# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities
from . import outputs
from ._inputs import *

__all__ = ['OboTokenArgs', 'OboToken']

@pulumi.input_type
class OboTokenArgs:
    def __init__(__self__, *,
                 application_id: pulumi.Input[_builtins.str],
                 comment: Optional[pulumi.Input[_builtins.str]] = None,
                 lifetime_seconds: Optional[pulumi.Input[_builtins.int]] = None,
                 provider_config: Optional[pulumi.Input['OboTokenProviderConfigArgs']] = None):
        """
        The set of arguments for constructing a OboToken resource.
        :param pulumi.Input[_builtins.str] application_id: Application ID of ServicePrincipal to create a PAT token for.
        :param pulumi.Input[_builtins.str] comment: Comment that describes the purpose of the token.
        :param pulumi.Input[_builtins.int] lifetime_seconds: The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        :param pulumi.Input['OboTokenProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        """
        pulumi.set(__self__, "application_id", application_id)
        if comment is not None:
            pulumi.set(__self__, "comment", comment)
        if lifetime_seconds is not None:
            pulumi.set(__self__, "lifetime_seconds", lifetime_seconds)
        if provider_config is not None:
            pulumi.set(__self__, "provider_config", provider_config)

    @_builtins.property
    @pulumi.getter(name="applicationId")
    def application_id(self) -> pulumi.Input[_builtins.str]:
        """
        Application ID of ServicePrincipal to create a PAT token for.
        """
        return pulumi.get(self, "application_id")

    @application_id.setter
    def application_id(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "application_id", value)

    @_builtins.property
    @pulumi.getter
    def comment(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Comment that describes the purpose of the token.
        """
        return pulumi.get(self, "comment")

    @comment.setter
    def comment(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "comment", value)

    @_builtins.property
    @pulumi.getter(name="lifetimeSeconds")
    def lifetime_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        """
        return pulumi.get(self, "lifetime_seconds")

    @lifetime_seconds.setter
    def lifetime_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "lifetime_seconds", value)

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> Optional[pulumi.Input['OboTokenProviderConfigArgs']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @provider_config.setter
    def provider_config(self, value: Optional[pulumi.Input['OboTokenProviderConfigArgs']]):
        pulumi.set(self, "provider_config", value)


@pulumi.input_type
class _OboTokenState:
    def __init__(__self__, *,
                 application_id: Optional[pulumi.Input[_builtins.str]] = None,
                 comment: Optional[pulumi.Input[_builtins.str]] = None,
                 lifetime_seconds: Optional[pulumi.Input[_builtins.int]] = None,
                 provider_config: Optional[pulumi.Input['OboTokenProviderConfigArgs']] = None,
                 token_value: Optional[pulumi.Input[_builtins.str]] = None):
        """
        Input properties used for looking up and filtering OboToken resources.
        :param pulumi.Input[_builtins.str] application_id: Application ID of ServicePrincipal to create a PAT token for.
        :param pulumi.Input[_builtins.str] comment: Comment that describes the purpose of the token.
        :param pulumi.Input[_builtins.int] lifetime_seconds: The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        :param pulumi.Input['OboTokenProviderConfigArgs'] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.str] token_value: **Sensitive** value of the newly-created token.
        """
        if application_id is not None:
            pulumi.set(__self__, "application_id", application_id)
        if comment is not None:
            pulumi.set(__self__, "comment", comment)
        if lifetime_seconds is not None:
            pulumi.set(__self__, "lifetime_seconds", lifetime_seconds)
        if provider_config is not None:
            pulumi.set(__self__, "provider_config", provider_config)
        if token_value is not None:
            pulumi.set(__self__, "token_value", token_value)

    @_builtins.property
    @pulumi.getter(name="applicationId")
    def application_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Application ID of ServicePrincipal to create a PAT token for.
        """
        return pulumi.get(self, "application_id")

    @application_id.setter
    def application_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "application_id", value)

    @_builtins.property
    @pulumi.getter
    def comment(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Comment that describes the purpose of the token.
        """
        return pulumi.get(self, "comment")

    @comment.setter
    def comment(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "comment", value)

    @_builtins.property
    @pulumi.getter(name="lifetimeSeconds")
    def lifetime_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        """
        return pulumi.get(self, "lifetime_seconds")

    @lifetime_seconds.setter
    def lifetime_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "lifetime_seconds", value)

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> Optional[pulumi.Input['OboTokenProviderConfigArgs']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @provider_config.setter
    def provider_config(self, value: Optional[pulumi.Input['OboTokenProviderConfigArgs']]):
        pulumi.set(self, "provider_config", value)

    @_builtins.property
    @pulumi.getter(name="tokenValue")
    def token_value(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        **Sensitive** value of the newly-created token.
        """
        return pulumi.get(self, "token_value")

    @token_value.setter
    def token_value(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "token_value", value)


@pulumi.type_token("databricks:index/oboToken:OboToken")
class OboToken(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 application_id: Optional[pulumi.Input[_builtins.str]] = None,
                 comment: Optional[pulumi.Input[_builtins.str]] = None,
                 lifetime_seconds: Optional[pulumi.Input[_builtins.int]] = None,
                 provider_config: Optional[pulumi.Input[Union['OboTokenProviderConfigArgs', 'OboTokenProviderConfigArgsDict']]] = None,
                 __props__=None):
        """
        This resource creates [On-Behalf-Of tokens](https://docs.databricks.com/administration-guide/users-groups/service-principals.html#manage-personal-access-tokens-for-a-service-principal) for a ServicePrincipal in Databricks workspaces on AWS and GCP.  In general it's best to use OAuth authentication using client ID and secret, and use this resource mostly for integrations that doesn't support OAuth.

