pulumi-snowflake 2.6.0a1758005717__py3-none-any.whl → 2.11.0a1766126285__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. pulumi_snowflake/__init__.py +21 -0
  2. pulumi_snowflake/_inputs.py +2582 -296
  3. pulumi_snowflake/authentication_policy.py +181 -31
  4. pulumi_snowflake/compute_pool.py +7 -7
  5. pulumi_snowflake/config/__init__.pyi +64 -1
  6. pulumi_snowflake/config/vars.py +88 -1
  7. pulumi_snowflake/get_authentication_policies.py +214 -0
  8. pulumi_snowflake/get_compute_pools.py +0 -4
  9. pulumi_snowflake/get_git_repositories.py +0 -4
  10. pulumi_snowflake/get_image_repositories.py +0 -4
  11. pulumi_snowflake/get_notebooks.py +174 -0
  12. pulumi_snowflake/get_semantic_views.py +178 -0
  13. pulumi_snowflake/get_services.py +0 -4
  14. pulumi_snowflake/get_user_programmatic_access_tokens.py +0 -4
  15. pulumi_snowflake/get_warehouses.py +4 -0
  16. pulumi_snowflake/notebook.py +623 -0
  17. pulumi_snowflake/outputs.py +2492 -147
  18. pulumi_snowflake/provider.py +315 -6
  19. pulumi_snowflake/pulumi-plugin.json +1 -1
  20. pulumi_snowflake/semantic_view.py +535 -0
  21. pulumi_snowflake/storage_integration.py +98 -38
  22. pulumi_snowflake/task.py +7 -7
  23. pulumi_snowflake/warehouse.py +94 -0
  24. {pulumi_snowflake-2.6.0a1758005717.dist-info → pulumi_snowflake-2.11.0a1766126285.dist-info}/METADATA +1 -1
  25. {pulumi_snowflake-2.6.0a1758005717.dist-info → pulumi_snowflake-2.11.0a1766126285.dist-info}/RECORD +27 -22
  26. {pulumi_snowflake-2.6.0a1758005717.dist-info → pulumi_snowflake-2.11.0a1766126285.dist-info}/WHEEL +0 -0
  27. {pulumi_snowflake-2.6.0a1758005717.dist-info → pulumi_snowflake-2.11.0a1766126285.dist-info}/top_level.txt +0 -0
pulumi_snowflake/authentication_policy.py CHANGED
@@ -28,19 +28,25 @@ class AuthenticationPolicyArgs:
28
28
  comment: Optional[pulumi.Input[_builtins.str]] = None,
29
29
  mfa_authentication_methods: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
30
30
  mfa_enrollment: Optional[pulumi.Input[_builtins.str]] = None,
31
+ mfa_policy: Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']] = None,
31
32
  name: Optional[pulumi.Input[_builtins.str]] = None,
32
- security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
33
+ pat_policy: Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']] = None,
34
+ security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
35
+ workload_identity_policy: Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']] = None):
33
36
  """
34
37
  The set of arguments for constructing a AuthenticationPolicy resource.
35
38
  :param pulumi.Input[_builtins.str] database: The database in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
36
39
  :param pulumi.Input[_builtins.str] schema: The schema in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
37
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
38
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
40
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
41
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
39
42
  :param pulumi.Input[_builtins.str] comment: Specifies a comment for the authentication policy.
40
43
  :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] mfa_authentication_methods: A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
41
- :param pulumi.Input[_builtins.str] mfa_enrollment: (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
44
+ :param pulumi.Input[_builtins.str] mfa_enrollment: Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
45
+ :param pulumi.Input['AuthenticationPolicyMfaPolicyArgs'] mfa_policy: Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
42
46
  :param pulumi.Input[_builtins.str] name: Specifies the identifier for the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
43
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
47
+ :param pulumi.Input['AuthenticationPolicyPatPolicyArgs'] pat_policy: Specifies the policy for programmatic access tokens.
48
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
49
+ :param pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs'] workload_identity_policy: Specifies the policy for workload identity federation.
44
50
  """
45
51
  pulumi.set(__self__, "database", database)
46
52
  pulumi.set(__self__, "schema", schema)
@@ -50,14 +56,23 @@ class AuthenticationPolicyArgs:
50
56
  pulumi.set(__self__, "client_types", client_types)
51
57
  if comment is not None:
52
58
  pulumi.set(__self__, "comment", comment)
59
+ if mfa_authentication_methods is not None:
60
+ warnings.warn("""This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""", DeprecationWarning)
61
+ pulumi.log.warn("""mfa_authentication_methods is deprecated: This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""")
53
62
  if mfa_authentication_methods is not None:
54
63
  pulumi.set(__self__, "mfa_authentication_methods", mfa_authentication_methods)
55
64
  if mfa_enrollment is not None:
56
65
  pulumi.set(__self__, "mfa_enrollment", mfa_enrollment)
66
+ if mfa_policy is not None:
67
+ pulumi.set(__self__, "mfa_policy", mfa_policy)
57
68
  if name is not None:
58
69
  pulumi.set(__self__, "name", name)
70
+ if pat_policy is not None:
71
+ pulumi.set(__self__, "pat_policy", pat_policy)
59
72
  if security_integrations is not None:
60
73
  pulumi.set(__self__, "security_integrations", security_integrations)
74
+ if workload_identity_policy is not None:
75
+ pulumi.set(__self__, "workload_identity_policy", workload_identity_policy)
61
76
 
