# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Callable, Mapping, Optional, Sequence, Union, overload
from . import _utilities

__all__ = ['RoleArgs', 'Role']

@pulumi.input_type
class RoleArgs:
    def __init__(__self__, *,
                 assume_role: Optional[pulumi.Input[str]] = None,
                 bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
                 connection_limit: Optional[pulumi.Input[int]] = None,
                 create_database: Optional[pulumi.Input[bool]] = None,
                 create_role: Optional[pulumi.Input[bool]] = None,
                 encrypted: Optional[pulumi.Input[str]] = None,
                 encrypted_password: Optional[pulumi.Input[bool]] = None,
                 idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
                 inherit: Optional[pulumi.Input[bool]] = None,
                 login: Optional[pulumi.Input[bool]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 password: Optional[pulumi.Input[str]] = None,
                 replication: Optional[pulumi.Input[bool]] = None,
                 roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 skip_drop_role: Optional[pulumi.Input[bool]] = None,
                 skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
                 statement_timeout: Optional[pulumi.Input[int]] = None,
                 superuser: Optional[pulumi.Input[bool]] = None,
                 valid_until: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a Role resource.
        :param pulumi.Input[str] assume_role: Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        :param pulumi.Input[bool] bypass_row_level_security: Defines whether a role bypasses every
               row-level security (RLS) policy.  Default value is `false`.
        :param pulumi.Input[int] connection_limit: If this role can log in, this specifies how
               many concurrent connections the role can establish. `-1` (the default) means no
               limit.
        :param pulumi.Input[bool] create_database: Defines a role's ability to execute `CREATE
               DATABASE`.  Default value is `false`.
        :param pulumi.Input[bool] create_role: Defines a role's ability to execute `CREATE ROLE`.
               A role with this privilege can also alter and drop other roles.  Default value
               is `false`.
        :param pulumi.Input[bool] encrypted_password: Defines whether the password is stored
               encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
               is always set (to the conservative and safe value), but may interfere with the
               behavior of
               [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        :param pulumi.Input[int] idle_in_transaction_session_timeout: Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        :param pulumi.Input[bool] inherit: Defines whether a role "inherits" the privileges of
               roles it is a member of.  Default value is `true`.
        :param pulumi.Input[bool] login: Defines whether role is allowed to log in.  Roles without
               this attribute are useful for managing database privileges, but are not users
               in the usual sense of the word.  Default value is `false`.
        :param pulumi.Input[str] name: The name of the role. Must be unique on the PostgreSQL
               server instance where it is configured.
        :param pulumi.Input[str] password: Sets the role's password. A password is only of use
               for roles having the `login` attribute set to true.
        :param pulumi.Input[bool] replication: Defines whether a role is allowed to initiate
               streaming replication or put the system in and out of backup mode.  Default
               value is `false`
        :param pulumi.Input[Sequence[pulumi.Input[str]]] roles: Defines list of roles which will be granted to this new role.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] search_paths: Alters the search path of this new role. Note that
               due to limitations in the implementation, values cannot contain the substring
               `", "`.
        :param pulumi.Input[bool] skip_drop_role: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, the
               [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
               in each of the respective databases must occur before the ROLE can be dropped
               from the catalog.  Set this option to true when there are multiple databases
               in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
               This is the third and final step taken when removing a ROLE from a database.
        :param pulumi.Input[bool] skip_reassign_owned: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, a
               [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
               must be executed on each of the respective databases before the `DROP ROLE`
               can be executed to dropped the ROLE from the catalog.  This is the first and
               second steps taken when removing a ROLE from a database (the second step being
               an implicit
               [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        :param pulumi.Input[int] statement_timeout: Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        :param pulumi.Input[bool] superuser: Defines whether the role is a "superuser", and
               therefore can override all access restrictions within the database.  Default
               value is `false`.
        :param pulumi.Input[str] valid_until: Defines the date and time after which the role's
               password is no longer valid.  Established connections past this `valid_time`
               will have to be manually terminated.  This value corresponds to a PostgreSQL
               datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
               set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        RoleArgs._configure(
            lambda key, value: pulumi.set(__self__, key, value),
            assume_role=assume_role,
            bypass_row_level_security=bypass_row_level_security,
            connection_limit=connection_limit,
            create_database=create_database,
            create_role=create_role,
            encrypted=encrypted,
            encrypted_password=encrypted_password,
            idle_in_transaction_session_timeout=idle_in_transaction_session_timeout,
            inherit=inherit,
            login=login,
            name=name,
            password=password,
            replication=replication,
            roles=roles,
            search_paths=search_paths,
            skip_drop_role=skip_drop_role,
            skip_reassign_owned=skip_reassign_owned,
            statement_timeout=statement_timeout,
            superuser=superuser,
            valid_until=valid_until,
        )
    @staticmethod
    def _configure(
             _setter: Callable[[Any, Any], None],
             assume_role: Optional[pulumi.Input[str]] = None,
             bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
             connection_limit: Optional[pulumi.Input[int]] = None,
             create_database: Optional[pulumi.Input[bool]] = None,
             create_role: Optional[pulumi.Input[bool]] = None,
             encrypted: Optional[pulumi.Input[str]] = None,
             encrypted_password: Optional[pulumi.Input[bool]] = None,
             idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
             inherit: Optional[pulumi.Input[bool]] = None,
             login: Optional[pulumi.Input[bool]] = None,
             name: Optional[pulumi.Input[str]] = None,
             password: Optional[pulumi.Input[str]] = None,
             replication: Optional[pulumi.Input[bool]] = None,
             roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             skip_drop_role: Optional[pulumi.Input[bool]] = None,
             skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
             statement_timeout: Optional[pulumi.Input[int]] = None,
             superuser: Optional[pulumi.Input[bool]] = None,
             valid_until: Optional[pulumi.Input[str]] = None,
             opts: Optional[pulumi.ResourceOptions] = None,
             **kwargs):
        if assume_role is None and 'assumeRole' in kwargs:
            assume_role = kwargs['assumeRole']
        if bypass_row_level_security is None and 'bypassRowLevelSecurity' in kwargs:
            bypass_row_level_security = kwargs['bypassRowLevelSecurity']
        if connection_limit is None and 'connectionLimit' in kwargs:
            connection_limit = kwargs['connectionLimit']
        if create_database is None and 'createDatabase' in kwargs:
            create_database = kwargs['createDatabase']
        if create_role is None and 'createRole' in kwargs:
            create_role = kwargs['createRole']
        if encrypted_password is None and 'encryptedPassword' in kwargs:
            encrypted_password = kwargs['encryptedPassword']
        if idle_in_transaction_session_timeout is None and 'idleInTransactionSessionTimeout' in kwargs:
            idle_in_transaction_session_timeout = kwargs['idleInTransactionSessionTimeout']
        if search_paths is None and 'searchPaths' in kwargs:
            search_paths = kwargs['searchPaths']
        if skip_drop_role is None and 'skipDropRole' in kwargs:
            skip_drop_role = kwargs['skipDropRole']
        if skip_reassign_owned is None and 'skipReassignOwned' in kwargs:
            skip_reassign_owned = kwargs['skipReassignOwned']
        if statement_timeout is None and 'statementTimeout' in kwargs:
            statement_timeout = kwargs['statementTimeout']
        if valid_until is None and 'validUntil' in kwargs:
            valid_until = kwargs['validUntil']