        > This resource can only be used with a workspace-level provider!

        > To create On-Behalf-Of token for Azure Service Principal, configure Pulumi provider to use Azure service principal's client ID and secret, and use `Token` resource to create a personal access token.

        ## Example Usage

        Creating a token for a narrowly-scoped service principal, that would be the only one (besides admins) allowed to use PAT token in this given workspace, keeping your automated deployment highly secure.

        > A given declaration of `databricks_permissions.token_usage` would OVERWRITE permissions to use PAT tokens from any existing groups with token usage permissions such as the `users` group. To avoid this, be sure to include any desired groups in additional `access_control` blocks in the Pulumi configuration file.

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.ServicePrincipal("this", display_name="Automation-only SP")
        token_usage = databricks.Permissions("token_usage",
            authorization="tokens",
            access_controls=[{
                "service_principal_name": this.application_id,
                "permission_level": "CAN_USE",
            }])
        this_obo_token = databricks.OboToken("this",
            application_id=this.application_id,
            comment=this.display_name.apply(lambda display_name: f"PAT on behalf of {display_name}"),
            lifetime_seconds=3600,
            opts = pulumi.ResourceOptions(depends_on=[token_usage]))
        pulumi.export("obo", this_obo_token.token_value)
        ```

        Creating a token for a service principal with admin privileges

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.ServicePrincipal("this", display_name="Pulumi")
        admins = databricks.get_group(display_name="admins")
        this_group_member = databricks.GroupMember("this",
            group_id=admins.id,
            member_id=this.id)
        this_obo_token = databricks.OboToken("this",
            application_id=this.application_id,
            comment=this.display_name.apply(lambda display_name: f"PAT on behalf of {display_name}"),
            lifetime_seconds=3600,
            opts = pulumi.ResourceOptions(depends_on=[this_group_member]))
        ```

        ## Related Resources

        The following resources are often used in the same context:

        * End to end workspace management guide.
        * Group data to retrieve information about Group members, entitlements and instance profiles.
        * GroupMember to attach users and groups as group members.
        * Permissions to manage [access control](https://docs.databricks.com/security/access-control/index.html) in Databricks workspace.
        * ServicePrincipal to manage [Service Principals](https://docs.databricks.com/administration-guide/users-groups/service-principals.html) that could be added to Group within workspace.
        * Grants to manage data access in Unity Catalog.

        ## Import

        !> Importing this resource is not currently supported.

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] application_id: Application ID of ServicePrincipal to create a PAT token for.
        :param pulumi.Input[_builtins.str] comment: Comment that describes the purpose of the token.
        :param pulumi.Input[_builtins.int] lifetime_seconds: The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        :param pulumi.Input[Union['OboTokenProviderConfigArgs', 'OboTokenProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: OboTokenArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        This resource creates [On-Behalf-Of tokens](https://docs.databricks.com/administration-guide/users-groups/service-principals.html#manage-personal-access-tokens-for-a-service-principal) for a ServicePrincipal in Databricks workspaces on AWS and GCP.  In general it's best to use OAuth authentication using client ID and secret, and use this resource mostly for integrations that doesn't support OAuth.

        > This resource can only be used with a workspace-level provider!

        > To create On-Behalf-Of token for Azure Service Principal, configure Pulumi provider to use Azure service principal's client ID and secret, and use `Token` resource to create a personal access token.

        ## Example Usage

        Creating a token for a narrowly-scoped service principal, that would be the only one (besides admins) allowed to use PAT token in this given workspace, keeping your automated deployment highly secure.

        > A given declaration of `databricks_permissions.token_usage` would OVERWRITE permissions to use PAT tokens from any existing groups with token usage permissions such as the `users` group. To avoid this, be sure to include any desired groups in additional `access_control` blocks in the Pulumi configuration file.