62
77
  @_builtins.property
63
78
  @pulumi.getter
@@ -87,7 +102,7 @@ class AuthenticationPolicyArgs:
87
102
  @pulumi.getter(name="authenticationMethods")
88
103
  def authentication_methods(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
89
104
  """
90
- A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
105
+ A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
91
106
  """
92
107
  return pulumi.get(self, "authentication_methods")
93
108
 
@@ -99,7 +114,7 @@ class AuthenticationPolicyArgs:
99
114
  @pulumi.getter(name="clientTypes")
100
115
  def client_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
101
116
  """
102
- A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
117
+ A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
103
118
  """
104
119
  return pulumi.get(self, "client_types")
105
120
 
@@ -121,6 +136,7 @@ class AuthenticationPolicyArgs:
121
136
 
122
137
  @_builtins.property
123
138
  @pulumi.getter(name="mfaAuthenticationMethods")
139
+ @_utilities.deprecated("""This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""")
124
140
  def mfa_authentication_methods(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
125
141
  """
126
142
  A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
@@ -135,7 +151,7 @@ class AuthenticationPolicyArgs:
135
151
  @pulumi.getter(name="mfaEnrollment")
136
152
  def mfa_enrollment(self) -> Optional[pulumi.Input[_builtins.str]]:
137
153
  """
138
- (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
154
+ Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
139
155
  """
140
156
  return pulumi.get(self, "mfa_enrollment")
141
157
 
@@ -143,6 +159,18 @@ class AuthenticationPolicyArgs:
143
159
  def mfa_enrollment(self, value: Optional[pulumi.Input[_builtins.str]]):
144
160
  pulumi.set(self, "mfa_enrollment", value)
145
161
 
162
+ @_builtins.property
163
+ @pulumi.getter(name="mfaPolicy")
164
+ def mfa_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']]:
165
+ """
166
+ Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
167
+ """
168
+ return pulumi.get(self, "mfa_policy")
169
+
170
+ @mfa_policy.setter
171
+ def mfa_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']]):
172
+ pulumi.set(self, "mfa_policy", value)
173
+
146
174
  @_builtins.property
147
175
  @pulumi.getter
148
176
  def name(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -155,11 +183,23 @@ class AuthenticationPolicyArgs:
155
183
  def name(self, value: Optional[pulumi.Input[_builtins.str]]):
156
184
  pulumi.set(self, "name", value)
157
185
 
186
+ @_builtins.property
187
+ @pulumi.getter(name="patPolicy")
188
+ def pat_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']]:
189
+ """
190
+ Specifies the policy for programmatic access tokens.
191
+ """
192
+ return pulumi.get(self, "pat_policy")
193
+
194
+ @pat_policy.setter
195
+ def pat_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']]):
196
+ pulumi.set(self, "pat_policy", value)
197
+
158
198
  @_builtins.property
159
199
  @pulumi.getter(name="securityIntegrations")
160
200
  def security_integrations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
161
201
  """
162
- A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
202
+ A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
163
203
  """
164
204
  return pulumi.get(self, "security_integrations")
165
205
 
@@ -167,6 +207,18 @@ class AuthenticationPolicyArgs:
167
207
  def security_integrations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
168
208
  pulumi.set(self, "security_integrations", value)
169
209
 
