# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities

__all__ = ['RoleBindingArgs', 'RoleBinding']

@pulumi.input_type
class RoleBindingArgs:
    def __init__(__self__, *,
                 crn_pattern: pulumi.Input[_builtins.str],
                 principal: pulumi.Input[_builtins.str],
                 role_name: pulumi.Input[_builtins.str],
                 disable_wait_for_ready: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        The set of arguments for constructing a RoleBinding resource.

        :param pulumi.Input[_builtins.str] crn_pattern: A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        :param pulumi.Input[_builtins.str] principal: A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        :param pulumi.Input[_builtins.str] role_name: A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        :param pulumi.Input[_builtins.bool] disable_wait_for_ready: An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.
               
               !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
               For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
               This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.
               
               > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.
               
               > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        """
        pulumi.set(__self__, "crn_pattern", crn_pattern)
        pulumi.set(__self__, "principal", principal)
        pulumi.set(__self__, "role_name", role_name)
        if disable_wait_for_ready is not None:
            pulumi.set(__self__, "disable_wait_for_ready", disable_wait_for_ready)

    @_builtins.property
    @pulumi.getter(name="crnPattern")
    def crn_pattern(self) -> pulumi.Input[_builtins.str]:
        """
        A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        """
        return pulumi.get(self, "crn_pattern")

    @crn_pattern.setter
    def crn_pattern(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "crn_pattern", value)

    @_builtins.property
    @pulumi.getter
    def principal(self) -> pulumi.Input[_builtins.str]:
        """
        A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        """
        return pulumi.get(self, "principal")

    @principal.setter
    def principal(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "principal", value)

    @_builtins.property
    @pulumi.getter(name="roleName")
    def role_name(self) -> pulumi.Input[_builtins.str]:
        """
        A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        return pulumi.get(self, "role_name")

    @role_name.setter
    def role_name(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "role_name", value)

    @_builtins.property
    @pulumi.getter(name="disableWaitForReady")
    def disable_wait_for_ready(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.

        !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
        For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
        This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.

        > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.

        > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        """
        return pulumi.get(self, "disable_wait_for_ready")

    @disable_wait_for_ready.setter
    def disable_wait_for_ready(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_wait_for_ready", value)


@pulumi.input_type
class _RoleBindingState:
    def __init__(__self__, *,
                 crn_pattern: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_wait_for_ready: Optional[pulumi.Input[_builtins.bool]] = None,
                 principal: Optional[pulumi.Input[_builtins.str]] = None,
                 role_name: Optional[pulumi.Input[_builtins.str]] = None):
        """
        Input properties used for looking up and filtering RoleBinding resources.

        :param pulumi.Input[_builtins.str] crn_pattern: A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        :param pulumi.Input[_builtins.bool] disable_wait_for_ready: An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.
               
               !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
               For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
               This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.
               
               > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.
               
               > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        :param pulumi.Input[_builtins.str] principal: A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        :param pulumi.Input[_builtins.str] role_name: A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        if crn_pattern is not None:
            pulumi.set(__self__, "crn_pattern", crn_pattern)
        if disable_wait_for_ready is not None:
            pulumi.set(__self__, "disable_wait_for_ready", disable_wait_for_ready)
        if principal is not None:
            pulumi.set(__self__, "principal", principal)
        if role_name is not None:
            pulumi.set(__self__, "role_name", role_name)

    @_builtins.property
    @pulumi.getter(name="crnPattern")
    def crn_pattern(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        """
        return pulumi.get(self, "crn_pattern")

    @crn_pattern.setter
    def crn_pattern(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "crn_pattern", value)

    @_builtins.property
    @pulumi.getter(name="disableWaitForReady")
    def disable_wait_for_ready(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.

        !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
        For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
        This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.

        > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.

        > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        """
        return pulumi.get(self, "disable_wait_for_ready")

    @disable_wait_for_ready.setter
    def disable_wait_for_ready(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_wait_for_ready", value)

    @_builtins.property
    @pulumi.getter
    def principal(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        """
        return pulumi.get(self, "principal")

    @principal.setter
    def principal(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "principal", value)

    @_builtins.property
    @pulumi.getter(name="roleName")
    def role_name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        return pulumi.get(self, "role_name")

    @role_name.setter
    def role_name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "role_name", value)


@pulumi.type_token("confluentcloud:index/roleBinding:RoleBinding")
class RoleBinding(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 crn_pattern: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_wait_for_ready: Optional[pulumi.Input[_builtins.bool]] = None,
                 principal: Optional[pulumi.Input[_builtins.str]] = None,
                 role_name: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        [![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](https://docs.confluent.io/cloud/current/api.html#section/Versioning/API-Lifecycle-Policy)

        `RoleBinding` provides a Role Binding resource that enables creating, reading, and deleting role bindings on Confluent Cloud.

        > **Note:** For more information on the Role Bindings, see [Predefined RBAC roles in Confluent Cloud](https://docs.confluent.io/cloud/current/access-management/access-control/rbac/predefined-rbac-roles.html).

        ## Example Usage

        ```python
        import pulumi
        import pulumi_confluentcloud as confluentcloud
        import pulumi_std as std

        org_example_rb = confluentcloud.RoleBinding("org-example-rb",
            principal=f"User:{test['id']}",
            role_name="MetricsViewer",
            crn_pattern=demo["resourceName"])
        environment_example_rb = confluentcloud.RoleBinding("environment-example-rb",
            principal=f"User:{test['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        environment_example_rb_skip_sync = confluentcloud.RoleBinding("environment-example-rb-skip-sync",
            principal=f"User:{test['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"],
            disable_wait_for_ready=True)
        environment_example_rb_2 = confluentcloud.RoleBinding("environment-example-rb-2",
            principal=f"User:{test_confluent_identity_pool['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        data_discovery_example_rb = confluentcloud.RoleBinding("data-discovery-example-rb",
            principal=f"User:{test['id']}",
            role_name="DataDiscovery",
            crn_pattern=stag["resourceName"])
        network_example_rb = confluentcloud.RoleBinding("network-example-rb",
            principal=f"User:{test['id']}",
            role_name="NetworkAdmin",
            crn_pattern=demo["resourceName"])
        cluster_example_rb = confluentcloud.RoleBinding("cluster-example-rb",
            principal=f"User:{test['id']}",
            role_name="CloudClusterAdmin",
            crn_pattern=basic["rbacCrn"])
        topic_example_rb = confluentcloud.RoleBinding("topic-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperWrite",
            crn_pattern=f"{standard['rbacCrn']}/kafka={standard['id']}/topic={orders['topicName']}")
        topic_example_rb_2 = confluentcloud.RoleBinding("topic-example-rb-2",
            principal=f"User:{test_confluent_identity_pool['id']}",
            role_name="DeveloperWrite",
            crn_pattern=f"{standard['rbacCrn']}/kafka={standard['id']}/topic={orders['topicName']}")
        group_example_rb = confluentcloud.RoleBinding("group-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{basic['rbacCrn']}/kafka={standard['id']}/group=confluent_cli_consumer_*")
        group_mapping_example_rb = confluentcloud.RoleBinding("group-mapping-example-rb",
            principal=f"User:{application_developers['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        transaction_example_rb = confluentcloud.RoleBinding("transaction-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{basic['rbacCrn']}/kafka={standard['id']}/transactional-id=my_transaction")
        connector_name = std.index.lookup(map=test_confluent_connector["configNonsensitive"],
            key="name",
            default="\\"name\\" attribute is missing")["result"]
        connector_example_rb = confluentcloud.RoleBinding("connector-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{standard['rbacCrn']}/connector={connector_name}")
        all_subjects_example_rb = confluentcloud.RoleBinding("all-subjects-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=*")
        subject_foo_example_rb = confluentcloud.RoleBinding("subject-foo-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=foo")
        subject_with_abc_prefix_example_rb = confluentcloud.RoleBinding("subject-with-abc-prefix-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=abc*")
        kek_example_rb = confluentcloud.RoleBinding("kek-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/kek=kek-name")
        flink_developer_compute_pool_example_rb = confluentcloud.RoleBinding("flink-developer-compute-pool-example-rb",
            principal=f"User:{test['id']}",
            role_name="FlinkDeveloper",
            crn_pattern=f"{stag['resourceName']}/flink-region={example_confluent_flink_compute_pool['cloud']}.{example_confluent_flink_compute_pool['region']}/compute-pool={example_confluent_flink_compute_pool['id']}")
        ```