        if assume_role is not None:
            _setter("assume_role", assume_role)
        if bypass_row_level_security is not None:
            _setter("bypass_row_level_security", bypass_row_level_security)
        if connection_limit is not None:
            _setter("connection_limit", connection_limit)
        if create_database is not None:
            _setter("create_database", create_database)
        if create_role is not None:
            _setter("create_role", create_role)
        if encrypted is not None:
            warnings.warn("""Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""", DeprecationWarning)
            pulumi.log.warn("""encrypted is deprecated: Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""")
        if encrypted is not None:
            _setter("encrypted", encrypted)
        if encrypted_password is not None:
            _setter("encrypted_password", encrypted_password)
        if idle_in_transaction_session_timeout is not None:
            _setter("idle_in_transaction_session_timeout", idle_in_transaction_session_timeout)
        if inherit is not None:
            _setter("inherit", inherit)
        if login is not None:
            _setter("login", login)
        if name is not None:
            _setter("name", name)
        if password is not None:
            _setter("password", password)
        if replication is not None:
            _setter("replication", replication)
        if roles is not None:
            _setter("roles", roles)
        if search_paths is not None:
            _setter("search_paths", search_paths)
        if skip_drop_role is not None:
            _setter("skip_drop_role", skip_drop_role)
        if skip_reassign_owned is not None:
            _setter("skip_reassign_owned", skip_reassign_owned)
        if statement_timeout is not None:
            _setter("statement_timeout", statement_timeout)
        if superuser is not None:
            _setter("superuser", superuser)
        if valid_until is not None:
            _setter("valid_until", valid_until)