210
+ @_builtins.property
211
+ @pulumi.getter(name="workloadIdentityPolicy")
212
+ def workload_identity_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']]:
213
+ """
214
+ Specifies the policy for workload identity federation.
215
+ """
216
+ return pulumi.get(self, "workload_identity_policy")
217
+
218
+ @workload_identity_policy.setter
219
+ def workload_identity_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']]):
220
+ pulumi.set(self, "workload_identity_policy", value)
221
+
170
222
 
171
223
  @pulumi.input_type
172
224
  class _AuthenticationPolicyState:
@@ -179,24 +231,30 @@ class _AuthenticationPolicyState:
179
231
  fully_qualified_name: Optional[pulumi.Input[_builtins.str]] = None,
180
232
  mfa_authentication_methods: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
181
233
  mfa_enrollment: Optional[pulumi.Input[_builtins.str]] = None,
234
+ mfa_policy: Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']] = None,
182
235
  name: Optional[pulumi.Input[_builtins.str]] = None,
236
+ pat_policy: Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']] = None,
183
237
  schema: Optional[pulumi.Input[_builtins.str]] = None,
184
238
  security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
185
- show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input['AuthenticationPolicyShowOutputArgs']]]] = None):
239
+ show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input['AuthenticationPolicyShowOutputArgs']]]] = None,
240
+ workload_identity_policy: Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']] = None):
186
241
  """
187
242
  Input properties used for looking up and filtering AuthenticationPolicy resources.
188
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
189
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
243
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
244
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
190
245
  :param pulumi.Input[_builtins.str] comment: Specifies a comment for the authentication policy.
191
246
  :param pulumi.Input[_builtins.str] database: The database in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
192
247
  :param pulumi.Input[Sequence[pulumi.Input['AuthenticationPolicyDescribeOutputArgs']]] describe_outputs: Outputs the result of `DESCRIBE AUTHENTICATION POLICY` for the given policy.
193
248
  :param pulumi.Input[_builtins.str] fully_qualified_name: Fully qualified name of the resource. For more information, see [object name resolution](https://docs.snowflake.com/en/sql-reference/name-resolution).
194
249
  :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] mfa_authentication_methods: A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
195
- :param pulumi.Input[_builtins.str] mfa_enrollment: (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
250
+ :param pulumi.Input[_builtins.str] mfa_enrollment: Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
251
+ :param pulumi.Input['AuthenticationPolicyMfaPolicyArgs'] mfa_policy: Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
196
252
  :param pulumi.Input[_builtins.str] name: Specifies the identifier for the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
253
+ :param pulumi.Input['AuthenticationPolicyPatPolicyArgs'] pat_policy: Specifies the policy for programmatic access tokens.
197
254
  :param pulumi.Input[_builtins.str] schema: The schema in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
198
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
255
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
199
256
  :param pulumi.Input[Sequence[pulumi.Input['AuthenticationPolicyShowOutputArgs']]] show_outputs: Outputs the result of `SHOW AUTHENTICATION POLICIES` for the given policy.
257
+ :param pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs'] workload_identity_policy: Specifies the policy for workload identity federation.
200
258
  """
201
259
  if authentication_methods is not None:
202
260
  pulumi.set(__self__, "authentication_methods", authentication_methods)
@@ -210,24 +268,33 @@ class _AuthenticationPolicyState:
210
268
  pulumi.set(__self__, "describe_outputs", describe_outputs)
211
269
  if fully_qualified_name is not None:
212
270
  pulumi.set(__self__, "fully_qualified_name", fully_qualified_name)
271
+ if mfa_authentication_methods is not None:
272
+ warnings.warn("""This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""", DeprecationWarning)
273
+ pulumi.log.warn("""mfa_authentication_methods is deprecated: This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""")
213
274
  if mfa_authentication_methods is not None:
214
275
  pulumi.set(__self__, "mfa_authentication_methods", mfa_authentication_methods)
215
276
  if mfa_enrollment is not None:
216
277
  pulumi.set(__self__, "mfa_enrollment", mfa_enrollment)
278
+ if mfa_policy is not None:
279
+ pulumi.set(__self__, "mfa_policy", mfa_policy)
217
280
  if name is not None:
218
281
  pulumi.set(__self__, "name", name)
282
+ if pat_policy is not None:
283
+ pulumi.set(__self__, "pat_policy", pat_policy)
219
284
  if schema is not None:
220
285
  pulumi.set(__self__, "schema", schema)
221
286
  if security_integrations is not None:
222
287
  pulumi.set(__self__, "security_integrations", security_integrations)
223
288
  if show_outputs is not None:
224
289
  pulumi.set(__self__, "show_outputs", show_outputs)
290
+ if workload_identity_policy is not None:
291
+ pulumi.set(__self__, "workload_identity_policy", workload_identity_policy)
225
292
 
