# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities
from . import outputs
from ._inputs import *

__all__ = [
    'GetProviderIntegrationAuthorizationResult',
    'AwaitableGetProviderIntegrationAuthorizationResult',
    'get_provider_integration_authorization',
    'get_provider_integration_authorization_output',
]

@pulumi.output_type
class GetProviderIntegrationAuthorizationResult:
    """
    A collection of values returned by getProviderIntegrationAuthorization.
    """
    def __init__(__self__, azures=None, environment=None, gcps=None, id=None, provider_integration_id=None):
        if azures and not isinstance(azures, list):
            raise TypeError("Expected argument 'azures' to be a list")
        pulumi.set(__self__, "azures", azures)
        if environment and not isinstance(environment, dict):
            raise TypeError("Expected argument 'environment' to be a dict")
        pulumi.set(__self__, "environment", environment)
        if gcps and not isinstance(gcps, list):
            raise TypeError("Expected argument 'gcps' to be a list")
        pulumi.set(__self__, "gcps", gcps)
        if id and not isinstance(id, str):
            raise TypeError("Expected argument 'id' to be a str")
        pulumi.set(__self__, "id", id)
        if provider_integration_id and not isinstance(provider_integration_id, str):
            raise TypeError("Expected argument 'provider_integration_id' to be a str")
        pulumi.set(__self__, "provider_integration_id", provider_integration_id)

    @_builtins.property
    @pulumi.getter
    def azures(self) -> Sequence['outputs.GetProviderIntegrationAuthorizationAzureResult']:
        """
        (Optional Configuration Block) Azure-specific configuration details. Present for Azure integrations. It supports the following:
        """
        return pulumi.get(self, "azures")

    @_builtins.property
    @pulumi.getter
    def environment(self) -> 'outputs.GetProviderIntegrationAuthorizationEnvironmentResult':
        """
        (Required Configuration Block) supports the following:
        """
        return pulumi.get(self, "environment")

    @_builtins.property
    @pulumi.getter
    def gcps(self) -> Sequence['outputs.GetProviderIntegrationAuthorizationGcpResult']:
        """
        (Optional Configuration Block) GCP-specific configuration details. Present for GCP integrations. It supports the following:
        """
        return pulumi.get(self, "gcps")

    @_builtins.property
    @pulumi.getter
    def id(self) -> _builtins.str:
        """
        (Required String) The ID of the Environment that the Provider Integration belongs to, for example, `env-abc123`.
        """
        return pulumi.get(self, "id")

    @_builtins.property
    @pulumi.getter(name="providerIntegrationId")
    def provider_integration_id(self) -> _builtins.str:
        """
        (Required String) The ID of the provider integration.
        """
        return pulumi.get(self, "provider_integration_id")


class AwaitableGetProviderIntegrationAuthorizationResult(GetProviderIntegrationAuthorizationResult):
    # pylint: disable=using-constant-test
    def __await__(self):
        if False:
            yield self
        return GetProviderIntegrationAuthorizationResult(
            azures=self.azures,
            environment=self.environment,
            gcps=self.gcps,
            id=self.id,
            provider_integration_id=self.provider_integration_id)


def get_provider_integration_authorization(environment: Optional[Union['GetProviderIntegrationAuthorizationEnvironmentArgs', 'GetProviderIntegrationAuthorizationEnvironmentArgsDict']] = None,
                                           id: Optional[_builtins.str] = None,
                                           opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetProviderIntegrationAuthorizationResult:
    """
    [![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](https://docs.confluent.io/cloud/current/api.html#section/Versioning/API-Lifecycle-Policy)

    `ProviderIntegrationAuthorization` describes the authorization configuration for a Cloud Service Provider (CSP) integration, including cloud-specific setup information like Azure multi-tenant app IDs or GCP service accounts.

    ## Example Usage

    ### Azure Provider Integration Authorization

    You can use the authorization data source with either approach:

    ### Option 1: With Azure Terraform Provider

    ```python
    import pulumi
    import pulumi_azuread as azuread
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    azure = confluentcloud.get_provider_integration_authorization(id="cspi-abc123",
        environment={
            "id": "env-xyz456",
        })
    # Create the service principal using Azure Terraform Provider
    confluent = azuread.index.ServicePrincipal("confluent", client_id=azure.azures[0].confluent_multi_tenant_app_id)
    pulumi.export("azureAppId", azure.azures[0].confluent_multi_tenant_app_id)
    pulumi.export("servicePrincipalObjectId", confluent["objectId"])
    ```

    ### Option 2: With CLI Commands

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    azure = confluentcloud.get_provider_integration_authorization(id="cspi-abc123",
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("azureSetupCommand", f"az ad sp create --id {azure.azures[0].confluent_multi_tenant_app_id}")
    ```

