# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities
from . import outputs

__all__ = [
    'AuthorizationPolicyRule',
    'AuthorizationPolicyRuleDestination',
    'AuthorizationPolicyRuleDestinationHttpHeaderMatch',
    'AuthorizationPolicyRuleSource',
    'ClientTlsPolicyClientCertificate',
    'ClientTlsPolicyClientCertificateCertificateProviderInstance',
    'ClientTlsPolicyClientCertificateGrpcEndpoint',
    'ClientTlsPolicyServerValidationCa',
    'ClientTlsPolicyServerValidationCaCertificateProviderInstance',
    'ClientTlsPolicyServerValidationCaGrpcEndpoint',
]

@pulumi.output_type
class AuthorizationPolicyRule(dict):
    def __init__(__self__, *,
                 destinations: Optional[Sequence['outputs.AuthorizationPolicyRuleDestination']] = None,
                 sources: Optional[Sequence['outputs.AuthorizationPolicyRuleSource']] = None):
        """
        :param Sequence['AuthorizationPolicyRuleDestinationArgs'] destinations: List of attributes for the traffic destination. All of the destinations must match. A destination is a match if a request matches all the specified hosts, ports, methods and headers.
               If not set, the action specified in the 'action' field will be applied without any rule checks for the destination.
               Structure is documented below.
        :param Sequence['AuthorizationPolicyRuleSourceArgs'] sources: List of attributes for the traffic source. All of the sources must match. A source is a match if both principals and ipBlocks match.
               If not set, the action specified in the 'action' field will be applied without any rule checks for the source.
               Structure is documented below.
        """
        if destinations is not None:
            pulumi.set(__self__, "destinations", destinations)
        if sources is not None:
            pulumi.set(__self__, "sources", sources)

    @property
    @pulumi.getter
    def destinations(self) -> Optional[Sequence['outputs.AuthorizationPolicyRuleDestination']]:
        """
        List of attributes for the traffic destination. All of the destinations must match. A destination is a match if a request matches all the specified hosts, ports, methods and headers.
        If not set, the action specified in the 'action' field will be applied without any rule checks for the destination.
        Structure is documented below.
        """
        return pulumi.get(self, "destinations")

    @property
    @pulumi.getter
    def sources(self) -> Optional[Sequence['outputs.AuthorizationPolicyRuleSource']]:
        """
        List of attributes for the traffic source. All of the sources must match. A source is a match if both principals and ipBlocks match.
        If not set, the action specified in the 'action' field will be applied without any rule checks for the source.
        Structure is documented below.
        """
        return pulumi.get(self, "sources")


@pulumi.output_type
class AuthorizationPolicyRuleDestination(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "httpHeaderMatch":
            suggest = "http_header_match"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorizationPolicyRuleDestination. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorizationPolicyRuleDestination.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorizationPolicyRuleDestination.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 hosts: Sequence[str],
                 methods: Sequence[str],
                 ports: Sequence[int],
                 http_header_match: Optional['outputs.AuthorizationPolicyRuleDestinationHttpHeaderMatch'] = None):
        """
        :param Sequence[str] hosts: List of host names to match. Matched against the ":authority" header in http requests. At least one host should match. Each host can be an exact match, or a prefix match (example "mydomain.*") or a suffix match (example "*.myorg.com") or a presence (any) match "*".
        :param Sequence[str] methods: A list of HTTP methods to match. At least one method should match. Should not be set for gRPC services.
        :param Sequence[int] ports: List of destination ports to match. At least one port should match.
        :param 'AuthorizationPolicyRuleDestinationHttpHeaderMatchArgs' http_header_match: Match against key:value pair in http header. Provides a flexible match based on HTTP headers, for potentially advanced use cases. At least one header should match.
               Avoid using header matches to make authorization decisions unless there is a strong guarantee that requests arrive through a trusted client or proxy.
               Structure is documented below.
        """
        pulumi.set(__self__, "hosts", hosts)
        pulumi.set(__self__, "methods", methods)
        pulumi.set(__self__, "ports", ports)
        if http_header_match is not None:
            pulumi.set(__self__, "http_header_match", http_header_match)

    @property
    @pulumi.getter
    def hosts(self) -> Sequence[str]:
        """
        List of host names to match. Matched against the ":authority" header in http requests. At least one host should match. Each host can be an exact match, or a prefix match (example "mydomain.*") or a suffix match (example "*.myorg.com") or a presence (any) match "*".
        """
        return pulumi.get(self, "hosts")

    @property
    @pulumi.getter
    def methods(self) -> Sequence[str]:
        """
        A list of HTTP methods to match. At least one method should match. Should not be set for gRPC services.
        """
        return pulumi.get(self, "methods")

    @property
    @pulumi.getter
    def ports(self) -> Sequence[int]:
        """
        List of destination ports to match. At least one port should match.
        """
        return pulumi.get(self, "ports")

