauth_any_role_mode", value)
|
|
407
417
|
|
|
408
418
|
@property
|
|
409
|
-
@pulumi.getter(name="
|
|
410
|
-
def
|
|
419
|
+
@pulumi.getter(name="externalOauthAudienceLists")
|
|
420
|
+
def external_oauth_audience_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
411
421
|
"""
|
|
412
|
-
|
|
422
|
+
Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
413
423
|
"""
|
|
414
|
-
return pulumi.get(self, "
|
|
424
|
+
return pulumi.get(self, "external_oauth_audience_lists")
|
|
415
425
|
|
|
416
|
-
@
|
|
417
|
-
def
|
|
418
|
-
pulumi.set(self, "
|
|
426
|
+
@external_oauth_audience_lists.setter
|
|
427
|
+
def external_oauth_audience_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
428
|
+
pulumi.set(self, "external_oauth_audience_lists", value)
|
|
419
429
|
|
|
420
430
|
@property
|
|
421
|
-
@pulumi.getter
|
|
422
|
-
def
|
|
431
|
+
@pulumi.getter(name="externalOauthBlockedRolesLists")
|
|
432
|
+
def external_oauth_blocked_roles_lists(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
423
433
|
"""
|
|
424
|
-
Specifies
|
|
434
|
+
Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
425
435
|
"""
|
|
426
|
-
return pulumi.get(self, "
|
|
436
|
+
return pulumi.get(self, "external_oauth_blocked_roles_lists")
|
|
427
437
|
|
|
428
|
-
@
|
|
429
|
-
def
|
|
430
|
-
pulumi.set(self, "
|
|
438
|
+
@external_oauth_blocked_roles_lists.setter
|
|
439
|
+
def external_oauth_blocked_roles_lists(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
440
|
+
pulumi.set(self, "external_oauth_blocked_roles_lists", value)
|
|
431
441
|
|
|
432
442
|
@property
|
|
433
|
-
@pulumi.getter
|
|
434
|
-
def
|
|
443
|
+
@pulumi.getter(name="externalOauthIssuer")
|
|
444
|
+
def external_oauth_issuer(self) -> Optional[pulumi.Input[str]]:
|
|
435
445
|
"""
|
|
436
446
|
Specifies the URL to define the OAuth 2.0 authorization server.
|
|
437
447
|
"""
|
|
438
|
-
return pulumi.get(self, "
|
|
448
|
+
return pulumi.get(self, "external_oauth_issuer")
|
|
439
449
|
|
|
440
|
-
@
|
|
441
|
-
def
|
|
442
|
-
pulumi.set(self, "
|
|
450
|
+
@external_oauth_issuer.setter
|
|
451
|
+
def external_oauth_issuer(self, value: Optional[pulumi.Input[str]]):
|
|
452
|
+
pulumi.set(self, "external_oauth_issuer", value)
|
|
443
453
|
|
|
444
454
|
@property
|
|
445
|
-
@pulumi.getter(name="
|
|
446
|
-
def
|
|
455
|
+
@pulumi.getter(name="externalOauthJwsKeysUrls")
|
|
456
|
+
def external_oauth_jws_keys_urls(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
447
457
|
"""
|
|
448
|
-
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3.
|
|
458
|
+
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
449
459
|
"""
|
|
450
|
-
return pulumi.get(self, "
|
|
460
|
+
return pulumi.get(self, "external_oauth_jws_keys_urls")
|
|
451
461
|
|
|
452
|
-
@
|
|
453
|
-
def
|
|
454
|
-
pulumi.set(self, "
|
|
462
|
+
@external_oauth_jws_keys_urls.setter
|
|
463
|
+
def external_oauth_jws_keys_urls(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
464
|
+
pulumi.set(self, "external_oauth_jws_keys_urls", value)
|
|
455
465
|
|
|
456
466
|
@property
|
|
457
|
-
@pulumi.getter
|
|
458
|
-
def
|
|
467
|
+
@pulumi.getter(name="externalOauthRsaPublicKey")
|
|
468
|
+
def external_oauth_rsa_public_key(self) -> Optional[pulumi.Input[str]]:
|
|
459
469
|
"""
|
|
460
|
-
Specifies
|
|
470
|
+
Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
461
471
|
"""
|
|
462
|
-
return pulumi.get(self, "
|
|
472
|
+
return pulumi.get(self, "external_oauth_rsa_public_key")
|
|
463
473
|
|
|
464
|
-
@
|
|
465
|
-
def
|
|
466
|
-
pulumi.set(self, "
|
|
474
|
+
@external_oauth_rsa_public_key.setter
|
|
475
|
+
def external_oauth_rsa_public_key(self, value: Optional[pulumi.Input[str]]):
|
|
476
|
+
pulumi.set(self, "external_oauth_rsa_public_key", value)
|
|
467
477
|
|
|
468
478
|
@property
|
|
469
|
-
@pulumi.getter(name="
|
|
470
|
-
def
|
|
479
|
+
@pulumi.getter(name="externalOauthRsaPublicKey2")
|
|
480
|
+
def external_oauth_rsa_public_key2(self) -> Optional[pulumi.Input[str]]:
|
|
471
481
|
"""
|
|
472
|
-
Specifies a
|
|
482
|
+
Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
473
483
|
"""
|
|
474
|
-
return pulumi.get(self, "
|
|
484
|
+
return pulumi.get(self, "external_oauth_rsa_public_key2")
|
|
475
485
|
|
|
476
|
-
@
|
|
477
|
-
def
|
|
478
|
-
pulumi.set(self, "
|
|
486
|
+
@external_oauth_rsa_public_key2.setter
|
|
487
|
+
def external_oauth_rsa_public_key2(self, value: Optional[pulumi.Input[str]]):
|
|
488
|
+
pulumi.set(self, "external_oauth_rsa_public_key2", value)
|
|
479
489
|
|
|
480
490
|
@property
|
|
481
|
-
@pulumi.getter(name="
|
|
482
|
-
def
|
|
491
|
+
@pulumi.getter(name="externalOauthScopeDelimiter")
|
|
492
|
+
def external_oauth_scope_delimiter(self) -> Optional[pulumi.Input[str]]:
|
|
483
493
|
"""
|
|
484
|
-
Specifies
|
|
494
|
+
Specifies the scope delimiter in the authorization token.