    ### GCP Provider Integration Authorization

    You can use the authorization data source with either approach:

    ### Option 1: With Google Terraform Provider

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud
    import pulumi_google as google

    # Get the authorization data
    gcp = confluentcloud.get_provider_integration_authorization(id="cspi-def456",
        environment={
            "id": "env-xyz456",
        })
    # Grant IAM permissions using Google Terraform Provider
    confluent_token_creator = google.index.ProjectIamMember("confluent_token_creator",
        project=gcp_project_id,
        role=roles/iam.serviceAccountTokenCreator,
        member=fserviceAccount:{gcp.gcps[0].google_service_account},
        condition=[{
            title: Confluent Cloud Access,
            description: Allow Confluent Cloud to impersonate the customer service account,
            expression: frequest.auth.claims.sub == '{gcp.gcps[0].google_service_account}',
        }])
    pulumi.export("confluentServiceAccount", gcp.gcps[0].google_service_account)
    pulumi.export("customerServiceAccount", gcp.gcps[0].customer_google_service_account)
    ```

    ### Option 2: With gcloud CLI Commands

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    gcp = confluentcloud.get_provider_integration_authorization(id="cspi-def456",
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("gcpIamCommand", f"gcloud projects add-iam-policy-binding YOUR_PROJECT_ID --member=\\"serviceAccount:{gcp.gcps[0].google_service_account}\\" --role=\\"roles/iam.serviceAccountTokenCreator\\" --condition=\\"expression=request.auth.claims.sub=='{gcp.gcps[0].google_service_account}'\\"")
    pulumi.export("confluentServiceAccount", gcp.gcps[0].google_service_account)
    ```

    ### Using with Integration Data Source

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    main = confluentcloud.get_provider_integration_setup(display_name="my-integration",
        environment={
            "id": "env-xyz456",
        })
    main_get_provider_integration_authorization = confluentcloud.get_provider_integration_authorization(id=main.id,
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("setupInfo", {
        "appId": main_get_provider_integration_authorization.azures[0].confluent_multi_tenant_app_id,
        "command": f"az ad sp create --id {main_get_provider_integration_authorization.azures[0].confluent_multi_tenant_app_id}",
    } if main.cloud == "AZURE" else {
        "confluentSa": main_get_provider_integration_authorization.gcps[0].google_service_account,
        "customerSa": main_get_provider_integration_authorization.gcps[0].customer_google_service_account,
    })
    ```

    ## Getting Started

    The following end-to-end examples might help to get started with `ProviderIntegrationAuthorization` data source:
    * provider-integration-azure: Complete Azure Provider Integration setup
    * provider-integration-gcp: Complete GCP Provider Integration setup


    :param Union['GetProviderIntegrationAuthorizationEnvironmentArgs', 'GetProviderIntegrationAuthorizationEnvironmentArgsDict'] environment: (Required Configuration Block) supports the following:
    :param _builtins.str id: The ID of the Provider Integration Authorization, for example, `cspi-4xg0q`.
    """
    __args__ = dict()
    __args__['environment'] = environment
    __args__['id'] = id
    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke('confluentcloud:index/getProviderIntegrationAuthorization:getProviderIntegrationAuthorization', __args__, opts=opts, typ=GetProviderIntegrationAuthorizationResult).value

    return AwaitableGetProviderIntegrationAuthorizationResult(
        azures=pulumi.get(__ret__, 'azures'),
        environment=pulumi.get(__ret__, 'environment'),
        gcps=pulumi.get(__ret__, 'gcps'),
        id=pulumi.get(__ret__, 'id'),
        provider_integration_id=pulumi.get(__ret__, 'provider_integration_id'))
def get_provider_integration_authorization_output(environment: Optional[pulumi.Input[Union['GetProviderIntegrationAuthorizationEnvironmentArgs', 'GetProviderIntegrationAuthorizationEnvironmentArgsDict']]] = None,
                                                  id: Optional[pulumi.Input[_builtins.str]] = None,
                                                  opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetProviderIntegrationAuthorizationResult]:
    """
    [![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](https://docs.confluent.io/cloud/current/api.html#section/Versioning/API-Lifecycle-Policy)

    `ProviderIntegrationAuthorization` describes the authorization configuration for a Cloud Service Provider (CSP) integration, including cloud-specific setup information like Azure multi-tenant app IDs or GCP service accounts.

