# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities

__all__ = [
    'GetAwsCrossAccountPolicyResult',
    'AwaitableGetAwsCrossAccountPolicyResult',
    'get_aws_cross_account_policy',
    'get_aws_cross_account_policy_output',
]

@pulumi.output_type
class GetAwsCrossAccountPolicyResult:
    """
    A collection of values returned by getAwsCrossAccountPolicy.
    """
    def __init__(__self__, aws_account_id=None, aws_partition=None, id=None, json=None, pass_roles=None, policy_type=None, region=None, security_group_id=None, vpc_id=None):
        if aws_account_id and not isinstance(aws_account_id, str):
            raise TypeError("Expected argument 'aws_account_id' to be a str")
        pulumi.set(__self__, "aws_account_id", aws_account_id)
        if aws_partition and not isinstance(aws_partition, str):
            raise TypeError("Expected argument 'aws_partition' to be a str")
        pulumi.set(__self__, "aws_partition", aws_partition)
        if id and not isinstance(id, str):
            raise TypeError("Expected argument 'id' to be a str")
        pulumi.set(__self__, "id", id)
        if json and not isinstance(json, str):
            raise TypeError("Expected argument 'json' to be a str")
        pulumi.set(__self__, "json", json)
        if pass_roles and not isinstance(pass_roles, list):
            raise TypeError("Expected argument 'pass_roles' to be a list")
        pulumi.set(__self__, "pass_roles", pass_roles)
        if policy_type and not isinstance(policy_type, str):
            raise TypeError("Expected argument 'policy_type' to be a str")
        pulumi.set(__self__, "policy_type", policy_type)
        if region and not isinstance(region, str):
            raise TypeError("Expected argument 'region' to be a str")
        pulumi.set(__self__, "region", region)
        if security_group_id and not isinstance(security_group_id, str):
            raise TypeError("Expected argument 'security_group_id' to be a str")
        pulumi.set(__self__, "security_group_id", security_group_id)
        if vpc_id and not isinstance(vpc_id, str):
            raise TypeError("Expected argument 'vpc_id' to be a str")
        pulumi.set(__self__, "vpc_id", vpc_id)

    @_builtins.property
    @pulumi.getter(name="awsAccountId")
    def aws_account_id(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "aws_account_id")

    @_builtins.property
    @pulumi.getter(name="awsPartition")
    def aws_partition(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "aws_partition")

    @_builtins.property
    @pulumi.getter
    def id(self) -> _builtins.str:
        """
        The provider-assigned unique ID for this managed resource.
        """
        return pulumi.get(self, "id")

    @_builtins.property
    @pulumi.getter
    def json(self) -> _builtins.str:
        """
        AWS IAM Policy JSON document
        """
        return pulumi.get(self, "json")

    @_builtins.property
    @pulumi.getter(name="passRoles")
    def pass_roles(self) -> Optional[Sequence[_builtins.str]]:
        return pulumi.get(self, "pass_roles")

    @_builtins.property
    @pulumi.getter(name="policyType")
    def policy_type(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "policy_type")

    @_builtins.property
    @pulumi.getter
    def region(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "region")

    @_builtins.property
    @pulumi.getter(name="securityGroupId")
    def security_group_id(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "security_group_id")

    @_builtins.property
    @pulumi.getter(name="vpcId")
    def vpc_id(self) -> Optional[_builtins.str]:
        return pulumi.get(self, "vpc_id")


class AwaitableGetAwsCrossAccountPolicyResult(GetAwsCrossAccountPolicyResult):
    # pylint: disable=using-constant-test
    def __await__(self):
        if False:
            yield self
        return GetAwsCrossAccountPolicyResult(
            aws_account_id=self.aws_account_id,
            aws_partition=self.aws_partition,
            id=self.id,
            json=self.json,
            pass_roles=self.pass_roles,
            policy_type=self.policy_type,
            region=self.region,
            security_group_id=self.security_group_id,
            vpc_id=self.vpc_id)


def get_aws_cross_account_policy(aws_account_id: Optional[_builtins.str] = None,
                                 aws_partition: Optional[_builtins.str] = None,
                                 pass_roles: Optional[Sequence[_builtins.str]] = None,
                                 policy_type: Optional[_builtins.str] = None,
                                 region: Optional[_builtins.str] = None,
                                 security_group_id: Optional[_builtins.str] = None,
                                 vpc_id: Optional[_builtins.str] = None,
                                 opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetAwsCrossAccountPolicyResult:
    """
    This data source constructs necessary AWS cross-account policy for you, which is based on [official documentation](https://docs.databricks.com/administration-guide/account-api/iam-role.html#language-Your%C2%A0VPC,%C2%A0default).

    > This data source can be used with an account or workspace-level provider.

    ## Example Usage

    For more detailed usage please see get_aws_assume_role_policy or databricks_aws_s3_mount pages.

    ```python
    import pulumi
    import pulumi_databricks as databricks

    this = databricks.get_aws_cross_account_policy()
    ```

    ## Related Resources

    The following resources are used in the same context:

    * Provisioning AWS Databricks workspaces with a Hub & Spoke firewall for data exfiltration protection guide
    * get_aws_assume_role_policy data to construct the necessary AWS STS assume role policy.
    * get_aws_bucket_policy data to configure a simple access policy for AWS S3 buckets, so that Databricks can access data in it.
    * InstanceProfile to manage AWS EC2 instance profiles that users can launch Cluster and access data, like databricks_mount.