|
|
485
495
|
"""
|
|
486
|
-
return pulumi.get(self, "
|
|
496
|
+
return pulumi.get(self, "external_oauth_scope_delimiter")
|
|
487
497
|
|
|
488
|
-
@
|
|
489
|
-
def
|
|
490
|
-
pulumi.set(self, "
|
|
498
|
+
@external_oauth_scope_delimiter.setter
|
|
499
|
+
def external_oauth_scope_delimiter(self, value: Optional[pulumi.Input[str]]):
|
|
500
|
+
pulumi.set(self, "external_oauth_scope_delimiter", value)
|
|
491
501
|
|
|
492
502
|
@property
|
|
493
|
-
@pulumi.getter(name="
|
|
494
|
-
def
|
|
503
|
+
@pulumi.getter(name="externalOauthScopeMappingAttribute")
|
|
504
|
+
def external_oauth_scope_mapping_attribute(self) -> Optional[pulumi.Input[str]]:
|
|
495
505
|
"""
|
|
496
|
-
Specifies the
|
|
506
|
+
Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
497
507
|
"""
|
|
498
|
-
return pulumi.get(self, "
|
|
508
|
+
return pulumi.get(self, "external_oauth_scope_mapping_attribute")
|
|
499
509
|
|
|
500
|
-
@
|
|
501
|
-
def
|
|
502
|
-
pulumi.set(self, "
|
|
510
|
+
@external_oauth_scope_mapping_attribute.setter
|
|
511
|
+
def external_oauth_scope_mapping_attribute(self, value: Optional[pulumi.Input[str]]):
|
|
512
|
+
pulumi.set(self, "external_oauth_scope_mapping_attribute", value)
|
|
503
513
|
|
|
504
514
|
@property
|
|
505
|
-
@pulumi.getter(name="
|
|
506
|
-
def
|
|
515
|
+
@pulumi.getter(name="externalOauthSnowflakeUserMappingAttribute")
|
|
516
|
+
def external_oauth_snowflake_user_mapping_attribute(self) -> Optional[pulumi.Input[str]]:
|
|
507
517
|
"""
|
|
508
|
-
|
|
518
|
+
Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
509
519
|
"""
|
|
510
|
-
return pulumi.get(self, "
|
|
520
|
+
return pulumi.get(self, "external_oauth_snowflake_user_mapping_attribute")
|
|
511
521
|
|
|
512
|
-
@
|
|
513
|
-
def
|
|
514
|
-
pulumi.set(self, "
|
|
522
|
+
@external_oauth_snowflake_user_mapping_attribute.setter
|
|
523
|
+
def external_oauth_snowflake_user_mapping_attribute(self, value: Optional[pulumi.Input[str]]):
|
|
524
|
+
pulumi.set(self, "external_oauth_snowflake_user_mapping_attribute", value)
|
|
515
525
|
|
|
516
526
|
@property
|
|
517
|
-
@pulumi.getter(name="
|
|
518
|
-
def
|
|
527
|
+
@pulumi.getter(name="externalOauthTokenUserMappingClaims")
|
|
528
|
+
def external_oauth_token_user_mapping_claims(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
519
529
|
"""
|
|
520
|
-
|
|
530
|
+
Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
521
531
|
"""
|
|
522
|
-
return pulumi.get(self, "
|
|
532
|
+
return pulumi.get(self, "external_oauth_token_user_mapping_claims")
|
|
523
533
|
|
|
524
|
-
@
|
|
525
|
-
def
|
|
526
|
-
pulumi.set(self, "
|
|
534
|
+
@external_oauth_token_user_mapping_claims.setter
|
|
535
|
+
def external_oauth_token_user_mapping_claims(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
536
|
+
pulumi.set(self, "external_oauth_token_user_mapping_claims", value)
|
|
527
537
|
|
|
528
538
|
@property
|
|
529
|
-
@pulumi.getter(name="
|
|
530
|
-
def
|
|
539
|
+
@pulumi.getter(name="externalOauthType")
|
|
540
|
+
def external_oauth_type(self) -> Optional[pulumi.Input[str]]:
|
|
531
541
|
"""
|
|
532
|
-
Specifies the
|
|
542
|
+
Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
533
543
|
"""
|
|
534
|
-
return pulumi.get(self, "
|
|
544
|
+
return pulumi.get(self, "external_oauth_type")
|
|
535
545
|
|
|
536
|
-
@
|
|
537
|
-
def
|
|
538
|
-
pulumi.set(self, "
|
|
546
|
+
@external_oauth_type.setter
|
|
547
|
+
def external_oauth_type(self, value: Optional[pulumi.Input[str]]):
|
|
548
|
+
pulumi.set(self, "external_oauth_type", value)
|
|
539
549
|
|
|
540
550
|
@property
|
|
541
551
|
@pulumi.getter
|
|
542
|
-
def
|
|
552
|
+
def name(self) -> Optional[pulumi.Input[str]]:
|
|
553
|
+
"""
|
|
554
|
+
Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
555
|
+
"""
|
|
556
|
+
return pulumi.get(self, "name")
|
|
557
|
+
|
|
558
|
+
@name.setter
|
|
559
|
+
def name(self, value: Optional[pulumi.Input[str]]):
|
|
560
|
+
pulumi.set(self, "name", value)
|
|
561
|
+
|
|
562
|
+
@property
|
|
563
|
+
@pulumi.getter(name="relatedParameters")
|
|
564
|
+
def related_parameters(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationRelatedParameterArgs']]]]:
|
|
565
|
+
"""
|
|
566
|
+
Paramteres related to this security integration.
