# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities
from . import outputs
from ._inputs import *

__all__ = ['InstanceProfileArgs', 'InstanceProfile']

@pulumi.input_type
class InstanceProfileArgs:
    def __init__(__self__, *,
                 instance_profile_arn: pulumi.Input[_builtins.str],
                 iam_role_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 is_meta_instance_profile: Optional[pulumi.Input[_builtins.bool]] = None,
                 provider_config: Optional[pulumi.Input['InstanceProfileProviderConfigArgs']] = None,
                 skip_validation: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        The set of arguments for constructing a InstanceProfile resource.
        :param pulumi.Input[_builtins.str] instance_profile_arn: `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        :param pulumi.Input[_builtins.str] iam_role_arn: The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        :param pulumi.Input[_builtins.bool] is_meta_instance_profile: Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        :param pulumi.Input['InstanceProfileProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.bool] skip_validation: **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        pulumi.set(__self__, "instance_profile_arn", instance_profile_arn)
        if iam_role_arn is not None:
            pulumi.set(__self__, "iam_role_arn", iam_role_arn)
        if is_meta_instance_profile is not None:
            pulumi.set(__self__, "is_meta_instance_profile", is_meta_instance_profile)
        if provider_config is not None:
            pulumi.set(__self__, "provider_config", provider_config)
        if skip_validation is not None:
            pulumi.set(__self__, "skip_validation", skip_validation)

    @_builtins.property
    @pulumi.getter(name="instanceProfileArn")
    def instance_profile_arn(self) -> pulumi.Input[_builtins.str]:
        """
        `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        """
        return pulumi.get(self, "instance_profile_arn")

    @instance_profile_arn.setter
    def instance_profile_arn(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "instance_profile_arn", value)

    @_builtins.property
    @pulumi.getter(name="iamRoleArn")
    def iam_role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        """
        return pulumi.get(self, "iam_role_arn")

    @iam_role_arn.setter
    def iam_role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "iam_role_arn", value)

    @_builtins.property
    @pulumi.getter(name="isMetaInstanceProfile")
    def is_meta_instance_profile(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        """
        return pulumi.get(self, "is_meta_instance_profile")

    @is_meta_instance_profile.setter
    def is_meta_instance_profile(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "is_meta_instance_profile", value)

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> Optional[pulumi.Input['InstanceProfileProviderConfigArgs']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @provider_config.setter
    def provider_config(self, value: Optional[pulumi.Input['InstanceProfileProviderConfigArgs']]):
        pulumi.set(self, "provider_config", value)

    @_builtins.property
    @pulumi.getter(name="skipValidation")
    def skip_validation(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        return pulumi.get(self, "skip_validation")

    @skip_validation.setter
    def skip_validation(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "skip_validation", value)


@pulumi.input_type
class _InstanceProfileState:
    def __init__(__self__, *,
                 iam_role_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 instance_profile_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 is_meta_instance_profile: Optional[pulumi.Input[_builtins.bool]] = None,
                 provider_config: Optional[pulumi.Input['InstanceProfileProviderConfigArgs']] = None,
                 skip_validation: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        Input properties used for looking up and filtering InstanceProfile resources.
        :param pulumi.Input[_builtins.str] iam_role_arn: The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        :param pulumi.Input[_builtins.str] instance_profile_arn: `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        :param pulumi.Input[_builtins.bool] is_meta_instance_profile: Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        :param pulumi.Input['InstanceProfileProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.bool] skip_validation: **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        if iam_role_arn is not None:
            pulumi.set(__self__, "iam_role_arn", iam_role_arn)
        if instance_profile_arn is not None:
            pulumi.set(__self__, "instance_profile_arn", instance_profile_arn)
        if is_meta_instance_profile is not None:
            pulumi.set(__self__, "is_meta_instance_profile", is_meta_instance_profile)
        if provider_config is not None:
            pulumi.set(__self__, "provider_config", provider_config)
        if skip_validation is not None:
            pulumi.set(__self__, "skip_validation", skip_validation)

    @_builtins.property
    @pulumi.getter(name="iamRoleArn")
    def iam_role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        """
        return pulumi.get(self, "iam_role_arn")

    @iam_role_arn.setter
    def iam_role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "iam_role_arn", value)

    @_builtins.property
    @pulumi.getter(name="instanceProfileArn")
    def instance_profile_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        """
        return pulumi.get(self, "instance_profile_arn")