    :param _builtins.str aws_account_id: — Your AWS account ID, which is a number.
    :param _builtins.str aws_partition: AWS partition. The options are `aws`, `aws-us-gov`, or `aws-us-gov-dod`. Defaults to `aws`
    :param Sequence[_builtins.str] pass_roles: List of Data IAM role ARNs that are explicitly granted `iam:PassRole` action.
           The below arguments are only valid for `restricted` policy type
    :param _builtins.str policy_type: The type of cross account policy to generated: `managed` for Databricks-managed VPC and `customer` for customer-managed VPC, `restricted` for customer-managed VPC with policy restrictions
    :param _builtins.str region: — AWS Region name for your VPC deployment, for example `us-west-2`.
    :param _builtins.str security_group_id: — ID of your AWS security group. When you add a security group restriction, you cannot reuse the cross-account IAM role or reference a credentials ID (`credentials_id`) for any other workspaces. For those other workspaces, you must create separate roles, policies, and credentials objects.
    :param _builtins.str vpc_id: — ID of the AWS VPC where you want to launch workspaces.
    """
    __args__ = dict()
    __args__['awsAccountId'] = aws_account_id
    __args__['awsPartition'] = aws_partition
    __args__['passRoles'] = pass_roles
    __args__['policyType'] = policy_type
    __args__['region'] = region
    __args__['securityGroupId'] = security_group_id
    __args__['vpcId'] = vpc_id
    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke('databricks:index/getAwsCrossAccountPolicy:getAwsCrossAccountPolicy', __args__, opts=opts, typ=GetAwsCrossAccountPolicyResult).value

    return AwaitableGetAwsCrossAccountPolicyResult(
        aws_account_id=pulumi.get(__ret__, 'aws_account_id'),
        aws_partition=pulumi.get(__ret__, 'aws_partition'),
        id=pulumi.get(__ret__, 'id'),
        json=pulumi.get(__ret__, 'json'),
        pass_roles=pulumi.get(__ret__, 'pass_roles'),
        policy_type=pulumi.get(__ret__, 'policy_type'),
        region=pulumi.get(__ret__, 'region'),
        security_group_id=pulumi.get(__ret__, 'security_group_id'),
        vpc_id=pulumi.get(__ret__, 'vpc_id'))
def get_aws_cross_account_policy_output(aws_account_id: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        aws_partition: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        pass_roles: Optional[pulumi.Input[Optional[Sequence[_builtins.str]]]] = None,
                                        policy_type: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        region: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        security_group_id: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        vpc_id: Optional[pulumi.Input[Optional[_builtins.str]]] = None,
                                        opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetAwsCrossAccountPolicyResult]:
    """
    This data source constructs necessary AWS cross-account policy for you, which is based on [official documentation](https://docs.databricks.com/administration-guide/account-api/iam-role.html#language-Your%C2%A0VPC,%C2%A0default).

    > This data source can be used with an account or workspace-level provider.

    ## Example Usage

    For more detailed usage please see get_aws_assume_role_policy or databricks_aws_s3_mount pages.

    ```python
    import pulumi
    import pulumi_databricks as databricks

    this = databricks.get_aws_cross_account_policy()
    ```

    ## Related Resources

    The following resources are used in the same context:

    * Provisioning AWS Databricks workspaces with a Hub & Spoke firewall for data exfiltration protection guide
    * get_aws_assume_role_policy data to construct the necessary AWS STS assume role policy.
    * get_aws_bucket_policy data to configure a simple access policy for AWS S3 buckets, so that Databricks can access data in it.
    * InstanceProfile to manage AWS EC2 instance profiles that users can launch Cluster and access data, like databricks_mount.


    :param _builtins.str aws_account_id: — Your AWS account ID, which is a number.
    :param _builtins.str aws_partition: AWS partition. The options are `aws`, `aws-us-gov`, or `aws-us-gov-dod`. Defaults to `aws`
    :param Sequence[_builtins.str] pass_roles: List of Data IAM role ARNs that are explicitly granted `iam:PassRole` action.
           The below arguments are only valid for `restricted` policy type
    :param _builtins.str policy_type: The type of cross account policy to generated: `managed` for Databricks-managed VPC and `customer` for customer-managed VPC, `restricted` for customer-managed VPC with policy restrictions
    :param _builtins.str region: — AWS Region name for your VPC deployment, for example `us-west-2`.
    :param _builtins.str security_group_id: — ID of your AWS security group. When you add a security group restriction, you cannot reuse the cross-account IAM role or reference a credentials ID (`credentials_id`) for any other workspaces. For those other workspaces, you must create separate roles, policies, and credentials objects.
    :param _builtins.str vpc_id: — ID of the AWS VPC where you want to launch workspaces.
    """
    __args__ = dict()
    __args__['awsAccountId'] = aws_account_id
    __args__['awsPartition'] = aws_partition
    __args__['passRoles'] = pass_roles
    __args__['policyType'] = policy_type
    __args__['region'] = region
    __args__['securityGroupId'] = security_group_id
    __args__['vpcId'] = vpc_id
    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke_output('databricks:index/getAwsCrossAccountPolicy:getAwsCrossAccountPolicy', __args__, opts=opts, typ=GetAwsCrossAccountPolicyResult)
    return __ret__.apply(lambda __response__: GetAwsCrossAccountPolicyResult(
        aws_account_id=pulumi.get(__response__, 'aws_account_id'),
        aws_partition=pulumi.get(__response__, 'aws_partition'),
        id=pulumi.get(__response__, 'id'),
        json=pulumi.get(__response__, 'json'),
        pass_roles=pulumi.get(__response__, 'pass_roles'),
        policy_type=pulumi.get(__response__, 'policy_type'),
        region=pulumi.get(__response__, 'region'),
        security_group_id=pulumi.get(__response__, 'security_group_id'),
        vpc_id=pulumi.get(__response__, 'vpc_id')))