|
|
567
|
+
"""
|
|
568
|
+
return pulumi.get(self, "related_parameters")
|
|
569
|
+
|
|
570
|
+
@related_parameters.setter
|
|
571
|
+
def related_parameters(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationRelatedParameterArgs']]]]):
|
|
572
|
+
pulumi.set(self, "related_parameters", value)
|
|
573
|
+
|
|
574
|
+
@property
|
|
575
|
+
@pulumi.getter(name="showOutputs")
|
|
576
|
+
def show_outputs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationShowOutputArgs']]]]:
|
|
543
577
|
"""
|
|
544
|
-
|
|
578
|
+
Outputs the result of `SHOW SECURITY INTEGRATIONS` for the given security integration.
|
|
545
579
|
"""
|
|
546
|
-
return pulumi.get(self, "
|
|
580
|
+
return pulumi.get(self, "show_outputs")
|
|
547
581
|
|
|
548
|
-
@
|
|
549
|
-
def
|
|
550
|
-
pulumi.set(self, "
|
|
582
|
+
@show_outputs.setter
|
|
583
|
+
def show_outputs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ExternalOauthIntegrationShowOutputArgs']]]]):
|
|
584
|
+
pulumi.set(self, "show_outputs", value)
|
|
551
585
|
|
|
552
586
|
|
|
553
587
|
class ExternalOauthIntegration(pulumi.CustomResource):
|
|
@@ -555,67 +589,52 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
555
589
|
def __init__(__self__,
|
|
556
590
|
resource_name: str,
|
|
557
591
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
558
|
-
allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
559
|
-
any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
560
|
-
audience_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
561
|
-
blocked_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
562
592
|
comment: Optional[pulumi.Input[str]] = None,
|
|
563
593
|
enabled: Optional[pulumi.Input[bool]] = None,
|
|
564
|
-
|
|
565
|
-
|
|
594
|
+
external_oauth_allowed_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
595
|
+
external_oauth_any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
596
|
+
external_oauth_audience_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
597
|
+
external_oauth_blocked_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
598
|
+
external_oauth_issuer: Optional[pulumi.Input[str]] = None,
|
|
599
|
+
external_oauth_jws_keys_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
600
|
+
external_oauth_rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
601
|
+
external_oauth_rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
602
|
+
external_oauth_scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
603
|
+
external_oauth_scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
604
|
+
external_oauth_snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
605
|
+
external_oauth_token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
606
|
+
external_oauth_type: Optional[pulumi.Input[str]] = None,
|
|
566
607
|
name: Optional[pulumi.Input[str]] = None,
|
|
567
|
-
rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
568
|
-
rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
569
|
-
scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
570
|
-
scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
571
|
-
snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
572
|
-
token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
573
|
-
type: Optional[pulumi.Input[str]] = None,
|
|
574
608
|
__props__=None):
|
|
575
609
|
"""
|
|
576
|
-
|
|
610
|
+
!> **V1 release candidate** This resource was reworked and is a release candidate for the V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the migration guide to use it.
|
|
577
611
|
|
|
578
|
-
|
|
579
|
-
|
|
580
|
-
```python
|
|
581
|
-
import pulumi
|
|
582
|
-
import pulumi_snowflake as snowflake
|
|
583
|
-
|
|
584
|
-
azure = snowflake.ExternalOauthIntegration("azure",
|
|
585
|
-
name="AZURE_POWERBI",
|
|
586
|
-
type="AZURE",
|
|
587
|
-
enabled=True,
|
|
588
|
-
issuer="https://sts.windows.net/00000000-0000-0000-0000-000000000000",
|
|
589
|
-
snowflake_user_mapping_attribute="LOGIN_NAME",
|
|
590
|
-
jws_keys_urls=["https://login.windows.net/common/discovery/keys"],
|
|
591
|
-
audience_urls=["https://analysis.windows.net/powerbi/connector/Snowflake"],
|
|
592
|
-
token_user_mapping_claims=["upn"])
|
|
593
|
-
```
|
|
612
|
+
Resource used to manage external oauth security integration objects. For more information, check [security integrations documentation](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-external).
|
|
594
613
|
|
|
595
614
|
## Import
|
|
596
615
|
|
|
597
616
|
```sh
|
|
598
|
-
$ pulumi import snowflake:index/externalOauthIntegration:ExternalOauthIntegration example name
|
|
617
|
+
$ pulumi import snowflake:index/externalOauthIntegration:ExternalOauthIntegration example "name"
|
|
599
618
|
```
|
|
600
619
|
|
|
601
620
|
:param str resource_name: The name of the resource.
|
|
602
621
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
603
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: Specifies the list of roles that the client can set as the primary role.
|
|
604
|
-
:param pulumi.Input[str] any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token.
|
|
605
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] audience_urls: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
606
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] blocked_roles: Specifies the list of roles that a client cannot set as the primary role. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
|
|
607
622
|
:param pulumi.Input[str] comment: Specifies a comment for the OAuth integration.
|
|
608
623
|
:param pulumi.Input[bool] enabled: Specifies whether to initiate operation of the integration or suspend it.
|
|
609
|
-
:param pulumi.Input[str]
|
|
610
|
-
:param pulumi.Input[
|
|
624
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_allowed_roles_lists: Specifies the list of roles that the client can set as the primary role.
|
|
625
|
+
:param pulumi.Input[str] external_oauth_any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
626
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_audience_lists: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
627
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_blocked_roles_lists: Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
628
|
+
:param pulumi.Input[str] external_oauth_issuer: Specifies the URL to define the OAuth 2.0 authorization server.
|
|
629
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_jws_keys_urls: Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
630
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
631
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
632
|
+
:param pulumi.Input[str] external_oauth_scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
633
|
+
:param pulumi.Input[str] external_oauth_scope_mapping_attribute: Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
634
|
+
:param pulumi.Input[str] external_oauth_snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
635
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
636
|
+
:param pulumi.Input[str] external_oauth_type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
611
637
|
:param pulumi.Input[str] name: Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
612
|
-
:param pulumi.Input[str] rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers.
|
|
613
|
-
:param pulumi.Input[str] rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation.
|
|
614
|
-
:param pulumi.Input[str] scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
615
|
-
:param pulumi.Input[str] scope_mapping_attribute: Specifies the access token claim to map the access token to an account role.