226
293
  @_builtins.property
227
294
  @pulumi.getter(name="authenticationMethods")
228
295
  def authentication_methods(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
229
296
  """
230
- A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
297
+ A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
231
298
  """
232
299
  return pulumi.get(self, "authentication_methods")
233
300
 
@@ -239,7 +306,7 @@ class _AuthenticationPolicyState:
239
306
  @pulumi.getter(name="clientTypes")
240
307
  def client_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
241
308
  """
242
- A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
309
+ A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
243
310
  """
244
311
  return pulumi.get(self, "client_types")
245
312
 
@@ -297,6 +364,7 @@ class _AuthenticationPolicyState:
297
364
 
298
365
  @_builtins.property
299
366
  @pulumi.getter(name="mfaAuthenticationMethods")
367
+ @_utilities.deprecated("""This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""")
300
368
  def mfa_authentication_methods(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
301
369
  """
302
370
  A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
@@ -311,7 +379,7 @@ class _AuthenticationPolicyState:
311
379
  @pulumi.getter(name="mfaEnrollment")
312
380
  def mfa_enrollment(self) -> Optional[pulumi.Input[_builtins.str]]:
313
381
  """
314
- (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
382
+ Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
315
383
  """
316
384
  return pulumi.get(self, "mfa_enrollment")
317
385
 
@@ -319,6 +387,18 @@ class _AuthenticationPolicyState:
319
387
  def mfa_enrollment(self, value: Optional[pulumi.Input[_builtins.str]]):
320
388
  pulumi.set(self, "mfa_enrollment", value)
321
389
 
390
+ @_builtins.property
391
+ @pulumi.getter(name="mfaPolicy")
392
+ def mfa_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']]:
393
+ """
394
+ Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
395
+ """
396
+ return pulumi.get(self, "mfa_policy")
397
+
398
+ @mfa_policy.setter
399
+ def mfa_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyMfaPolicyArgs']]):
400
+ pulumi.set(self, "mfa_policy", value)
401
+
322
402
  @_builtins.property
323
403
  @pulumi.getter
324
404
  def name(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -331,6 +411,18 @@ class _AuthenticationPolicyState:
331
411
  def name(self, value: Optional[pulumi.Input[_builtins.str]]):
332
412
  pulumi.set(self, "name", value)
333
413
 
414
+ @_builtins.property
415
+ @pulumi.getter(name="patPolicy")
416
+ def pat_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']]:
417
+ """
418
+ Specifies the policy for programmatic access tokens.
419
+ """
420
+ return pulumi.get(self, "pat_policy")
421
+
422
+ @pat_policy.setter
423
+ def pat_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyPatPolicyArgs']]):
424
+ pulumi.set(self, "pat_policy", value)
425
+
334
426
  @_builtins.property
335
427
  @pulumi.getter
336
428
  def schema(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -347,7 +439,7 @@ class _AuthenticationPolicyState:
347
439
  @pulumi.getter(name="securityIntegrations")
348
440
  def security_integrations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
349
441
  """
350
- A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
442
+ A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
351
443
  """
352
444
  return pulumi.get(self, "security_integrations")
353
445
 
@@ -367,6 +459,18 @@ class _AuthenticationPolicyState:
367
459
  def show_outputs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AuthenticationPolicyShowOutputArgs']]]]):
368
460
  pulumi.set(self, "show_outputs", value)
369
461
 
462
+ @_builtins.property
463
+ @pulumi.getter(name="workloadIdentityPolicy")
464
+ def workload_identity_policy(self) -> Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']]:
465
+ """
466
+ Specifies the policy for workload identity federation.
467
+ """
468
+ return pulumi.get(self, "workload_identity_policy")
469
+
470
+ @workload_identity_policy.setter
471
+ def workload_identity_policy(self, value: Optional[pulumi.Input['AuthenticationPolicyWorkloadIdentityPolicyArgs']]):
472
+ pulumi.set(self, "workload_identity_policy", value)
473
+
370
474
 