        ## Getting Started

        The following end-to-end examples might help to get started with `RoleBinding` resource:
          * standard-kafka-rbac: _Standard_ Kafka cluster with authorization using RBAC
          * dedicated-public-kafka-rbac: _Dedicated_ Kafka cluster that is accessible over the public internet with authorization using RBAC
          * dedicated-privatelink-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using RBAC
          * dedicated-privatelink-azure-kafka-rbac: _Dedicated_ Kafka cluster on Azure that is accessible via PrivateLink connections with authorization using RBAC
          * dedicated-vnet-peering-azure-kafka-rbac: _Dedicated_ Kafka cluster on Azure that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-vpc-peering-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-vpc-peering-gcp-kafka-rbac: _Dedicated_ Kafka cluster on GCP that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-transit-gateway-attachment-aws-kafka-acls: _Dedicated_ Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using ACLs
          * dedicated-transit-gateway-attachment-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using RBAC
          * enterprise-privatelinkattachment-aws-kafka-acls: _Enterprise_ Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using ACLs

        ## Example of using time_sleep

        This configuration introduces a 360-second custom delay after the creation of a role binding, before creating a Kafka topic.

        For context, using `disable_wait_for_ready = false` (the default setting) results in a 90-second hardcoded delay, while opting for `disable_wait_for_ready = true` results in a 0-second delay.

        ```python
        import pulumi
        import pulumi_confluentcloud as confluentcloud
        import pulumi_time as time

        app_manager_kafka_cluster_admin_skip_sync = confluentcloud.RoleBinding("app-manager-kafka-cluster-admin-skip-sync",
            principal=f"User:{app_manager['id']}",
            role_name="CloudClusterAdmin",
            crn_pattern=standard["rbacCrn"],
            disable_wait_for_ready=True)
        wait360_seconds_after_role_binding = time.index.Sleep("wait_360_seconds_after_role_binding", create_duration=360s,
        opts = pulumi.ResourceOptions(depends_on=[app_manager_kafka_cluster_admin_skip_sync]))
        orders = confluentcloud.KafkaTopic("orders",
            kafka_cluster={
                "id": standard["id"],
            },
            topic_name="orders",
            rest_endpoint=standard["restEndpoint"],
            credentials={
                "key": app_manager_kafka_api_key["id"],
                "secret": app_manager_kafka_api_key["secret"],
            },
            opts = pulumi.ResourceOptions(depends_on=[wait360_seconds_after_role_binding]))
        ```

        ## Import

        > **Note:** `CONFLUENT_CLOUD_API_KEY` and `CONFLUENT_CLOUD_API_SECRET` environment variables must be set before importing a Role Binding.

        You can import a Role Binding by using Role Binding ID, for example:

        ```sh
        $ export CONFLUENT_CLOUD_API_KEY="<cloud_api_key>"
        $ export CONFLUENT_CLOUD_API_SECRET="<cloud_api_secret>"
        $ pulumi import confluentcloud:index/roleBinding:RoleBinding my_rb rb-f3a90de
        ```

        !> **Warning:** Do not forget to delete terminal command history afterwards for security purposes.


        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] crn_pattern: A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        :param pulumi.Input[_builtins.bool] disable_wait_for_ready: An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.
               
               !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
               For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
               This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.
               
               > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.
               
               > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        :param pulumi.Input[_builtins.str] principal: A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        :param pulumi.Input[_builtins.str] role_name: A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: RoleBindingArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        [![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](https://docs.confluent.io/cloud/current/api.html#section/Versioning/API-Lifecycle-Policy)

        `RoleBinding` provides a Role Binding resource that enables creating, reading, and deleting role bindings on Confluent Cloud.

        > **Note:** For more information on the Role Bindings, see [Predefined RBAC roles in Confluent Cloud](https://docs.confluent.io/cloud/current/access-management/access-control/rbac/predefined-rbac-roles.html).

        ## Example Usage

        ```python
        import pulumi
        import pulumi_confluentcloud as confluentcloud
        import pulumi_std as std

        org_example_rb = confluentcloud.RoleBinding("org-example-rb",
            principal=f"User:{test['id']}",
            role_name="MetricsViewer",
            crn_pattern=demo["resourceName"])
        environment_example_rb = confluentcloud.RoleBinding("environment-example-rb",
            principal=f"User:{test['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        environment_example_rb_skip_sync = confluentcloud.RoleBinding("environment-example-rb-skip-sync",
            principal=f"User:{test['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"],
            disable_wait_for_ready=True)
        environment_example_rb_2 = confluentcloud.RoleBinding("environment-example-rb-2",
            principal=f"User:{test_confluent_identity_pool['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        data_discovery_example_rb = confluentcloud.RoleBinding("data-discovery-example-rb",
            principal=f"User:{test['id']}",
            role_name="DataDiscovery",
            crn_pattern=stag["resourceName"])
        network_example_rb = confluentcloud.RoleBinding("network-example-rb",
            principal=f"User:{test['id']}",
            role_name="NetworkAdmin",
            crn_pattern=demo["resourceName"])
        cluster_example_rb = confluentcloud.RoleBinding("cluster-example-rb",
            principal=f"User:{test['id']}",
            role_name="CloudClusterAdmin",
            crn_pattern=basic["rbacCrn"])
        topic_example_rb = confluentcloud.RoleBinding("topic-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperWrite",
            crn_pattern=f"{standard['rbacCrn']}/kafka={standard['id']}/topic={orders['topicName']}")
        topic_example_rb_2 = confluentcloud.RoleBinding("topic-example-rb-2",
            principal=f"User:{test_confluent_identity_pool['id']}",
            role_name="DeveloperWrite",
            crn_pattern=f"{standard['rbacCrn']}/kafka={standard['id']}/topic={orders['topicName']}")
        group_example_rb = confluentcloud.RoleBinding("group-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{basic['rbacCrn']}/kafka={standard['id']}/group=confluent_cli_consumer_*")
        group_mapping_example_rb = confluentcloud.RoleBinding("group-mapping-example-rb",
            principal=f"User:{application_developers['id']}",
            role_name="EnvironmentAdmin",
            crn_pattern=stag["resourceName"])
        transaction_example_rb = confluentcloud.RoleBinding("transaction-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{basic['rbacCrn']}/kafka={standard['id']}/transactional-id=my_transaction")
        connector_name = std.index.lookup(map=test_confluent_connector["configNonsensitive"],
            key="name",
            default="\\"name\\" attribute is missing")["result"]
        connector_example_rb = confluentcloud.RoleBinding("connector-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{standard['rbacCrn']}/connector={connector_name}")
        all_subjects_example_rb = confluentcloud.RoleBinding("all-subjects-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=*")
        subject_foo_example_rb = confluentcloud.RoleBinding("subject-foo-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=foo")
        subject_with_abc_prefix_example_rb = confluentcloud.RoleBinding("subject-with-abc-prefix-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/subject=abc*")
        kek_example_rb = confluentcloud.RoleBinding("kek-example-rb",
            principal=f"User:{test['id']}",
            role_name="DeveloperRead",
            crn_pattern=f"{example['resourceName']}/kek=kek-name")
        flink_developer_compute_pool_example_rb = confluentcloud.RoleBinding("flink-developer-compute-pool-example-rb",
            principal=f"User:{test['id']}",
            role_name="FlinkDeveloper",
            crn_pattern=f"{stag['resourceName']}/flink-region={example_confluent_flink_compute_pool['cloud']}.{example_confluent_flink_compute_pool['region']}/compute-pool={example_confluent_flink_compute_pool['id']}")
        ```