|
|
616
|
-
:param pulumi.Input[str] snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record.
|
|
617
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record.
|
|
618
|
-
:param pulumi.Input[str] type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server.
|
|
619
638
|
"""
|
|
620
639
|
...
|
|
621
640
|
@overload
|
|
@@ -624,29 +643,14 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
624
643
|
args: ExternalOauthIntegrationArgs,
|
|
625
644
|
opts: Optional[pulumi.ResourceOptions] = None):
|
|
626
645
|
"""
|
|
627
|
-
|
|
646
|
+
!> **V1 release candidate** This resource was reworked and is a release candidate for the V1. We do not expect significant changes in it before the V1. We will welcome any feedback and adjust the resource if needed. Any errors reported will be resolved with a higher priority. We encourage checking this resource out before the V1 release. Please follow the migration guide to use it.
|
|
628
647
|
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
```python
|
|
632
|
-
import pulumi
|
|
633
|
-
import pulumi_snowflake as snowflake
|
|
634
|
-
|
|
635
|
-
azure = snowflake.ExternalOauthIntegration("azure",
|
|
636
|
-
name="AZURE_POWERBI",
|
|
637
|
-
type="AZURE",
|
|
638
|
-
enabled=True,
|
|
639
|
-
issuer="https://sts.windows.net/00000000-0000-0000-0000-000000000000",
|
|
640
|
-
snowflake_user_mapping_attribute="LOGIN_NAME",
|
|
641
|
-
jws_keys_urls=["https://login.windows.net/common/discovery/keys"],
|
|
642
|
-
audience_urls=["https://analysis.windows.net/powerbi/connector/Snowflake"],
|
|
643
|
-
token_user_mapping_claims=["upn"])
|
|
644
|
-
```
|
|
648
|
+
Resource used to manage external oauth security integration objects. For more information, check [security integrations documentation](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-external).
|
|
645
649
|
|
|
646
650
|
## Import
|
|
647
651
|
|
|
648
652
|
```sh
|
|
649
|
-
$ pulumi import snowflake:index/externalOauthIntegration:ExternalOauthIntegration example name
|
|
653
|
+
$ pulumi import snowflake:index/externalOauthIntegration:ExternalOauthIntegration example "name"
|
|
650
654
|
```
|
|
651
655
|
|
|
652
656
|
:param str resource_name: The name of the resource.
|
|
@@ -664,22 +668,22 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
664
668
|
def _internal_init(__self__,
|
|
665
669
|
resource_name: str,
|
|
666
670
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
667
|
-
allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
668
|
-
any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
669
|
-
audience_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
670
|
-
blocked_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
671
671
|
comment: Optional[pulumi.Input[str]] = None,
|
|
672
672
|
enabled: Optional[pulumi.Input[bool]] = None,
|
|
673
|
-
|
|
674
|
-
|
|
673
|
+
external_oauth_allowed_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
674
|
+
external_oauth_any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
675
|
+
external_oauth_audience_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
676
|
+
external_oauth_blocked_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
677
|
+
external_oauth_issuer: Optional[pulumi.Input[str]] = None,
|
|
678
|
+
external_oauth_jws_keys_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
679
|
+
external_oauth_rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
680
|
+
external_oauth_rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
681
|
+
external_oauth_scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
682
|
+
external_oauth_scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
683
|
+
external_oauth_snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
684
|
+
external_oauth_token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
685
|
+
external_oauth_type: Optional[pulumi.Input[str]] = None,
|
|
675
686
|
name: Optional[pulumi.Input[str]] = None,
|
|
676
|
-
rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
677
|
-
rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
678
|
-
scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
679
|
-
scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
680
|
-
snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
681
|
-
token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
682
|
-
type: Optional[pulumi.Input[str]] = None,
|
|
683
687
|
__props__=None):
|
|
684
688
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
685
689
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -689,33 +693,35 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
689
693
|
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
690
694
|
__props__ = ExternalOauthIntegrationArgs.__new__(ExternalOauthIntegrationArgs)
|
|
691
695
|
|
|
692
|
-
__props__.__dict__["allowed_roles"] = allowed_roles
|
|
693
|
-
__props__.__dict__["any_role_mode"] = any_role_mode
|
|
694
|
-
__props__.__dict__["audience_urls"] = audience_urls
|
|
695
|
-
__props__.__dict__["blocked_roles"] = blocked_roles
|
|
696
696
|
__props__.__dict__["comment"] = comment
|
|
697
697
|
if enabled is None and not opts.urn:
|
|
698
698
|
raise TypeError("Missing required property 'enabled'")
|
|
699
699
|
__props__.__dict__["enabled"] = enabled
|
|
700
|
-
|
|
701
|
-
|
|
702
|
-
__props__.__dict__["
|
|
703
|
-
__props__.__dict__["
|
|
700
|
+
__props__.__dict__["external_oauth_allowed_roles_lists"] = external_oauth_allowed_roles_lists
|
|
701
|
+
__props__.__dict__["external_oauth_any_role_mode"] = external_oauth_any_role_mode
|
|
702
|
+
__props__.__dict__["external_oauth_audience_lists"] = external_oauth_audience_lists
|
|
703
|
+
__props__.__dict__["external_oauth_blocked_roles_lists"] = external_oauth_blocked_roles_lists
|
|
704
|
+
if external_oauth_issuer is None and not opts.urn:
|
|
705
|
+
raise TypeError("Missing required property 'external_oauth_issuer'")
|
|
706
|
+
__props__.__dict__["external_oauth_issuer"] = external_oauth_issuer
|
|
707
|
+
__props__.__dict__["external_oauth_jws_keys_urls"] = external_oauth_jws_keys_urls
|
|
708
|
+
__props__.__dict__["external_oauth_rsa_public_key"] = external_oauth_rsa_public_key
|
|
709
|
+
__props__.__dict__["external_oauth_rsa_public_key2"] = external_oauth_rsa_public_key2
|
|
710
|
+
__props__.__dict__["external_oauth_scope_delimiter"] = external_oauth_scope_delimiter
|