371
475
  @pulumi.type_token("snowflake:index/authenticationPolicy:AuthenticationPolicy")
372
476
  class AuthenticationPolicy(pulumi.CustomResource):
@@ -380,9 +484,12 @@ class AuthenticationPolicy(pulumi.CustomResource):
380
484
  database: Optional[pulumi.Input[_builtins.str]] = None,
381
485
  mfa_authentication_methods: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
382
486
  mfa_enrollment: Optional[pulumi.Input[_builtins.str]] = None,
487
+ mfa_policy: Optional[pulumi.Input[Union['AuthenticationPolicyMfaPolicyArgs', 'AuthenticationPolicyMfaPolicyArgsDict']]] = None,
383
488
  name: Optional[pulumi.Input[_builtins.str]] = None,
489
+ pat_policy: Optional[pulumi.Input[Union['AuthenticationPolicyPatPolicyArgs', 'AuthenticationPolicyPatPolicyArgsDict']]] = None,
384
490
  schema: Optional[pulumi.Input[_builtins.str]] = None,
385
491
  security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
492
+ workload_identity_policy: Optional[pulumi.Input[Union['AuthenticationPolicyWorkloadIdentityPolicyArgs', 'AuthenticationPolicyWorkloadIdentityPolicyArgsDict']]] = None,
386
493
  __props__=None):
387
494
  """
388
495
  ## Import
@@ -393,15 +500,18 @@ class AuthenticationPolicy(pulumi.CustomResource):
393
500
 
