# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = [
    'DenyPolicyRuleArgs',
    'DenyPolicyRuleDenyRuleArgs',
    'DenyPolicyRuleDenyRuleDenialConditionArgs',
    'WorkforcePoolProviderOidcArgs',
    'WorkforcePoolProviderSamlArgs',
    'WorkloadIdentityPoolProviderAwsArgs',
    'WorkloadIdentityPoolProviderOidcArgs',
]

@pulumi.input_type
class DenyPolicyRuleArgs:
    def __init__(__self__, *,
                 deny_rule: Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']] = None,
                 description: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input['DenyPolicyRuleDenyRuleArgs'] deny_rule: A deny rule in an IAM deny policy.
               Structure is documented below.
        :param pulumi.Input[str] description: The description of the rule.
        """
        if deny_rule is not None:
            pulumi.set(__self__, "deny_rule", deny_rule)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter(name="denyRule")
    def deny_rule(self) -> Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']]:
        """
        A deny rule in an IAM deny policy.
        Structure is documented below.
        """
        return pulumi.get(self, "deny_rule")

    @deny_rule.setter
    def deny_rule(self, value: Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']]):
        pulumi.set(self, "deny_rule", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the rule.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)


@pulumi.input_type
class DenyPolicyRuleDenyRuleArgs:
    def __init__(__self__, *,
                 denial_condition: Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']] = None,
                 denied_permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 denied_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 exception_permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 exception_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs'] denial_condition: User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
               Structure is documented below.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] denied_permissions: The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
               where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] denied_principals: The identities that are prevented from using one or more permissions on Google Cloud resources.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] exception_permissions: Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
               If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
               The excluded permissions can be specified using the same syntax as deniedPermissions.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] exception_principals: The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
               For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
        """
        if denial_condition is not None:
            pulumi.set(__self__, "denial_condition", denial_condition)
        if denied_permissions is not None:
            pulumi.set(__self__, "denied_permissions", denied_permissions)
        if denied_principals is not None:
            pulumi.set(__self__, "denied_principals", denied_principals)
        if exception_permissions is not None:
            pulumi.set(__self__, "exception_permissions", exception_permissions)
        if exception_principals is not None:
            pulumi.set(__self__, "exception_principals", exception_principals)

    @property
    @pulumi.getter(name="denialCondition")
    def denial_condition(self) -> Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']]:
        """
        User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
        Structure is documented below.
        """
        return pulumi.get(self, "denial_condition")

    @denial_condition.setter
    def denial_condition(self, value: Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']]):
        pulumi.set(self, "denial_condition", value)

    @property
    @pulumi.getter(name="deniedPermissions")
    def denied_permissions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
        where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
        """
        return pulumi.get(self, "denied_permissions")

    @denied_permissions.setter
    def denied_permissions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "denied_permissions", value)

    @property
    @pulumi.getter(name="deniedPrincipals")
    def denied_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The identities that are prevented from using one or more permissions on Google Cloud resources.
        """
        return pulumi.get(self, "denied_principals")

    @denied_principals.setter
    def denied_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "denied_principals", value)

    @property
    @pulumi.getter(name="exceptionPermissions")
    def exception_permissions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
        If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
        The excluded permissions can be specified using the same syntax as deniedPermissions.
        """
        return pulumi.get(self, "exception_permissions")

    @exception_permissions.setter
    def exception_permissions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "exception_permissions", value)

    @property
    @pulumi.getter(name="exceptionPrincipals")
    def exception_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
        For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
        """
        return pulumi.get(self, "exception_principals")

    @exception_principals.setter
    def exception_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "exception_principals", value)


@pulumi.input_type
class DenyPolicyRuleDenyRuleDenialConditionArgs:
    def __init__(__self__, *,
                 expression: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 location: Optional[pulumi.Input[str]] = None,
                 title: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] expression: Textual representation of an expression in Common Expression Language syntax.
        :param pulumi.Input[str] description: Description of the expression. This is a longer text which describes the expression,
               e.g. when hovered over it in a UI.
        :param pulumi.Input[str] location: String indicating the location of the expression for error reporting,
               e.g. a file name and a position in the file.
        :param pulumi.Input[str] title: Title for the expression, i.e. a short string describing its purpose.
               This can be used e.g. in UIs which allow to enter the expression.
        """
        pulumi.set(__self__, "expression", expression)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if location is not None:
            pulumi.set(__self__, "location", location)
        if title is not None:
            pulumi.set(__self__, "title", title)

    @property
    @pulumi.getter
    def expression(self) -> pulumi.Input[str]:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @expression.setter
    def expression(self, value: pulumi.Input[str]):
        pulumi.set(self, "expression", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        Description of the expression. This is a longer text which describes the expression,
        e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def location(self) -> Optional[pulumi.Input[str]]:
        """
        String indicating the location of the expression for error reporting,
        e.g. a file name and a position in the file.
        """
        return pulumi.get(self, "location")

    @location.setter
    def location(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "location", value)

    @property
    @pulumi.getter
    def title(self) -> Optional[pulumi.Input[str]]:
        """
        Title for the expression, i.e. a short string describing its purpose.
        This can be used e.g. in UIs which allow to enter the expression.
        """
        return pulumi.get(self, "title")