|
711
|
+
__props__.__dict__["external_oauth_scope_mapping_attribute"] = external_oauth_scope_mapping_attribute
|
|
712
|
+
if external_oauth_snowflake_user_mapping_attribute is None and not opts.urn:
|
|
713
|
+
raise TypeError("Missing required property 'external_oauth_snowflake_user_mapping_attribute'")
|
|
714
|
+
__props__.__dict__["external_oauth_snowflake_user_mapping_attribute"] = external_oauth_snowflake_user_mapping_attribute
|
|
715
|
+
if external_oauth_token_user_mapping_claims is None and not opts.urn:
|
|
716
|
+
raise TypeError("Missing required property 'external_oauth_token_user_mapping_claims'")
|
|
717
|
+
__props__.__dict__["external_oauth_token_user_mapping_claims"] = external_oauth_token_user_mapping_claims
|
|
718
|
+
if external_oauth_type is None and not opts.urn:
|
|
719
|
+
raise TypeError("Missing required property 'external_oauth_type'")
|
|
720
|
+
__props__.__dict__["external_oauth_type"] = external_oauth_type
|
|
704
721
|
__props__.__dict__["name"] = name
|
|
705
|
-
__props__.__dict__["
|
|
706
|
-
__props__.__dict__["
|
|
707
|
-
__props__.__dict__["
|
|
708
|
-
__props__.__dict__["scope_mapping_attribute"] = scope_mapping_attribute
|
|
709
|
-
if snowflake_user_mapping_attribute is None and not opts.urn:
|
|
710
|
-
raise TypeError("Missing required property 'snowflake_user_mapping_attribute'")
|
|
711
|
-
__props__.__dict__["snowflake_user_mapping_attribute"] = snowflake_user_mapping_attribute
|
|
712
|
-
if token_user_mapping_claims is None and not opts.urn:
|
|
713
|
-
raise TypeError("Missing required property 'token_user_mapping_claims'")
|
|
714
|
-
__props__.__dict__["token_user_mapping_claims"] = token_user_mapping_claims
|
|
715
|
-
if type is None and not opts.urn:
|
|
716
|
-
raise TypeError("Missing required property 'type'")
|
|
717
|
-
__props__.__dict__["type"] = type
|
|
718
|
-
__props__.__dict__["created_on"] = None
|
|
722
|
+
__props__.__dict__["describe_outputs"] = None
|
|
723
|
+
__props__.__dict__["related_parameters"] = None
|
|
724
|
+
__props__.__dict__["show_outputs"] = None
|
|
719
725
|
super(ExternalOauthIntegration, __self__).__init__(
|
|
720
726
|
'snowflake:index/externalOauthIntegration:ExternalOauthIntegration',
|
|
721
727
|
resource_name,
|
|
@@ -726,23 +732,25 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
726
732
|
def get(resource_name: str,
|
|
727
733
|
id: pulumi.Input[str],
|
|
728
734
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
729
|
-
allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
730
|
-
any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
731
|
-
audience_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
732
|
-
blocked_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
733
735
|
comment: Optional[pulumi.Input[str]] = None,
|
|
734
|
-
|
|
736
|
+
describe_outputs: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationDescribeOutputArgs']]]]] = None,
|
|
735
737
|
enabled: Optional[pulumi.Input[bool]] = None,
|
|
736
|
-
|
|
737
|
-
|
|
738
|
+
external_oauth_allowed_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
739
|
+
external_oauth_any_role_mode: Optional[pulumi.Input[str]] = None,
|
|
740
|
+
external_oauth_audience_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
741
|
+
external_oauth_blocked_roles_lists: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
742
|
+
external_oauth_issuer: Optional[pulumi.Input[str]] = None,
|
|
743
|
+
external_oauth_jws_keys_urls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
744
|
+
external_oauth_rsa_public_key: Optional[pulumi.Input[str]] = None,
|
|
745
|
+
external_oauth_rsa_public_key2: Optional[pulumi.Input[str]] = None,
|
|
746
|
+
external_oauth_scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
747
|
+
external_oauth_scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
748
|
+
external_oauth_snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
749
|
+
external_oauth_token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
750
|
+
external_oauth_type: Optional[pulumi.Input[str]] = None,
|
|
738
751
|
name: Optional[pulumi.Input[str]] = None,
|
|
739
|
-
|
|
740
|
-
|
|
741
|
-
scope_delimiter: Optional[pulumi.Input[str]] = None,
|
|
742
|
-
scope_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
743
|
-
snowflake_user_mapping_attribute: Optional[pulumi.Input[str]] = None,
|
|
744
|
-
token_user_mapping_claims: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
745
|
-
type: Optional[pulumi.Input[str]] = None) -> 'ExternalOauthIntegration':
|
|
752
|
+
related_parameters: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationRelatedParameterArgs']]]]] = None,
|
|
753
|
+
show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationShowOutputArgs']]]]] = None) -> 'ExternalOauthIntegration':
|
|
746
754
|
"""
|
|
747
755
|
Get an existing ExternalOauthIntegration resource's state with the given name, id, and optional extra
|
|
748
756
|
properties used to qualify the lookup.
|
|
@@ -750,180 +758,200 @@ class ExternalOauthIntegration(pulumi.CustomResource):
|
|
|
750
758
|
:param str resource_name: The unique name of the resulting resource.
|
|
751
759
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
752
760
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
753
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: Specifies the list of roles that the client can set as the primary role.
|
|
754
|
-
:param pulumi.Input[str] any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token.
|
|
755
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] audience_urls: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
756
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] blocked_roles: Specifies the list of roles that a client cannot set as the primary role. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
|
|
757
761
|
:param pulumi.Input[str] comment: Specifies a comment for the OAuth integration.
|
|
758
|
-
:param pulumi.Input[
|
|
762
|
+
:param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationDescribeOutputArgs']]]] describe_outputs: Outputs the result of `DESCRIBE SECURITY INTEGRATIONS` for the given security integration.
|
|
759
763
|
:param pulumi.Input[bool] enabled: Specifies whether to initiate operation of the integration or suspend it.