    @property
    @pulumi.getter(name="assumeRole")
    def assume_role(self) -> Optional[pulumi.Input[str]]:
        """
        Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        """
        return pulumi.get(self, "assume_role")

    @assume_role.setter
    def assume_role(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "assume_role", value)

    @property
    @pulumi.getter(name="bypassRowLevelSecurity")
    def bypass_row_level_security(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role bypasses every
        row-level security (RLS) policy.  Default value is `false`.
        """
        return pulumi.get(self, "bypass_row_level_security")

    @bypass_row_level_security.setter
    def bypass_row_level_security(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "bypass_row_level_security", value)

    @property
    @pulumi.getter(name="connectionLimit")
    def connection_limit(self) -> Optional[pulumi.Input[int]]:
        """
        If this role can log in, this specifies how
        many concurrent connections the role can establish. `-1` (the default) means no
        limit.
        """
        return pulumi.get(self, "connection_limit")

    @connection_limit.setter
    def connection_limit(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "connection_limit", value)

    @property
    @pulumi.getter(name="createDatabase")
    def create_database(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines a role's ability to execute `CREATE
        DATABASE`.  Default value is `false`.
        """
        return pulumi.get(self, "create_database")

    @create_database.setter
    def create_database(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "create_database", value)

    @property
    @pulumi.getter(name="createRole")
    def create_role(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines a role's ability to execute `CREATE ROLE`.
        A role with this privilege can also alter and drop other roles.  Default value
        is `false`.
        """
        return pulumi.get(self, "create_role")

    @create_role.setter
    def create_role(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "create_role", value)

    @property
    @pulumi.getter
    def encrypted(self) -> Optional[pulumi.Input[str]]:
        warnings.warn("""Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""", DeprecationWarning)
        pulumi.log.warn("""encrypted is deprecated: Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""")

        return pulumi.get(self, "encrypted")

    @encrypted.setter
    def encrypted(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "encrypted", value)

    @property
    @pulumi.getter(name="encryptedPassword")
    def encrypted_password(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether the password is stored
        encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
        is always set (to the conservative and safe value), but may interfere with the
        behavior of
        [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        """
        return pulumi.get(self, "encrypted_password")

    @encrypted_password.setter
    def encrypted_password(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "encrypted_password", value)

    @property
    @pulumi.getter(name="idleInTransactionSessionTimeout")
    def idle_in_transaction_session_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        """
        return pulumi.get(self, "idle_in_transaction_session_timeout")

    @idle_in_transaction_session_timeout.setter
    def idle_in_transaction_session_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "idle_in_transaction_session_timeout", value)

    @property
    @pulumi.getter
    def inherit(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role "inherits" the privileges of
        roles it is a member of.  Default value is `true`.
        """
        return pulumi.get(self, "inherit")

    @inherit.setter
    def inherit(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "inherit", value)