394
501
  :param str resource_name: The name of the resource.
395
502
  :param pulumi.ResourceOptions opts: Options for the resource.
396
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
397
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
503
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
504
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
398
505
  :param pulumi.Input[_builtins.str] comment: Specifies a comment for the authentication policy.
399
506
  :param pulumi.Input[_builtins.str] database: The database in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
400
507
  :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] mfa_authentication_methods: A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
401
- :param pulumi.Input[_builtins.str] mfa_enrollment: (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
508
+ :param pulumi.Input[_builtins.str] mfa_enrollment: Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
509
+ :param pulumi.Input[Union['AuthenticationPolicyMfaPolicyArgs', 'AuthenticationPolicyMfaPolicyArgsDict']] mfa_policy: Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
402
510
  :param pulumi.Input[_builtins.str] name: Specifies the identifier for the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
511
+ :param pulumi.Input[Union['AuthenticationPolicyPatPolicyArgs', 'AuthenticationPolicyPatPolicyArgsDict']] pat_policy: Specifies the policy for programmatic access tokens.
403
512
  :param pulumi.Input[_builtins.str] schema: The schema in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
404
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
513
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
514
+ :param pulumi.Input[Union['AuthenticationPolicyWorkloadIdentityPolicyArgs', 'AuthenticationPolicyWorkloadIdentityPolicyArgsDict']] workload_identity_policy: Specifies the policy for workload identity federation.
405
515
  """
406
516
  ...
407
517
  @overload
@@ -437,9 +547,12 @@ class AuthenticationPolicy(pulumi.CustomResource):
437
547
  database: Optional[pulumi.Input[_builtins.str]] = None,
438
548
  mfa_authentication_methods: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
439
549
  mfa_enrollment: Optional[pulumi.Input[_builtins.str]] = None,
550
+ mfa_policy: Optional[pulumi.Input[Union['AuthenticationPolicyMfaPolicyArgs', 'AuthenticationPolicyMfaPolicyArgsDict']]] = None,
440
551
  name: Optional[pulumi.Input[_builtins.str]] = None,
552
+ pat_policy: Optional[pulumi.Input[Union['AuthenticationPolicyPatPolicyArgs', 'AuthenticationPolicyPatPolicyArgsDict']]] = None,
441
553
  schema: Optional[pulumi.Input[_builtins.str]] = None,
442
554
  security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
555
+ workload_identity_policy: Optional[pulumi.Input[Union['AuthenticationPolicyWorkloadIdentityPolicyArgs', 'AuthenticationPolicyWorkloadIdentityPolicyArgsDict']]] = None,
443
556
  __props__=None):
444
557
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
445
558
  if not isinstance(opts, pulumi.ResourceOptions):
@@ -457,11 +570,14 @@ class AuthenticationPolicy(pulumi.CustomResource):
457
570
  __props__.__dict__["database"] = database
458
571
  __props__.__dict__["mfa_authentication_methods"] = mfa_authentication_methods
459
572
  __props__.__dict__["mfa_enrollment"] = mfa_enrollment
573
+ __props__.__dict__["mfa_policy"] = mfa_policy
460
574
  __props__.__dict__["name"] = name
575
+ __props__.__dict__["pat_policy"] = pat_policy
461
576
  if schema is None and not opts.urn:
462
577
  raise TypeError("Missing required property 'schema'")
463
578
  __props__.__dict__["schema"] = schema
464
579
  __props__.__dict__["security_integrations"] = security_integrations
580
+ __props__.__dict__["workload_identity_policy"] = workload_identity_policy
465
581
  __props__.__dict__["describe_outputs"] = None
466
582
  __props__.__dict__["fully_qualified_name"] = None
467
583
  __props__.__dict__["show_outputs"] = None
@@ -483,10 +599,13 @@ class AuthenticationPolicy(pulumi.CustomResource):
483
599
  fully_qualified_name: Optional[pulumi.Input[_builtins.str]] = None,
484
600
  mfa_authentication_methods: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
485
601
  mfa_enrollment: Optional[pulumi.Input[_builtins.str]] = None,
602
+ mfa_policy: Optional[pulumi.Input[Union['AuthenticationPolicyMfaPolicyArgs', 'AuthenticationPolicyMfaPolicyArgsDict']]] = None,
486
603
  name: Optional[pulumi.Input[_builtins.str]] = None,
604
+ pat_policy: Optional[pulumi.Input[Union['AuthenticationPolicyPatPolicyArgs', 'AuthenticationPolicyPatPolicyArgsDict']]] = None,
487
605
  schema: Optional[pulumi.Input[_builtins.str]] = None,
488
606
  security_integrations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
489
- show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input[Union['AuthenticationPolicyShowOutputArgs', 'AuthenticationPolicyShowOutputArgsDict']]]]] = None) -> 'AuthenticationPolicy':
607
+ show_outputs: Optional[pulumi.Input[Sequence[pulumi.Input[Union['AuthenticationPolicyShowOutputArgs', 'AuthenticationPolicyShowOutputArgsDict']]]]] = None,
608
+ workload_identity_policy: Optional[pulumi.Input[Union['AuthenticationPolicyWorkloadIdentityPolicyArgs', 'AuthenticationPolicyWorkloadIdentityPolicyArgsDict']]] = None) -> 'AuthenticationPolicy':
490
609
  """
491
610
  Get an existing AuthenticationPolicy resource's state with the given name, id, and optional extra
492
611
  properties used to qualify the lookup.
@@ -494,18 +613,21 @@ class AuthenticationPolicy(pulumi.CustomResource):
494
613
  :param str resource_name: The unique name of the resulting resource.
495
614
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
496
615
  :param pulumi.ResourceOptions opts: Options for the resource.
497
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
498
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
616
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] authentication_methods: A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
617
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] client_types: A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
499
618
  :param pulumi.Input[_builtins.str] comment: Specifies a comment for the authentication policy.
500
619
  :param pulumi.Input[_builtins.str] database: The database in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
501
620
  :param pulumi.Input[Sequence[pulumi.Input[Union['AuthenticationPolicyDescribeOutputArgs', 'AuthenticationPolicyDescribeOutputArgsDict']]]] describe_outputs: Outputs the result of `DESCRIBE AUTHENTICATION POLICY` for the given policy.
502
621
  :param pulumi.Input[_builtins.str] fully_qualified_name: Fully qualified name of the resource. For more information, see [object name resolution](https://docs.snowflake.com/en/sql-reference/name-resolution).
503
622
  :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] mfa_authentication_methods: A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
504
- :param pulumi.Input[_builtins.str] mfa_enrollment: (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
623
+ :param pulumi.Input[_builtins.str] mfa_enrollment: Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
624
+ :param pulumi.Input[Union['AuthenticationPolicyMfaPolicyArgs', 'AuthenticationPolicyMfaPolicyArgsDict']] mfa_policy: Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
505
625
  :param pulumi.Input[_builtins.str] name: Specifies the identifier for the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
626
+ :param pulumi.Input[Union['AuthenticationPolicyPatPolicyArgs', 'AuthenticationPolicyPatPolicyArgsDict']] pat_policy: Specifies the policy for programmatic access tokens.
506
627
  :param pulumi.Input[_builtins.str] schema: The schema in which to create the authentication policy. Due to technical limitations (read more here), avoid using the following characters: `|`, `.`, `"`.
507
- :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
628
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] security_integrations: A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
508
629
  :param pulumi.Input[Sequence[pulumi.Input[Union['AuthenticationPolicyShowOutputArgs', 'AuthenticationPolicyShowOutputArgsDict']]]] show_outputs: Outputs the result of `SHOW AUTHENTICATION POLICIES` for the given policy.
630
+ :param pulumi.Input[Union['AuthenticationPolicyWorkloadIdentityPolicyArgs', 'AuthenticationPolicyWorkloadIdentityPolicyArgsDict']] workload_identity_policy: Specifies the policy for workload identity federation.
509
631
  """
510
632
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
511
633
 