|
|
760
|
-
:param pulumi.Input[str]
|
|
761
|
-
:param pulumi.Input[
|
|
764
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_allowed_roles_lists: Specifies the list of roles that the client can set as the primary role.
|
|
765
|
+
:param pulumi.Input[str] external_oauth_any_role_mode: Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
766
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_audience_lists: Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
767
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_blocked_roles_lists: Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
768
|
+
:param pulumi.Input[str] external_oauth_issuer: Specifies the URL to define the OAuth 2.0 authorization server.
|
|
769
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_jws_keys_urls: Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
770
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key: Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
771
|
+
:param pulumi.Input[str] external_oauth_rsa_public_key2: Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
772
|
+
:param pulumi.Input[str] external_oauth_scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
773
|
+
:param pulumi.Input[str] external_oauth_scope_mapping_attribute: Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
774
|
+
:param pulumi.Input[str] external_oauth_snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
775
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] external_oauth_token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
776
|
+
:param pulumi.Input[str] external_oauth_type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
762
777
|
:param pulumi.Input[str] name: Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
763
|
-
:param pulumi.Input[
|
|
764
|
-
:param pulumi.Input[
|
|
765
|
-
:param pulumi.Input[str] scope_delimiter: Specifies the scope delimiter in the authorization token.
|
|
766
|
-
:param pulumi.Input[str] scope_mapping_attribute: Specifies the access token claim to map the access token to an account role.
|
|
767
|
-
:param pulumi.Input[str] snowflake_user_mapping_attribute: Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record.
|
|
768
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] token_user_mapping_claims: Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record.
|
|
769
|
-
:param pulumi.Input[str] type: Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server.
|
|
778
|
+
:param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationRelatedParameterArgs']]]] related_parameters: Paramteres related to this security integration.
|
|
779
|
+
:param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['ExternalOauthIntegrationShowOutputArgs']]]] show_outputs: Outputs the result of `SHOW SECURITY INTEGRATIONS` for the given security integration.
|
|
770
780
|
"""
|
|
771
781
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
772
782
|
|
|
773
783
|
__props__ = _ExternalOauthIntegrationState.__new__(_ExternalOauthIntegrationState)
|
|
774
784
|
|
|
775
|
-
__props__.__dict__["allowed_roles"] = allowed_roles
|
|
776
|
-
__props__.__dict__["any_role_mode"] = any_role_mode
|
|
777
|
-
__props__.__dict__["audience_urls"] = audience_urls
|
|
778
|
-
__props__.__dict__["blocked_roles"] = blocked_roles
|
|
779
785
|
__props__.__dict__["comment"] = comment
|
|
780
|
-
__props__.__dict__["
|
|
786
|
+
__props__.__dict__["describe_outputs"] = describe_outputs
|
|
781
787
|
__props__.__dict__["enabled"] = enabled
|
|
782
|
-
__props__.__dict__["
|
|
783
|
-
__props__.__dict__["
|
|
788
|
+
__props__.__dict__["external_oauth_allowed_roles_lists"] = external_oauth_allowed_roles_lists
|
|
789
|
+
__props__.__dict__["external_oauth_any_role_mode"] = external_oauth_any_role_mode
|
|
790
|
+
__props__.__dict__["external_oauth_audience_lists"] = external_oauth_audience_lists
|
|
791
|
+
__props__.__dict__["external_oauth_blocked_roles_lists"] = external_oauth_blocked_roles_lists
|
|
792
|
+
__props__.__dict__["external_oauth_issuer"] = external_oauth_issuer
|
|
793
|
+
__props__.__dict__["external_oauth_jws_keys_urls"] = external_oauth_jws_keys_urls
|
|
794
|
+
__props__.__dict__["external_oauth_rsa_public_key"] = external_oauth_rsa_public_key
|
|
795
|
+
__props__.__dict__["external_oauth_rsa_public_key2"] = external_oauth_rsa_public_key2
|
|
796
|
+
__props__.__dict__["external_oauth_scope_delimiter"] = external_oauth_scope_delimiter
|
|
797
|
+
__props__.__dict__["external_oauth_scope_mapping_attribute"] = external_oauth_scope_mapping_attribute
|
|
798
|
+
__props__.__dict__["external_oauth_snowflake_user_mapping_attribute"] = external_oauth_snowflake_user_mapping_attribute
|
|
799
|
+
__props__.__dict__["external_oauth_token_user_mapping_claims"] = external_oauth_token_user_mapping_claims
|
|
800
|
+
__props__.__dict__["external_oauth_type"] = external_oauth_type
|
|
784
801
|
__props__.__dict__["name"] = name
|
|
785
|
-
__props__.__dict__["
|
|
786
|
-
__props__.__dict__["
|
|
787
|
-
__props__.__dict__["scope_delimiter"] = scope_delimiter
|
|
788
|
-
__props__.__dict__["scope_mapping_attribute"] = scope_mapping_attribute
|
|
789
|
-
__props__.__dict__["snowflake_user_mapping_attribute"] = snowflake_user_mapping_attribute
|
|
790
|
-
__props__.__dict__["token_user_mapping_claims"] = token_user_mapping_claims
|
|
791
|
-
__props__.__dict__["type"] = type
|
|
802
|
+
__props__.__dict__["related_parameters"] = related_parameters
|
|
803
|
+
__props__.__dict__["show_outputs"] = show_outputs
|
|
792
804
|
return ExternalOauthIntegration(resource_name, opts=opts, __props__=__props__)
|
|
793
805
|
|
|
794
806
|
@property
|
|
795
|
-
@pulumi.getter
|
|
796
|
-
def
|
|
807
|
+
@pulumi.getter
|
|
808
|
+
def comment(self) -> pulumi.Output[Optional[str]]:
|
|
797
809
|
"""
|
|
798
|
-
Specifies
|
|
810
|
+
Specifies a comment for the OAuth integration.