    @property
    @pulumi.getter
    def login(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether role is allowed to log in.  Roles without
        this attribute are useful for managing database privileges, but are not users
        in the usual sense of the word.  Default value is `false`.
        """
        return pulumi.get(self, "login")

    @login.setter
    def login(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "login", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the role. Must be unique on the PostgreSQL
        server instance where it is configured.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def password(self) -> Optional[pulumi.Input[str]]:
        """
        Sets the role's password. A password is only of use
        for roles having the `login` attribute set to true.
        """
        return pulumi.get(self, "password")

    @password.setter
    def password(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "password", value)

    @property
    @pulumi.getter
    def replication(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role is allowed to initiate
        streaming replication or put the system in and out of backup mode.  Default
        value is `false`
        """
        return pulumi.get(self, "replication")

    @replication.setter
    def replication(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "replication", value)

    @property
    @pulumi.getter
    def roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Defines list of roles which will be granted to this new role.
        """
        return pulumi.get(self, "roles")

    @roles.setter
    def roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "roles", value)

    @property
    @pulumi.getter(name="searchPaths")
    def search_paths(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Alters the search path of this new role. Note that
        due to limitations in the implementation, values cannot contain the substring
        `", "`.
        """
        return pulumi.get(self, "search_paths")

    @search_paths.setter
    def search_paths(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "search_paths", value)

    @property
    @pulumi.getter(name="skipDropRole")
    def skip_drop_role(self) -> Optional[pulumi.Input[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, the
        [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
        in each of the respective databases must occur before the ROLE can be dropped
        from the catalog.  Set this option to true when there are multiple databases
        in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
        This is the third and final step taken when removing a ROLE from a database.
        """
        return pulumi.get(self, "skip_drop_role")

    @skip_drop_role.setter
    def skip_drop_role(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "skip_drop_role", value)

    @property
    @pulumi.getter(name="skipReassignOwned")
    def skip_reassign_owned(self) -> Optional[pulumi.Input[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, a
        [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
        must be executed on each of the respective databases before the `DROP ROLE`
        can be executed to dropped the ROLE from the catalog.  This is the first and
        second steps taken when removing a ROLE from a database (the second step being
        an implicit
        [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        """
        return pulumi.get(self, "skip_reassign_owned")

    @skip_reassign_owned.setter
    def skip_reassign_owned(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "skip_reassign_owned", value)

    @property
    @pulumi.getter(name="statementTimeout")
    def statement_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        """
        return pulumi.get(self, "statement_timeout")

    @statement_timeout.setter
    def statement_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "statement_timeout", value)

    @property
    @pulumi.getter
    def superuser(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether the role is a "superuser", and
        therefore can override all access restrictions within the database.  Default
        value is `false`.
        """
        return pulumi.get(self, "superuser")

    @superuser.setter
    def superuser(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "superuser", value)

    @property
    @pulumi.getter(name="validUntil")
    def valid_until(self) -> Optional[pulumi.Input[str]]:
        """
        Defines the date and time after which the role's
        password is no longer valid.  Established connections past this `valid_time`
        will have to be manually terminated.  This value corresponds to a PostgreSQL
        datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
        set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        return pulumi.get(self, "valid_until")

    @valid_until.setter
    def valid_until(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "valid_until", value)