    ## Example Usage

    ### Azure Provider Integration Authorization

    You can use the authorization data source with either approach:

    ### Option 1: With Azure Terraform Provider

    ```python
    import pulumi
    import pulumi_azuread as azuread
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    azure = confluentcloud.get_provider_integration_authorization(id="cspi-abc123",
        environment={
            "id": "env-xyz456",
        })
    # Create the service principal using Azure Terraform Provider
    confluent = azuread.index.ServicePrincipal("confluent", client_id=azure.azures[0].confluent_multi_tenant_app_id)
    pulumi.export("azureAppId", azure.azures[0].confluent_multi_tenant_app_id)
    pulumi.export("servicePrincipalObjectId", confluent["objectId"])
    ```

    ### Option 2: With CLI Commands

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    azure = confluentcloud.get_provider_integration_authorization(id="cspi-abc123",
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("azureSetupCommand", f"az ad sp create --id {azure.azures[0].confluent_multi_tenant_app_id}")
    ```

    ### GCP Provider Integration Authorization

    You can use the authorization data source with either approach:

    ### Option 1: With Google Terraform Provider

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud
    import pulumi_google as google

    # Get the authorization data
    gcp = confluentcloud.get_provider_integration_authorization(id="cspi-def456",
        environment={
            "id": "env-xyz456",
        })
    # Grant IAM permissions using Google Terraform Provider
    confluent_token_creator = google.index.ProjectIamMember("confluent_token_creator",
        project=gcp_project_id,
        role=roles/iam.serviceAccountTokenCreator,
        member=fserviceAccount:{gcp.gcps[0].google_service_account},
        condition=[{
            title: Confluent Cloud Access,
            description: Allow Confluent Cloud to impersonate the customer service account,
            expression: frequest.auth.claims.sub == '{gcp.gcps[0].google_service_account}',
        }])
    pulumi.export("confluentServiceAccount", gcp.gcps[0].google_service_account)
    pulumi.export("customerServiceAccount", gcp.gcps[0].customer_google_service_account)
    ```

    ### Option 2: With gcloud CLI Commands

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    # Get the authorization data
    gcp = confluentcloud.get_provider_integration_authorization(id="cspi-def456",
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("gcpIamCommand", f"gcloud projects add-iam-policy-binding YOUR_PROJECT_ID --member=\\"serviceAccount:{gcp.gcps[0].google_service_account}\\" --role=\\"roles/iam.serviceAccountTokenCreator\\" --condition=\\"expression=request.auth.claims.sub=='{gcp.gcps[0].google_service_account}'\\"")
    pulumi.export("confluentServiceAccount", gcp.gcps[0].google_service_account)
    ```

    ### Using with Integration Data Source

    ```python
    import pulumi
    import pulumi_confluentcloud as confluentcloud

    main = confluentcloud.get_provider_integration_setup(display_name="my-integration",
        environment={
            "id": "env-xyz456",
        })
    main_get_provider_integration_authorization = confluentcloud.get_provider_integration_authorization(id=main.id,
        environment={
            "id": "env-xyz456",
        })
    pulumi.export("setupInfo", {
        "appId": main_get_provider_integration_authorization.azures[0].confluent_multi_tenant_app_id,
        "command": f"az ad sp create --id {main_get_provider_integration_authorization.azures[0].confluent_multi_tenant_app_id}",
    } if main.cloud == "AZURE" else {
        "confluentSa": main_get_provider_integration_authorization.gcps[0].google_service_account,
        "customerSa": main_get_provider_integration_authorization.gcps[0].customer_google_service_account,
    })
    ```

    ## Getting Started

    The following end-to-end examples might help to get started with `ProviderIntegrationAuthorization` data source:
    * provider-integration-azure: Complete Azure Provider Integration setup
    * provider-integration-gcp: Complete GCP Provider Integration setup


    :param Union['GetProviderIntegrationAuthorizationEnvironmentArgs', 'GetProviderIntegrationAuthorizationEnvironmentArgsDict'] environment: (Required Configuration Block) supports the following:
    :param _builtins.str id: The ID of the Provider Integration Authorization, for example, `cspi-4xg0q`.
    """
    __args__ = dict()
    __args__['environment'] = environment
    __args__['id'] = id
    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke_output('confluentcloud:index/getProviderIntegrationAuthorization:getProviderIntegrationAuthorization', __args__, opts=opts, typ=GetProviderIntegrationAuthorizationResult)
    return __ret__.apply(lambda __response__: GetProviderIntegrationAuthorizationResult(
        azures=pulumi.get(__response__, 'azures'),
        environment=pulumi.get(__response__, 'environment'),
        gcps=pulumi.get(__response__, 'gcps'),
        id=pulumi.get(__response__, 'id'),
        provider_integration_id=pulumi.get(__response__, 'provider_integration_id')))