|
|
799
811
|
"""
|
|
800
|
-
return pulumi.get(self, "
|
|
812
|
+
return pulumi.get(self, "comment")
|
|
801
813
|
|
|
802
814
|
@property
|
|
803
|
-
@pulumi.getter(name="
|
|
804
|
-
def
|
|
815
|
+
@pulumi.getter(name="describeOutputs")
|
|
816
|
+
def describe_outputs(self) -> pulumi.Output[Sequence['outputs.ExternalOauthIntegrationDescribeOutput']]:
|
|
805
817
|
"""
|
|
806
|
-
|
|
818
|
+
Outputs the result of `DESCRIBE SECURITY INTEGRATIONS` for the given security integration.
|
|
807
819
|
"""
|
|
808
|
-
return pulumi.get(self, "
|
|
820
|
+
return pulumi.get(self, "describe_outputs")
|
|
809
821
|
|
|
810
822
|
@property
|
|
811
|
-
@pulumi.getter
|
|
812
|
-
def
|
|
823
|
+
@pulumi.getter
|
|
824
|
+
def enabled(self) -> pulumi.Output[bool]:
|
|
813
825
|
"""
|
|
814
|
-
Specifies
|
|
826
|
+
Specifies whether to initiate operation of the integration or suspend it.
|
|
815
827
|
"""
|
|
816
|
-
return pulumi.get(self, "
|
|
828
|
+
return pulumi.get(self, "enabled")
|
|
817
829
|
|
|
818
830
|
@property
|
|
819
|
-
@pulumi.getter(name="
|
|
820
|
-
def
|
|
831
|
+
@pulumi.getter(name="externalOauthAllowedRolesLists")
|
|
832
|
+
def external_oauth_allowed_roles_lists(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
821
833
|
"""
|
|
822
|
-
Specifies the list of roles that
|
|
834
|
+
Specifies the list of roles that the client can set as the primary role.
|
|
823
835
|
"""
|
|
824
|
-
return pulumi.get(self, "
|
|
836
|
+
return pulumi.get(self, "external_oauth_allowed_roles_lists")
|
|
825
837
|
|
|
826
838
|
@property
|
|
827
|
-
@pulumi.getter
|
|
828
|
-
def
|
|
839
|
+
@pulumi.getter(name="externalOauthAnyRoleMode")
|
|
840
|
+
def external_oauth_any_role_mode(self) -> pulumi.Output[Optional[str]]:
|
|
829
841
|
"""
|
|
830
|
-
Specifies a
|
|
842
|
+
Specifies whether the OAuth client or user can use a role that is not defined in the OAuth access token. Valid values are (case-insensitive): `DISABLE` | `ENABLE` | `ENABLE_FOR_PRIVILEGE`.
|
|
831
843
|
"""
|
|
832
|
-
return pulumi.get(self, "
|
|
844
|
+
return pulumi.get(self, "external_oauth_any_role_mode")
|
|
833
845
|
|
|
834
846
|
@property
|
|
835
|
-
@pulumi.getter(name="
|
|
836
|
-
def
|
|
847
|
+
@pulumi.getter(name="externalOauthAudienceLists")
|
|
848
|
+
def external_oauth_audience_lists(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
837
849
|
"""
|
|
838
|
-
|
|
850
|
+
Specifies additional values that can be used for the access token's audience validation on top of using the Customer's Snowflake Account URL
|
|
839
851
|
"""
|
|
840
|
-
return pulumi.get(self, "
|
|
852
|
+
return pulumi.get(self, "external_oauth_audience_lists")
|
|
841
853
|
|
|
842
854
|
@property
|
|
843
|
-
@pulumi.getter
|
|
844
|
-
def
|
|
855
|
+
@pulumi.getter(name="externalOauthBlockedRolesLists")
|
|
856
|
+
def external_oauth_blocked_roles_lists(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
845
857
|
"""
|
|
846
|
-
Specifies
|
|
858
|
+
Specifies the list of roles that a client cannot set as the primary role. By default, this list includes the ACCOUNTADMIN, ORGADMIN and SECURITYADMIN roles. To remove these privileged roles from the list, use the ALTER ACCOUNT command to set the EXTERNAL*OAUTH*ADD*PRIVILEGED*ROLES*TO*BLOCKED_LIST account parameter to FALSE.
|
|
847
859
|
"""
|
|
848
|
-
return pulumi.get(self, "
|
|
860
|
+
return pulumi.get(self, "external_oauth_blocked_roles_lists")
|
|
849
861
|
|
|
850
862
|
@property
|
|
851
|
-
@pulumi.getter
|
|
852
|
-
def
|
|
863
|
+
@pulumi.getter(name="externalOauthIssuer")
|
|
864
|
+
def external_oauth_issuer(self) -> pulumi.Output[str]:
|
|
853
865
|
"""
|
|
854
866
|
Specifies the URL to define the OAuth 2.0 authorization server.
|
|
855
867
|
"""
|
|
856
|
-
return pulumi.get(self, "
|
|
868
|
+
return pulumi.get(self, "external_oauth_issuer")
|
|
857
869
|
|
|
858
870
|
@property
|
|
859
|
-
@pulumi.getter(name="
|
|
860
|
-
def
|
|
871
|
+
@pulumi.getter(name="externalOauthJwsKeysUrls")
|
|
872
|
+
def external_oauth_jws_keys_urls(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
861
873
|
"""
|
|
862
|
-
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3.
|
|
874
|
+
Specifies the endpoint or a list of endpoints from which to download public keys or certificates to validate an External OAuth access token. The maximum number of URLs that can be specified in the list is 3. If removed from the config, the resource is recreated.
|
|
863
875
|
"""
|
|
864
|
-
return pulumi.get(self, "
|
|
876
|
+
return pulumi.get(self, "external_oauth_jws_keys_urls")
|
|
865
877
|
|
|
866
878
|
@property
|
|
867
|
-
@pulumi.getter
|
|
868
|
-
def
|
|
879
|
+
@pulumi.getter(name="externalOauthRsaPublicKey")
|
|
880
|
+
def external_oauth_rsa_public_key(self) -> pulumi.Output[Optional[str]]:
|
|
869
881
|
"""
|
|
870
|
-
Specifies
|
|
882
|
+
Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. If removed from the config, the resource is recreated.