@pulumi.input_type
class _RoleState:
    def __init__(__self__, *,
                 assume_role: Optional[pulumi.Input[str]] = None,
                 bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
                 connection_limit: Optional[pulumi.Input[int]] = None,
                 create_database: Optional[pulumi.Input[bool]] = None,
                 create_role: Optional[pulumi.Input[bool]] = None,
                 encrypted: Optional[pulumi.Input[str]] = None,
                 encrypted_password: Optional[pulumi.Input[bool]] = None,
                 idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
                 inherit: Optional[pulumi.Input[bool]] = None,
                 login: Optional[pulumi.Input[bool]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 password: Optional[pulumi.Input[str]] = None,
                 replication: Optional[pulumi.Input[bool]] = None,
                 roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 skip_drop_role: Optional[pulumi.Input[bool]] = None,
                 skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
                 statement_timeout: Optional[pulumi.Input[int]] = None,
                 superuser: Optional[pulumi.Input[bool]] = None,
                 valid_until: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering Role resources.
        :param pulumi.Input[str] assume_role: Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        :param pulumi.Input[bool] bypass_row_level_security: Defines whether a role bypasses every
               row-level security (RLS) policy.  Default value is `false`.
        :param pulumi.Input[int] connection_limit: If this role can log in, this specifies how
               many concurrent connections the role can establish. `-1` (the default) means no
               limit.
        :param pulumi.Input[bool] create_database: Defines a role's ability to execute `CREATE
               DATABASE`.  Default value is `false`.
        :param pulumi.Input[bool] create_role: Defines a role's ability to execute `CREATE ROLE`.
               A role with this privilege can also alter and drop other roles.  Default value
               is `false`.
        :param pulumi.Input[bool] encrypted_password: Defines whether the password is stored
               encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
               is always set (to the conservative and safe value), but may interfere with the
               behavior of
               [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        :param pulumi.Input[int] idle_in_transaction_session_timeout: Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        :param pulumi.Input[bool] inherit: Defines whether a role "inherits" the privileges of
               roles it is a member of.  Default value is `true`.
        :param pulumi.Input[bool] login: Defines whether role is allowed to log in.  Roles without
               this attribute are useful for managing database privileges, but are not users
               in the usual sense of the word.  Default value is `false`.
        :param pulumi.Input[str] name: The name of the role. Must be unique on the PostgreSQL
               server instance where it is configured.
        :param pulumi.Input[str] password: Sets the role's password. A password is only of use
               for roles having the `login` attribute set to true.
        :param pulumi.Input[bool] replication: Defines whether a role is allowed to initiate
               streaming replication or put the system in and out of backup mode.  Default
               value is `false`
        :param pulumi.Input[Sequence[pulumi.Input[str]]] roles: Defines list of roles which will be granted to this new role.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] search_paths: Alters the search path of this new role. Note that
               due to limitations in the implementation, values cannot contain the substring
               `", "`.
        :param pulumi.Input[bool] skip_drop_role: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, the
               [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
               in each of the respective databases must occur before the ROLE can be dropped
               from the catalog.  Set this option to true when there are multiple databases
               in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
               This is the third and final step taken when removing a ROLE from a database.
        :param pulumi.Input[bool] skip_reassign_owned: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, a
               [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
               must be executed on each of the respective databases before the `DROP ROLE`
               can be executed to dropped the ROLE from the catalog.  This is the first and
               second steps taken when removing a ROLE from a database (the second step being
               an implicit
               [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        :param pulumi.Input[int] statement_timeout: Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        :param pulumi.Input[bool] superuser: Defines whether the role is a "superuser", and
               therefore can override all access restrictions within the database.  Default
               value is `false`.
        :param pulumi.Input[str] valid_until: Defines the date and time after which the role's
               password is no longer valid.  Established connections past this `valid_time`
               will have to be manually terminated.  This value corresponds to a PostgreSQL
               datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
               set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        _RoleState._configure(
            lambda key, value: pulumi.set(__self__, key, value),
            assume_role=assume_role,
            bypass_row_level_security=bypass_row_level_security,
            connection_limit=connection_limit,
            create_database=create_database,
            create_role=create_role,
            encrypted=encrypted,
            encrypted_password=encrypted_password,
            idle_in_transaction_session_timeout=idle_in_transaction_session_timeout,
            inherit=inherit,
            login=login,
            name=name,
            password=password,
            replication=replication,
            roles=roles,
            search_paths=search_paths,
            skip_drop_role=skip_drop_role,
            skip_reassign_owned=skip_reassign_owned,
            statement_timeout=statement_timeout,
            superuser=superuser,
            valid_until=valid_until,
        )
    @staticmethod
    def _configure(
             _setter: Callable[[Any, Any], None],
             assume_role: Optional[pulumi.Input[str]] = None,
             bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
             connection_limit: Optional[pulumi.Input[int]] = None,
             create_database: Optional[pulumi.Input[bool]] = None,
             create_role: Optional[pulumi.Input[bool]] = None,
             encrypted: Optional[pulumi.Input[str]] = None,
             encrypted_password: Optional[pulumi.Input[bool]] = None,
             idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
             inherit: Optional[pulumi.Input[bool]] = None,
             login: Optional[pulumi.Input[bool]] = None,
             name: Optional[pulumi.Input[str]] = None,
             password: Optional[pulumi.Input[str]] = None,
             replication: Optional[pulumi.Input[bool]] = None,
             roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             skip_drop_role: Optional[pulumi.Input[bool]] = None,
             skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
             statement_timeout: Optional[pulumi.Input[int]] = None,
             superuser: Optional[pulumi.Input[bool]] = None,
             valid_until: Optional[pulumi.Input[str]] = None,
             opts: Optional[pulumi.ResourceOptions] = None,
             **kwargs):
        if assume_role is None and 'assumeRole' in kwargs:
            assume_role = kwargs['assumeRole']
        if bypass_row_level_security is None and 'bypassRowLevelSecurity' in kwargs:
            bypass_row_level_security = kwargs['bypassRowLevelSecurity']
        if connection_limit is None and 'connectionLimit' in kwargs:
            connection_limit = kwargs['connectionLimit']
        if create_database is None and 'createDatabase' in kwargs:
            create_database = kwargs['createDatabase']
        if create_role is None and 'createRole' in kwargs:
            create_role = kwargs['createRole']
        if encrypted_password is None and 'encryptedPassword' in kwargs:
            encrypted_password = kwargs['encryptedPassword']
        if idle_in_transaction_session_timeout is None and 'idleInTransactionSessionTimeout' in kwargs:
            idle_in_transaction_session_timeout = kwargs['idleInTransactionSessionTimeout']
        if search_paths is None and 'searchPaths' in kwargs:
            search_paths = kwargs['searchPaths']
        if skip_drop_role is None and 'skipDropRole' in kwargs:
            skip_drop_role = kwargs['skipDropRole']
        if skip_reassign_owned is None and 'skipReassignOwned' in kwargs:
            skip_reassign_owned = kwargs['skipReassignOwned']
        if statement_timeout is None and 'statementTimeout' in kwargs:
            statement_timeout = kwargs['statementTimeout']
        if valid_until is None and 'validUntil' in kwargs:
            valid_until = kwargs['validUntil']