        ## Getting Started

        The following end-to-end examples might help to get started with `RoleBinding` resource:
          * standard-kafka-rbac: _Standard_ Kafka cluster with authorization using RBAC
          * dedicated-public-kafka-rbac: _Dedicated_ Kafka cluster that is accessible over the public internet with authorization using RBAC
          * dedicated-privatelink-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using RBAC
          * dedicated-privatelink-azure-kafka-rbac: _Dedicated_ Kafka cluster on Azure that is accessible via PrivateLink connections with authorization using RBAC
          * dedicated-vnet-peering-azure-kafka-rbac: _Dedicated_ Kafka cluster on Azure that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-vpc-peering-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-vpc-peering-gcp-kafka-rbac: _Dedicated_ Kafka cluster on GCP that is accessible via VPC Peering connections with authorization using RBAC
          * dedicated-transit-gateway-attachment-aws-kafka-acls: _Dedicated_ Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using ACLs
          * dedicated-transit-gateway-attachment-aws-kafka-rbac: _Dedicated_ Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using RBAC
          * enterprise-privatelinkattachment-aws-kafka-acls: _Enterprise_ Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using ACLs

        ## Example of using time_sleep

        This configuration introduces a 360-second custom delay after the creation of a role binding, before creating a Kafka topic.

        For context, using `disable_wait_for_ready = false` (the default setting) results in a 90-second hardcoded delay, while opting for `disable_wait_for_ready = true` results in a 0-second delay.

        ```python
        import pulumi
        import pulumi_confluentcloud as confluentcloud
        import pulumi_time as time

        app_manager_kafka_cluster_admin_skip_sync = confluentcloud.RoleBinding("app-manager-kafka-cluster-admin-skip-sync",
            principal=f"User:{app_manager['id']}",
            role_name="CloudClusterAdmin",
            crn_pattern=standard["rbacCrn"],
            disable_wait_for_ready=True)
        wait360_seconds_after_role_binding = time.index.Sleep("wait_360_seconds_after_role_binding", create_duration=360s,
        opts = pulumi.ResourceOptions(depends_on=[app_manager_kafka_cluster_admin_skip_sync]))
        orders = confluentcloud.KafkaTopic("orders",
            kafka_cluster={
                "id": standard["id"],
            },
            topic_name="orders",
            rest_endpoint=standard["restEndpoint"],
            credentials={
                "key": app_manager_kafka_api_key["id"],
                "secret": app_manager_kafka_api_key["secret"],
            },
            opts = pulumi.ResourceOptions(depends_on=[wait360_seconds_after_role_binding]))
        ```

        ## Import

        > **Note:** `CONFLUENT_CLOUD_API_KEY` and `CONFLUENT_CLOUD_API_SECRET` environment variables must be set before importing a Role Binding.

        You can import a Role Binding by using Role Binding ID, for example:

        ```sh
        $ export CONFLUENT_CLOUD_API_KEY="<cloud_api_key>"
        $ export CONFLUENT_CLOUD_API_SECRET="<cloud_api_secret>"
        $ pulumi import confluentcloud:index/roleBinding:RoleBinding my_rb rb-f3a90de
        ```

        !> **Warning:** Do not forget to delete terminal command history afterwards for security purposes.