|
|
871
883
|
"""
|
|
872
|
-
return pulumi.get(self, "
|
|
884
|
+
return pulumi.get(self, "external_oauth_rsa_public_key")
|
|
873
885
|
|
|
874
886
|
@property
|
|
875
|
-
@pulumi.getter(name="
|
|
876
|
-
def
|
|
887
|
+
@pulumi.getter(name="externalOauthRsaPublicKey2")
|
|
888
|
+
def external_oauth_rsa_public_key2(self) -> pulumi.Output[Optional[str]]:
|
|
877
889
|
"""
|
|
878
|
-
Specifies a
|
|
890
|
+
Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation. If removed from the config, the resource is recreated.
|
|
879
891
|
"""
|
|
880
|
-
return pulumi.get(self, "
|
|
892
|
+
return pulumi.get(self, "external_oauth_rsa_public_key2")
|
|
881
893
|
|
|
882
894
|
@property
|
|
883
|
-
@pulumi.getter(name="
|
|
884
|
-
def
|
|
895
|
+
@pulumi.getter(name="externalOauthScopeDelimiter")
|
|
896
|
+
def external_oauth_scope_delimiter(self) -> pulumi.Output[Optional[str]]:
|
|
885
897
|
"""
|
|
886
|
-
Specifies
|
|
898
|
+
Specifies the scope delimiter in the authorization token.
|
|
887
899
|
"""
|
|
888
|
-
return pulumi.get(self, "
|
|
900
|
+
return pulumi.get(self, "external_oauth_scope_delimiter")
|
|
889
901
|
|
|
890
902
|
@property
|
|
891
|
-
@pulumi.getter(name="
|
|
892
|
-
def
|
|
903
|
+
@pulumi.getter(name="externalOauthScopeMappingAttribute")
|
|
904
|
+
def external_oauth_scope_mapping_attribute(self) -> pulumi.Output[Optional[str]]:
|
|
893
905
|
"""
|
|
894
|
-
Specifies the
|
|
906
|
+
Specifies the access token claim to map the access token to an account role. If removed from the config, the resource is recreated.
|
|
895
907
|
"""
|
|
896
|
-
return pulumi.get(self, "
|
|
908
|
+
return pulumi.get(self, "external_oauth_scope_mapping_attribute")
|
|
897
909
|
|
|
898
910
|
@property
|
|
899
|
-
@pulumi.getter(name="
|
|
900
|
-
def
|
|
911
|
+
@pulumi.getter(name="externalOauthSnowflakeUserMappingAttribute")
|
|
912
|
+
def external_oauth_snowflake_user_mapping_attribute(self) -> pulumi.Output[str]:
|
|
901
913
|
"""
|
|
902
|
-
|
|
914
|
+
Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record. Valid values are (case-insensitive): `LOGIN_NAME` | `EMAIL_ADDRESS`.
|
|
903
915
|
"""
|
|
904
|
-
return pulumi.get(self, "
|
|
916
|
+
return pulumi.get(self, "external_oauth_snowflake_user_mapping_attribute")
|
|
905
917
|
|
|
906
918
|
@property
|
|
907
|
-
@pulumi.getter(name="
|
|
908
|
-
def
|
|
919
|
+
@pulumi.getter(name="externalOauthTokenUserMappingClaims")
|
|
920
|
+
def external_oauth_token_user_mapping_claims(self) -> pulumi.Output[Sequence[str]]:
|
|
909
921
|
"""
|
|
910
|
-
|
|
922
|
+
Specifies the access token claim or claims that can be used to map the access token to a Snowflake user record. If removed from the config, the resource is recreated.
|
|
911
923
|
"""
|
|
912
|
-
return pulumi.get(self, "
|
|
924
|
+
return pulumi.get(self, "external_oauth_token_user_mapping_claims")
|
|
913
925
|
|
|
914
926
|
@property
|
|
915
|
-
@pulumi.getter(name="
|
|
916
|
-
def
|
|
927
|
+
@pulumi.getter(name="externalOauthType")
|
|
928
|
+
def external_oauth_type(self) -> pulumi.Output[str]:
|
|
917
929
|
"""
|
|
918
|
-
Specifies the
|
|
930
|
+
Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server. Valid values are (case-insensitive): `OKTA` | `AZURE` | `PING_FEDERATE` | `CUSTOM`.
|
|
919
931
|
"""
|
|
920
|
-
return pulumi.get(self, "
|
|
932
|
+
return pulumi.get(self, "external_oauth_type")
|
|
921
933
|
|
|
922
934
|
@property
|
|
923
935
|
@pulumi.getter
|
|
924
|
-
def
|
|
936
|
+
def name(self) -> pulumi.Output[str]:
|
|
937
|
+
"""
|
|
938
|
+
Specifies the name of the External Oath integration. This name follows the rules for Object Identifiers. The name should be unique among security integrations in your account.
|
|
939
|
+
"""
|
|
940
|
+
return pulumi.get(self, "name")
|
|
941
|
+
|
|
942
|
+
@property
|
|
943
|
+
@pulumi.getter(name="relatedParameters")
|
|
944
|
+
def related_parameters(self) -> pulumi.Output[Sequence['outputs.ExternalOauthIntegrationRelatedParameter']]:
|
|
945
|
+
"""
|
|
946
|
+
Paramteres related to this security integration.
|
|
947
|
+
"""
|
|
948
|
+
return pulumi.get(self, "related_parameters")
|
|
949
|
+
|
|
950
|
+
@property
|
|
951
|
+
@pulumi.getter(name="showOutputs")
|
|
952
|
+
def show_outputs(self) -> pulumi.Output[Sequence['outputs.ExternalOauthIntegrationShowOutput']]:
|
|
925
953
|
"""
|
|
926
|
-
|
|
954
|
+
Outputs the result of `SHOW SECURITY INTEGRATIONS` for the given security integration.
|
|
927
955
|
"""
|
|
928
|
-
return pulumi.get(self, "
|
|
956
|
+
return pulumi.get(self, "show_outputs")
|
|
929
957
|
|