    @property
    @pulumi.getter(name="httpHeaderMatch")
    def http_header_match(self) -> Optional['outputs.AuthorizationPolicyRuleDestinationHttpHeaderMatch']:
        """
        Match against key:value pair in http header. Provides a flexible match based on HTTP headers, for potentially advanced use cases. At least one header should match.
        Avoid using header matches to make authorization decisions unless there is a strong guarantee that requests arrive through a trusted client or proxy.
        Structure is documented below.
        """
        return pulumi.get(self, "http_header_match")


@pulumi.output_type
class AuthorizationPolicyRuleDestinationHttpHeaderMatch(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "headerName":
            suggest = "header_name"
        elif key == "regexMatch":
            suggest = "regex_match"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorizationPolicyRuleDestinationHttpHeaderMatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorizationPolicyRuleDestinationHttpHeaderMatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorizationPolicyRuleDestinationHttpHeaderMatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 header_name: str,
                 regex_match: str):
        """
        :param str header_name: The name of the HTTP header to match. For matching against the HTTP request's authority, use a headerMatch with the header name ":authority". For matching a request's method, use the headerName ":method".
        :param str regex_match: The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see: en.cppreference.com/w/cpp/regex/ecmascript For matching against a port specified in the HTTP request, use a headerMatch with headerName set to Host and a regular expression that satisfies the RFC2616 Host header's port specifier.
        """
        pulumi.set(__self__, "header_name", header_name)
        pulumi.set(__self__, "regex_match", regex_match)

    @property
    @pulumi.getter(name="headerName")
    def header_name(self) -> str:
        """
        The name of the HTTP header to match. For matching against the HTTP request's authority, use a headerMatch with the header name ":authority". For matching a request's method, use the headerName ":method".
        """
        return pulumi.get(self, "header_name")

    @property
    @pulumi.getter(name="regexMatch")
    def regex_match(self) -> str:
        """
        The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see: en.cppreference.com/w/cpp/regex/ecmascript For matching against a port specified in the HTTP request, use a headerMatch with headerName set to Host and a regular expression that satisfies the RFC2616 Host header's port specifier.
        """
        return pulumi.get(self, "regex_match")


@pulumi.output_type
class AuthorizationPolicyRuleSource(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "ipBlocks":
            suggest = "ip_blocks"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorizationPolicyRuleSource. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorizationPolicyRuleSource.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorizationPolicyRuleSource.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 ip_blocks: Optional[Sequence[str]] = None,
                 principals: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] ip_blocks: List of CIDR ranges to match based on source IP address. At least one IP block should match. Single IP (e.g., "1.2.3.4") and CIDR (e.g., "1.2.3.0/24") are supported. Authorization based on source IP alone should be avoided.
               The IP addresses of any load balancers or proxies should be considered untrusted.
        :param Sequence[str] principals: List of peer identities to match for authorization. At least one principal should match. Each peer can be an exact match, or a prefix match (example, "namespace/*") or a suffix match (example, "*/service-account") or a presence match "*".
               Authorization based on the principal name without certificate validation (configured by ServerTlsPolicy resource) is considered insecure.
        """
        if ip_blocks is not None:
            pulumi.set(__self__, "ip_blocks", ip_blocks)
        if principals is not None:
            pulumi.set(__self__, "principals", principals)

    @property
    @pulumi.getter(name="ipBlocks")
    def ip_blocks(self) -> Optional[Sequence[str]]:
        """
        List of CIDR ranges to match based on source IP address. At least one IP block should match. Single IP (e.g., "1.2.3.4") and CIDR (e.g., "1.2.3.0/24") are supported. Authorization based on source IP alone should be avoided.
        The IP addresses of any load balancers or proxies should be considered untrusted.
        """
        return pulumi.get(self, "ip_blocks")

    @property
    @pulumi.getter
    def principals(self) -> Optional[Sequence[str]]:
        """
        List of peer identities to match for authorization. At least one principal should match. Each peer can be an exact match, or a prefix match (example, "namespace/*") or a suffix match (example, "*/service-account") or a presence match "*".
        Authorization based on the principal name without certificate validation (configured by ServerTlsPolicy resource) is considered insecure.
        """
        return pulumi.get(self, "principals")


@pulumi.output_type
class ClientTlsPolicyClientCertificate(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certificateProviderInstance":
            suggest = "certificate_provider_instance"
        elif key == "grpcEndpoint":
            suggest = "grpc_endpoint"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyClientCertificate. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyClientCertificate.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyClientCertificate.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 certificate_provider_instance: Optional['outputs.ClientTlsPolicyClientCertificateCertificateProviderInstance'] = None,
                 grpc_endpoint: Optional['outputs.ClientTlsPolicyClientCertificateGrpcEndpoint'] = None):
        """
        :param 'ClientTlsPolicyClientCertificateCertificateProviderInstanceArgs' certificate_provider_instance: The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information.
               Structure is documented below.
        :param 'ClientTlsPolicyClientCertificateGrpcEndpointArgs' grpc_endpoint: gRPC specific configuration to access the gRPC server to obtain the cert and private key.
               Structure is documented below.
        """
        if certificate_provider_instance is not None:
            pulumi.set(__self__, "certificate_provider_instance", certificate_provider_instance)
        if grpc_endpoint is not None:
            pulumi.set(__self__, "grpc_endpoint", grpc_endpoint)