        :param str resource_name: The name of the resource.
        :param RoleBindingArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(RoleBindingArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 crn_pattern: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_wait_for_ready: Optional[pulumi.Input[_builtins.bool]] = None,
                 principal: Optional[pulumi.Input[_builtins.str]] = None,
                 role_name: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = RoleBindingArgs.__new__(RoleBindingArgs)

            if crn_pattern is None and not opts.urn:
                raise TypeError("Missing required property 'crn_pattern'")
            __props__.__dict__["crn_pattern"] = crn_pattern
            __props__.__dict__["disable_wait_for_ready"] = disable_wait_for_ready
            if principal is None and not opts.urn:
                raise TypeError("Missing required property 'principal'")
            __props__.__dict__["principal"] = principal
            if role_name is None and not opts.urn:
                raise TypeError("Missing required property 'role_name'")
            __props__.__dict__["role_name"] = role_name
        super(RoleBinding, __self__).__init__(
            'confluentcloud:index/roleBinding:RoleBinding',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            crn_pattern: Optional[pulumi.Input[_builtins.str]] = None,
            disable_wait_for_ready: Optional[pulumi.Input[_builtins.bool]] = None,
            principal: Optional[pulumi.Input[_builtins.str]] = None,
            role_name: Optional[pulumi.Input[_builtins.str]] = None) -> 'RoleBinding':
        """
        Get an existing RoleBinding resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] crn_pattern: A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        :param pulumi.Input[_builtins.bool] disable_wait_for_ready: An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.
               
               !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
               For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
               This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.
               
               > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.
               
               > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        :param pulumi.Input[_builtins.str] principal: A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        :param pulumi.Input[_builtins.str] role_name: A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _RoleBindingState.__new__(_RoleBindingState)

        __props__.__dict__["crn_pattern"] = crn_pattern
        __props__.__dict__["disable_wait_for_ready"] = disable_wait_for_ready
        __props__.__dict__["principal"] = principal
        __props__.__dict__["role_name"] = role_name
        return RoleBinding(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="crnPattern")
    def crn_pattern(self) -> pulumi.Output[_builtins.str]:
        """
        A [Confluent Resource Name (CRN)](https://docs.confluent.io/cloud/current/api.html#section/Identifiers-and-URLs/Confluent-Resource-Names-(CRNs)) that specifies the scope and resource patterns necessary for the role to bind.
        """
        return pulumi.get(self, "crn_pattern")

    @_builtins.property
    @pulumi.getter(name="disableWaitForReady")
    def disable_wait_for_ready(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        An optional flag to disable wait-for-readiness on create. Must be unset when importing. Defaults to `false`.

        !> **Warning:** When `disable_wait_for_ready = true` is used, Terraform skips waiting for role bindings to fully propagate. This can lead to a situation where Terraform attempts to create resources before the service account has the necessary permissions—resulting in HTTP 403 Forbidden errors.
        For example, if you're creating a new service account, a new Kafka API Key, a new `CloudClusterAdmin` role binding, and a Kafka topic in a single run (see this code snippet), the topic creation may fail if the role binding hasn’t taken effect yet. Without that role, the service account won’t have permission to create the topic.
        This setting is best suited for scenarios where you're provisioning a large number of role bindings without dependent resources, as it significantly speeds up the apply process.

        > **Note:** If you encounter HTTP 403 Forbidden errors when creating role bindings, you can rerun `pulumi up` after a few minutes, once the role bindings have had time to propagate.

        > **Note:** You can also use `time_sleep` resource of HashiCorp's `time` TF provider to configure a custom waiting period, see this example for more details.
        """
        return pulumi.get(self, "disable_wait_for_ready")

    @_builtins.property
    @pulumi.getter
    def principal(self) -> pulumi.Output[_builtins.str]:
        """
        A principal User to bind the role to, for example, "User:u-111aaa" for binding to a user "u-111aaa", or "User:sa-111aaa" for binding to a service account "sa-111aaa".
        """
        return pulumi.get(self, "principal")

    @_builtins.property
    @pulumi.getter(name="roleName")
    def role_name(self) -> pulumi.Output[_builtins.str]:
        """
        A name of the role to bind to the principal. See [Confluent Cloud RBAC Roles](https://docs.confluent.io/cloud/current/access-management/access-control/cloud-rbac.html#ccloud-rbac-roles) for a full list of supported role names.
        """
        return pulumi.get(self, "role_name")