    @title.setter
    def title(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "title", value)


@pulumi.input_type
class WorkforcePoolProviderOidcArgs:
    def __init__(__self__, *,
                 client_id: pulumi.Input[str],
                 issuer_uri: pulumi.Input[str]):
        """
        :param pulumi.Input[str] client_id: The client ID. Must match the audience claim of the JWT issued by the identity provider.
        :param pulumi.Input[str] issuer_uri: The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
        """
        pulumi.set(__self__, "client_id", client_id)
        pulumi.set(__self__, "issuer_uri", issuer_uri)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Input[str]:
        """
        The client ID. Must match the audience claim of the JWT issued by the identity provider.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="issuerUri")
    def issuer_uri(self) -> pulumi.Input[str]:
        """
        The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
        """
        return pulumi.get(self, "issuer_uri")

    @issuer_uri.setter
    def issuer_uri(self, value: pulumi.Input[str]):
        pulumi.set(self, "issuer_uri", value)


@pulumi.input_type
class WorkforcePoolProviderSamlArgs:
    def __init__(__self__, *,
                 idp_metadata_xml: pulumi.Input[str]):
        """
        :param pulumi.Input[str] idp_metadata_xml: SAML Identity provider configuration metadata xml doc.
               The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
               The max size of the acceptable xml document will be bounded to 128k characters.
               The metadata xml document should satisfy the following constraints:
               1) Must contain an Identity Provider Entity ID.
               2) Must contain at least one non-expired signing key certificate.
               3) For each signing key:
               a) Valid from should be no more than 7 days from now.
               b) Valid to should be no more than 10 years in the future.
               4) Up to 3 IdP signing keys are allowed in the metadata xml.
               When updating the provider's metadata xml, at least one non-expired signing key
               must overlap with the existing metadata. This requirement is skipped if there are
               no non-expired signing keys present in the existing metadata.
        """
        pulumi.set(__self__, "idp_metadata_xml", idp_metadata_xml)

    @property
    @pulumi.getter(name="idpMetadataXml")
    def idp_metadata_xml(self) -> pulumi.Input[str]:
        """
        SAML Identity provider configuration metadata xml doc.
        The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
        The max size of the acceptable xml document will be bounded to 128k characters.
        The metadata xml document should satisfy the following constraints:
        1) Must contain an Identity Provider Entity ID.
        2) Must contain at least one non-expired signing key certificate.
        3) For each signing key:
        a) Valid from should be no more than 7 days from now.
        b) Valid to should be no more than 10 years in the future.
        4) Up to 3 IdP signing keys are allowed in the metadata xml.
        When updating the provider's metadata xml, at least one non-expired signing key
        must overlap with the existing metadata. This requirement is skipped if there are
        no non-expired signing keys present in the existing metadata.
        """
        return pulumi.get(self, "idp_metadata_xml")

    @idp_metadata_xml.setter
    def idp_metadata_xml(self, value: pulumi.Input[str]):
        pulumi.set(self, "idp_metadata_xml", value)


@pulumi.input_type
class WorkloadIdentityPoolProviderAwsArgs:
    def __init__(__self__, *,
                 account_id: pulumi.Input[str]):
        """
        :param pulumi.Input[str] account_id: The AWS account ID.
        """
        pulumi.set(__self__, "account_id", account_id)

    @property
    @pulumi.getter(name="accountId")
    def account_id(self) -> pulumi.Input[str]:
        """
        The AWS account ID.
        """
        return pulumi.get(self, "account_id")

    @account_id.setter
    def account_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "account_id", value)


@pulumi.input_type
class WorkloadIdentityPoolProviderOidcArgs:
    def __init__(__self__, *,
                 issuer_uri: pulumi.Input[str],
                 allowed_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] issuer_uri: The OIDC issuer URL.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_audiences: Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
               requests are rejected if the token audience does not match one of the configured
               values. Each audience may be at most 256 characters. A maximum of 10 audiences may
               be configured.
               If this list is empty, the OIDC token audience must be equal to the full canonical
               resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
               For example:
               ```python
               import pulumi
               ```
        """
        pulumi.set(__self__, "issuer_uri", issuer_uri)
        if allowed_audiences is not None:
            pulumi.set(__self__, "allowed_audiences", allowed_audiences)

    @property
    @pulumi.getter(name="issuerUri")
    def issuer_uri(self) -> pulumi.Input[str]:
        """
        The OIDC issuer URL.
        """
        return pulumi.get(self, "issuer_uri")

    @issuer_uri.setter
    def issuer_uri(self, value: pulumi.Input[str]):
        pulumi.set(self, "issuer_uri", value)

    @property
    @pulumi.getter(name="allowedAudiences")
    def allowed_audiences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
        requests are rejected if the token audience does not match one of the configured
        values. Each audience may be at most 256 characters. A maximum of 10 audiences may
        be configured.
        If this list is empty, the OIDC token audience must be equal to the full canonical
        resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
        For example:
        ```python
        import pulumi
        ```
        """
        return pulumi.get(self, "allowed_audiences")

    @allowed_audiences.setter
    def allowed_audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "allowed_audiences", value)