    @property
    @pulumi.getter(name="certificateProviderInstance")
    def certificate_provider_instance(self) -> Optional['outputs.ClientTlsPolicyClientCertificateCertificateProviderInstance']:
        """
        The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information.
        Structure is documented below.
        """
        return pulumi.get(self, "certificate_provider_instance")

    @property
    @pulumi.getter(name="grpcEndpoint")
    def grpc_endpoint(self) -> Optional['outputs.ClientTlsPolicyClientCertificateGrpcEndpoint']:
        """
        gRPC specific configuration to access the gRPC server to obtain the cert and private key.
        Structure is documented below.
        """
        return pulumi.get(self, "grpc_endpoint")


@pulumi.output_type
class ClientTlsPolicyClientCertificateCertificateProviderInstance(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "pluginInstance":
            suggest = "plugin_instance"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyClientCertificateCertificateProviderInstance. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyClientCertificateCertificateProviderInstance.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyClientCertificateCertificateProviderInstance.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 plugin_instance: str):
        """
        :param str plugin_instance: Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
        """
        pulumi.set(__self__, "plugin_instance", plugin_instance)

    @property
    @pulumi.getter(name="pluginInstance")
    def plugin_instance(self) -> str:
        """
        Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
        """
        return pulumi.get(self, "plugin_instance")


@pulumi.output_type
class ClientTlsPolicyClientCertificateGrpcEndpoint(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "targetUri":
            suggest = "target_uri"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyClientCertificateGrpcEndpoint. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyClientCertificateGrpcEndpoint.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyClientCertificateGrpcEndpoint.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 target_uri: str):
        """
        :param str target_uri: The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
        """
        pulumi.set(__self__, "target_uri", target_uri)

    @property
    @pulumi.getter(name="targetUri")
    def target_uri(self) -> str:
        """
        The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
        """
        return pulumi.get(self, "target_uri")


@pulumi.output_type
class ClientTlsPolicyServerValidationCa(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certificateProviderInstance":
            suggest = "certificate_provider_instance"
        elif key == "grpcEndpoint":
            suggest = "grpc_endpoint"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyServerValidationCa. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyServerValidationCa.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyServerValidationCa.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 certificate_provider_instance: Optional['outputs.ClientTlsPolicyServerValidationCaCertificateProviderInstance'] = None,
                 grpc_endpoint: Optional['outputs.ClientTlsPolicyServerValidationCaGrpcEndpoint'] = None):
        """
        :param 'ClientTlsPolicyServerValidationCaCertificateProviderInstanceArgs' certificate_provider_instance: The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information.
               Structure is documented below.
        :param 'ClientTlsPolicyServerValidationCaGrpcEndpointArgs' grpc_endpoint: gRPC specific configuration to access the gRPC server to obtain the cert and private key.
               Structure is documented below.
        """
        if certificate_provider_instance is not None:
            pulumi.set(__self__, "certificate_provider_instance", certificate_provider_instance)
        if grpc_endpoint is not None:
            pulumi.set(__self__, "grpc_endpoint", grpc_endpoint)

    @property
    @pulumi.getter(name="certificateProviderInstance")
    def certificate_provider_instance(self) -> Optional['outputs.ClientTlsPolicyServerValidationCaCertificateProviderInstance']:
        """
        The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information.
        Structure is documented below.
        """
        return pulumi.get(self, "certificate_provider_instance")

    @property
    @pulumi.getter(name="grpcEndpoint")
    def grpc_endpoint(self) -> Optional['outputs.ClientTlsPolicyServerValidationCaGrpcEndpoint']:
        """
        gRPC specific configuration to access the gRPC server to obtain the cert and private key.
        Structure is documented below.
        """
        return pulumi.get(self, "grpc_endpoint")


@pulumi.output_type
class ClientTlsPolicyServerValidationCaCertificateProviderInstance(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "pluginInstance":
            suggest = "plugin_instance"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyServerValidationCaCertificateProviderInstance. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyServerValidationCaCertificateProviderInstance.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyServerValidationCaCertificateProviderInstance.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 plugin_instance: str):
        """
        :param str plugin_instance: Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
        """
        pulumi.set(__self__, "plugin_instance", plugin_instance)

    @property
    @pulumi.getter(name="pluginInstance")
    def plugin_instance(self) -> str:
        """
        Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
        """
        return pulumi.get(self, "plugin_instance")


@pulumi.output_type
class ClientTlsPolicyServerValidationCaGrpcEndpoint(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "targetUri":
            suggest = "target_uri"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ClientTlsPolicyServerValidationCaGrpcEndpoint. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ClientTlsPolicyServerValidationCaGrpcEndpoint.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ClientTlsPolicyServerValidationCaGrpcEndpoint.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 target_uri: str):
        """
        :param str target_uri: The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
        """
        pulumi.set(__self__, "target_uri", target_uri)

    @property
    @pulumi.getter(name="targetUri")
    def target_uri(self) -> str:
        """
        The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
        """
        return pulumi.get(self, "target_uri")