@@ -519,17 +641,20 @@ class AuthenticationPolicy(pulumi.CustomResource):
519
641
  __props__.__dict__["fully_qualified_name"] = fully_qualified_name
520
642
  __props__.__dict__["mfa_authentication_methods"] = mfa_authentication_methods
521
643
  __props__.__dict__["mfa_enrollment"] = mfa_enrollment
644
+ __props__.__dict__["mfa_policy"] = mfa_policy
522
645
  __props__.__dict__["name"] = name
646
+ __props__.__dict__["pat_policy"] = pat_policy
523
647
  __props__.__dict__["schema"] = schema
524
648
  __props__.__dict__["security_integrations"] = security_integrations
525
649
  __props__.__dict__["show_outputs"] = show_outputs
650
+ __props__.__dict__["workload_identity_policy"] = workload_identity_policy
526
651
  return AuthenticationPolicy(resource_name, opts=opts, __props__=__props__)
527
652
 
528
653
  @_builtins.property
529
654
  @pulumi.getter(name="authenticationMethods")
530
655
  def authentication_methods(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
531
656
  """
532
- A list of authentication methods that are allowed during login. This parameter accepts one or more of the following values: `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR`
657
+ A list of authentication methods that are allowed during login. Valid values are (case-insensitive): `ALL` | `SAML` | `PASSWORD` | `OAUTH` | `KEYPAIR` | `PROGRAMMATIC_ACCESS_TOKEN` | `WORKLOAD_IDENTITY`.
533
658
  """
534
659
  return pulumi.get(self, "authentication_methods")
535
660
 
@@ -537,7 +662,7 @@ class AuthenticationPolicy(pulumi.CustomResource):
537
662
  @pulumi.getter(name="clientTypes")
538
663
  def client_types(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
539
664
  """
540
- A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid CLIENT*TYPES, then the login attempt fails. Allowed values are `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL`. The CLIENT*TYPES property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
665
+ A list of clients that can authenticate with Snowflake. If a client tries to connect, and the client is not one of the valid `client_types`, then the login attempt fails. Valid values are (case-insensitive): `ALL` | `SNOWFLAKE_UI` | `DRIVERS` | `SNOWSQL` | `SNOWFLAKE_CLI`. The `client_types` property of an authentication policy is a best effort method to block user logins based on specific clients. It should not be used as the sole control to establish a security boundary.
541
666
  """
542
667
  return pulumi.get(self, "client_types")
543
668
 