    @instance_profile_arn.setter
    def instance_profile_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "instance_profile_arn", value)

    @_builtins.property
    @pulumi.getter(name="isMetaInstanceProfile")
    def is_meta_instance_profile(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        """
        return pulumi.get(self, "is_meta_instance_profile")

    @is_meta_instance_profile.setter
    def is_meta_instance_profile(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "is_meta_instance_profile", value)

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> Optional[pulumi.Input['InstanceProfileProviderConfigArgs']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @provider_config.setter
    def provider_config(self, value: Optional[pulumi.Input['InstanceProfileProviderConfigArgs']]):
        pulumi.set(self, "provider_config", value)

    @_builtins.property
    @pulumi.getter(name="skipValidation")
    def skip_validation(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        return pulumi.get(self, "skip_validation")

    @skip_validation.setter
    def skip_validation(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "skip_validation", value)


@pulumi.type_token("databricks:index/instanceProfile:InstanceProfile")
class InstanceProfile(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 iam_role_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 instance_profile_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 is_meta_instance_profile: Optional[pulumi.Input[_builtins.bool]] = None,
                 provider_config: Optional[pulumi.Input[Union['InstanceProfileProviderConfigArgs', 'InstanceProfileProviderConfigArgsDict']]] = None,
                 skip_validation: Optional[pulumi.Input[_builtins.bool]] = None,
                 __props__=None):
        """
        This resource allows you to manage AWS EC2 instance profiles that users can launch Cluster and access data, like databricks_mount. The following example demonstrates how to create an instance profile and create a cluster with it. When creating a new `InstanceProfile`, Databricks validates that it has sufficient permissions to launch instances with the instance profile. This validation uses AWS dry-run mode for the [AWS EC2 RunInstances API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html).

        > This resource can only be used with a workspace-level provider!

        > Please switch to StorageCredential with Unity Catalog to manage storage credentials, which provides a better and faster way for managing credential security.

        ## Usage with Cluster Policies

        It is advised to keep all common configurations in Cluster Policies to maintain control of the environments launched, so `Cluster` above could be replaced with `ClusterPolicy`:

        ```python
        import pulumi
        import json
        import pulumi_databricks as databricks

        this = databricks.ClusterPolicy("this",
            name="Policy with predefined instance profile",
            definition=json.dumps({
                "aws_attributes.instance_profile_arn": {
                    "type": "fixed",
                    "value": shared["id"],
                },
            }))
        ```

        ## Granting access to all users

        You can make instance profile available to all users by associating it with the special group called `users` through Group data source.

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.InstanceProfile("this", instance_profile_arn=shared["id"])
        users = databricks.get_group(display_name="users")
        all = databricks.GroupInstanceProfile("all",
            group_id=users.id,
            instance_profile_id=this.id)
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] iam_role_arn: The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        :param pulumi.Input[_builtins.str] instance_profile_arn: `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        :param pulumi.Input[_builtins.bool] is_meta_instance_profile: Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        :param pulumi.Input[Union['InstanceProfileProviderConfigArgs', 'InstanceProfileProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.bool] skip_validation: **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: InstanceProfileArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        This resource allows you to manage AWS EC2 instance profiles that users can launch Cluster and access data, like databricks_mount. The following example demonstrates how to create an instance profile and create a cluster with it. When creating a new `InstanceProfile`, Databricks validates that it has sufficient permissions to launch instances with the instance profile. This validation uses AWS dry-run mode for the [AWS EC2 RunInstances API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html).

        > This resource can only be used with a workspace-level provider!

        > Please switch to StorageCredential with Unity Catalog to manage storage credentials, which provides a better and faster way for managing credential security.

        ## Usage with Cluster Policies

        It is advised to keep all common configurations in Cluster Policies to maintain control of the environments launched, so `Cluster` above could be replaced with `ClusterPolicy`:

        ```python
        import pulumi
        import json
        import pulumi_databricks as databricks

        this = databricks.ClusterPolicy("this",
            name="Policy with predefined instance profile",
            definition=json.dumps({
                "aws_attributes.instance_profile_arn": {
                    "type": "fixed",
                    "value": shared["id"],
                },
            }))
        ```

        ## Granting access to all users

        You can make instance profile available to all users by associating it with the special group called `users` through Group data source.