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.ServicePrincipal("this", display_name="Automation-only SP")
        token_usage = databricks.Permissions("token_usage",
            authorization="tokens",
            access_controls=[{
                "service_principal_name": this.application_id,
                "permission_level": "CAN_USE",
            }])
        this_obo_token = databricks.OboToken("this",
            application_id=this.application_id,
            comment=this.display_name.apply(lambda display_name: f"PAT on behalf of {display_name}"),
            lifetime_seconds=3600,
            opts = pulumi.ResourceOptions(depends_on=[token_usage]))
        pulumi.export("obo", this_obo_token.token_value)
        ```

        Creating a token for a service principal with admin privileges

        ```python
        import pulumi
        import pulumi_databricks as databricks

        this = databricks.ServicePrincipal("this", display_name="Pulumi")
        admins = databricks.get_group(display_name="admins")
        this_group_member = databricks.GroupMember("this",
            group_id=admins.id,
            member_id=this.id)
        this_obo_token = databricks.OboToken("this",
            application_id=this.application_id,
            comment=this.display_name.apply(lambda display_name: f"PAT on behalf of {display_name}"),
            lifetime_seconds=3600,
            opts = pulumi.ResourceOptions(depends_on=[this_group_member]))
        ```

        ## Related Resources

        The following resources are often used in the same context:

        * End to end workspace management guide.
        * Group data to retrieve information about Group members, entitlements and instance profiles.
        * GroupMember to attach users and groups as group members.
        * Permissions to manage [access control](https://docs.databricks.com/security/access-control/index.html) in Databricks workspace.
        * ServicePrincipal to manage [Service Principals](https://docs.databricks.com/administration-guide/users-groups/service-principals.html) that could be added to Group within workspace.
        * Grants to manage data access in Unity Catalog.

        ## Import

        !> Importing this resource is not currently supported.

        :param str resource_name: The name of the resource.
        :param OboTokenArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(OboTokenArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 application_id: Optional[pulumi.Input[_builtins.str]] = None,
                 comment: Optional[pulumi.Input[_builtins.str]] = None,
                 lifetime_seconds: Optional[pulumi.Input[_builtins.int]] = None,
                 provider_config: Optional[pulumi.Input[Union['OboTokenProviderConfigArgs', 'OboTokenProviderConfigArgsDict']]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = OboTokenArgs.__new__(OboTokenArgs)

            if application_id is None and not opts.urn:
                raise TypeError("Missing required property 'application_id'")
            __props__.__dict__["application_id"] = application_id
            __props__.__dict__["comment"] = comment
            __props__.__dict__["lifetime_seconds"] = lifetime_seconds
            __props__.__dict__["provider_config"] = provider_config
            __props__.__dict__["token_value"] = None
        secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["tokenValue"])
        opts = pulumi.ResourceOptions.merge(opts, secret_opts)
        super(OboToken, __self__).__init__(
            'databricks:index/oboToken:OboToken',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            application_id: Optional[pulumi.Input[_builtins.str]] = None,
            comment: Optional[pulumi.Input[_builtins.str]] = None,
            lifetime_seconds: Optional[pulumi.Input[_builtins.int]] = None,
            provider_config: Optional[pulumi.Input[Union['OboTokenProviderConfigArgs', 'OboTokenProviderConfigArgsDict']]] = None,
            token_value: Optional[pulumi.Input[_builtins.str]] = None) -> 'OboToken':
        """
        Get an existing OboToken resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] application_id: Application ID of ServicePrincipal to create a PAT token for.
        :param pulumi.Input[_builtins.str] comment: Comment that describes the purpose of the token.
        :param pulumi.Input[_builtins.int] lifetime_seconds: The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        :param pulumi.Input[Union['OboTokenProviderConfigArgs', 'OboTokenProviderConfigArgsDict']] provider_config: Configure the provider for management through account provider. This block consists of the following fields:
        :param pulumi.Input[_builtins.str] token_value: **Sensitive** value of the newly-created token.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _OboTokenState.__new__(_OboTokenState)

        __props__.__dict__["application_id"] = application_id
        __props__.__dict__["comment"] = comment
        __props__.__dict__["lifetime_seconds"] = lifetime_seconds
        __props__.__dict__["provider_config"] = provider_config
        __props__.__dict__["token_value"] = token_value
        return OboToken(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="applicationId")
    def application_id(self) -> pulumi.Output[_builtins.str]:
        """
        Application ID of ServicePrincipal to create a PAT token for.
        """
        return pulumi.get(self, "application_id")

    @_builtins.property
    @pulumi.getter
    def comment(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Comment that describes the purpose of the token.
        """
        return pulumi.get(self, "comment")

    @_builtins.property
    @pulumi.getter(name="lifetimeSeconds")
    def lifetime_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        The number of seconds before the token expires. Token resource is re-created when it expires. If no lifetime is specified, the token remains valid indefinitely.
        """
        return pulumi.get(self, "lifetime_seconds")

    @_builtins.property
    @pulumi.getter(name="providerConfig")
    def provider_config(self) -> pulumi.Output[Optional['outputs.OboTokenProviderConfig']]:
        """
        Configure the provider for management through account provider. This block consists of the following fields:
        """
        return pulumi.get(self, "provider_config")

    @_builtins.property
    @pulumi.getter(name="tokenValue")
    def token_value(self) -> pulumi.Output[_builtins.str]:
        """
        **Sensitive** value of the newly-created token.
        """
        return pulumi.get(self, "token_value")