@@ -575,6 +700,7 @@ class AuthenticationPolicy(pulumi.CustomResource):
575
700
 
576
701
  @_builtins.property
577
702
  @pulumi.getter(name="mfaAuthenticationMethods")
703
+ @_utilities.deprecated("""This field is deprecated and will be removed in the future. The new field `ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION` will be added in the next versions of the provider. Read our [BCR Migration Guide](https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/SNOWFLAKE_BCR_MIGRATION_GUIDE.md#changes-in-authentication-policies) for more migration steps and more details.""")
578
704
  def mfa_authentication_methods(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
579
705
  """
580
706
  A list of authentication methods that enforce multi-factor authentication (MFA) during login. Authentication methods not listed in this parameter do not prompt for multi-factor authentication. Allowed values are `ALL` | `SAML` | `PASSWORD`.
@@ -585,10 +711,18 @@ class AuthenticationPolicy(pulumi.CustomResource):
585
711
  @pulumi.getter(name="mfaEnrollment")
586
712
  def mfa_enrollment(self) -> pulumi.Output[Optional[_builtins.str]]:
587
713
  """
588
- (Default: `OPTIONAL`) Determines whether a user must enroll in multi-factor authentication. Allowed values are REQUIRED and OPTIONAL. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the CLIENT*TYPES parameter must include SNOWFLAKE*UI, because Snowsight is the only place users can enroll in multi-factor authentication (MFA).
714
+ Determines whether a user must enroll in multi-factor authentication. Valid values are (case-insensitive): `REQUIRED` | `REQUIRED_PASSWORD_ONLY` | `OPTIONAL`. When REQUIRED is specified, Enforces users to enroll in MFA. If this value is used, then the `client_types` parameter must include `snowflake_ui`, because Snowsight is the only place users can enroll in multi-factor authentication (MFA). Note that when you set this value to OPTIONAL, and your account setup forces users to enroll in MFA, then Snowflake may set quietly this value to `REQUIRED_PASSWORD_ONLY`, which may cause permadiff. In this case, you may want to adjust this field value.
589
715
  """
590
716
  return pulumi.get(self, "mfa_enrollment")
591
717
 
718
+ @_builtins.property
719
+ @pulumi.getter(name="mfaPolicy")
720
+ def mfa_policy(self) -> pulumi.Output[Optional['outputs.AuthenticationPolicyMfaPolicy']]:
721
+ """
722
+ Specifies the multi-factor authentication (MFA) methods that users can use as a second factor of authentication.
723
+ """
724
+ return pulumi.get(self, "mfa_policy")
725
+
592
726
  @_builtins.property
593
727
  @pulumi.getter
594
728
  def name(self) -> pulumi.Output[_builtins.str]:
@@ -597,6 +731,14 @@ class AuthenticationPolicy(pulumi.CustomResource):
597
731
  """
598
732
  return pulumi.get(self, "name")
599
733
 
734
+ @_builtins.property
735
+ @pulumi.getter(name="patPolicy")
736
+ def pat_policy(self) -> pulumi.Output[Optional['outputs.AuthenticationPolicyPatPolicy']]:
737
+ """
738
+ Specifies the policy for programmatic access tokens.
739
+ """
740
+ return pulumi.get(self, "pat_policy")
741
+
600
742
  @_builtins.property
601
743
  @pulumi.getter
602
744
  def schema(self) -> pulumi.Output[_builtins.str]:
@@ -609,7 +751,7 @@ class AuthenticationPolicy(pulumi.CustomResource):
609
751
  @pulumi.getter(name="securityIntegrations")
610
752
  def security_integrations(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
611
753
  """
612
- A list of security integrations the authentication policy is associated with. This parameter has no effect when SAML or OAUTH are not in the AUTHENTICATION*METHODS list. All values in the SECURITY*INTEGRATIONS list must be compatible with the values in the AUTHENTICATION*METHODS list. For example, if SECURITY*INTEGRATIONS contains a SAML security integration, and AUTHENTICATION_METHODS contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use ALL as parameter.
754
+ A list of security integrations the authentication policy is associated with. This parameter has no effect when `saml` or `oauth` are not in the `authentication_methods` list. All values in the `security_integrations` list must be compatible with the values in the `authentication_methods` list. For example, if `security_integrations` contains a SAML security integration, and `authentication_methods` contains OAUTH, then you cannot create the authentication policy. To allow all security integrations use `ALL` as parameter.
613
755
  """
614
756
  return pulumi.get(self, "security_integrations")
615
757
 
@@ -621,3 +763,11 @@ class AuthenticationPolicy(pulumi.CustomResource):
621
763
  """
622
764
  return pulumi.get(self, "show_outputs")
623
765
 
766
+ @_builtins.property
767
+ @pulumi.getter(name="workloadIdentityPolicy")
768
+ def workload_identity_policy(self) -> pulumi.Output[Optional['outputs.AuthenticationPolicyWorkloadIdentityPolicy']]:
769
+ """
770
+ Specifies the policy for workload identity federation.
771
+ """
772
+ return pulumi.get(self, "workload_identity_policy")
773
+