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.InstanceProfile("this", instance_profile_arn=shared["id"])
        users = databricks.get_group(display_name="users")
        all = databricks.GroupInstanceProfile("all",
            group_id=users.id,
            instance_profile_id=this.id)
        ```

        :param str resource_name: The name of the resource.
        :param InstanceProfileArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(InstanceProfileArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 iam_role_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 instance_profile_arn: Optional[pulumi.Input[_builtins.str]] = None,
                 is_meta_instance_profile: Optional[pulumi.Input[_builtins.bool]] = None,
                 provider_config: Optional[pulumi.Input[Union['InstanceProfileProviderConfigArgs', 'InstanceProfileProviderConfigArgsDict']]] = None,
                 skip_validation: Optional[pulumi.Input[_builtins.bool]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = InstanceProfileArgs.__new__(InstanceProfileArgs)

            __props__.__dict__["iam_role_arn"] = iam_role_arn
            if instance_profile_arn is None and not opts.urn:
                raise TypeError("Missing required property 'instance_profile_arn'")
            __props__.__dict__["instance_profile_arn"] = instance_profile_arn
            __props__.__dict__["is_meta_instance_profile"] = is_meta_instance_profile
            __props__.__dict__["provider_config"] = provider_config
            __props__.__dict__["skip_validation"] = skip_validation
        super(InstanceProfile, __self__).__init__(
            'databricks:index/instanceProfile:InstanceProfile',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            iam_role_arn: Optional[pulumi.Input[_builtins.str]] = None,
            instance_profile_arn: Optional[pulumi.Input[_builtins.str]] = None,
            is_meta_instance_profile: Optional[pulumi.Input[_builtins.bool]] = None,
            provider_config: Optional[pulumi.Input[Union['InstanceProfileProviderConfigArgs', 'InstanceProfileProviderConfigArgsDict']]] = None,
            skip_validation: Optional[pulumi.Input[_builtins.bool]] = None) -> 'InstanceProfile':
        """
        Get an existing InstanceProfile resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] iam_role_arn: The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        :param pulumi.Input[_builtins.str] instance_profile_arn: `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        :param pulumi.Input[_builtins.bool] is_meta_instance_profile: Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        :param pulumi.Input[Union['InstanceProfileProviderConfigArgs', 'InstanceProfileProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.bool] skip_validation: **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _InstanceProfileState.__new__(_InstanceProfileState)

        __props__.__dict__["iam_role_arn"] = iam_role_arn
        __props__.__dict__["instance_profile_arn"] = instance_profile_arn
        __props__.__dict__["is_meta_instance_profile"] = is_meta_instance_profile
        __props__.__dict__["provider_config"] = provider_config
        __props__.__dict__["skip_validation"] = skip_validation
        return InstanceProfile(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="iamRoleArn")
    def iam_role_arn(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The AWS IAM role ARN of the role associated with the instance profile. It must have the form `arn:aws:iam::<account-id>:role/<name>`. This field is required if your role name and instance profile name do not match and you want to use the instance profile with Databricks SQL Serverless.
        """
        return pulumi.get(self, "iam_role_arn")

    @_builtins.property
    @pulumi.getter(name="instanceProfileArn")
    def instance_profile_arn(self) -> pulumi.Output[_builtins.str]:
        """
        `ARN` attribute of `aws_iam_instance_profile` output, the EC2 instance profile association to AWS IAM role. This ARN would be validated upon resource creation.
        """
        return pulumi.get(self, "instance_profile_arn")

    @_builtins.property
    @pulumi.getter(name="isMetaInstanceProfile")
    def is_meta_instance_profile(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Whether the instance profile is a meta instance profile. Used only in [IAM credential passthrough](https://docs.databricks.com/security/credential-passthrough/iam-passthrough.html).
        """
        return pulumi.get(self, "is_meta_instance_profile")

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> pulumi.Output[Optional['outputs.InstanceProfileProviderConfig']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @_builtins.property
    @pulumi.getter(name="skipValidation")
    def skip_validation(self) -> pulumi.Output[_builtins.bool]:
        """
        **For advanced usage only.** If validation fails with an error message that does not indicate an IAM related permission issue, (e.g. "Your requested instance type is not supported in your requested availability zone"), you can pass this flag to skip the validation and forcibly add the instance profile.
        """
        return pulumi.get(self, "skip_validation")