        if assume_role is not None:
            _setter("assume_role", assume_role)
        if bypass_row_level_security is not None:
            _setter("bypass_row_level_security", bypass_row_level_security)
        if connection_limit is not None:
            _setter("connection_limit", connection_limit)
        if create_database is not None:
            _setter("create_database", create_database)
        if create_role is not None:
            _setter("create_role", create_role)
        if encrypted is not None:
            warnings.warn("""Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""", DeprecationWarning)
            pulumi.log.warn("""encrypted is deprecated: Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""")
        if encrypted is not None:
            _setter("encrypted", encrypted)
        if encrypted_password is not None:
            _setter("encrypted_password", encrypted_password)
        if idle_in_transaction_session_timeout is not None:
            _setter("idle_in_transaction_session_timeout", idle_in_transaction_session_timeout)
        if inherit is not None:
            _setter("inherit", inherit)
        if login is not None:
            _setter("login", login)
        if name is not None:
            _setter("name", name)
        if password is not None:
            _setter("password", password)
        if replication is not None:
            _setter("replication", replication)
        if roles is not None:
            _setter("roles", roles)
        if search_paths is not None:
            _setter("search_paths", search_paths)
        if skip_drop_role is not None:
            _setter("skip_drop_role", skip_drop_role)
        if skip_reassign_owned is not None:
            _setter("skip_reassign_owned", skip_reassign_owned)
        if statement_timeout is not None:
            _setter("statement_timeout", statement_timeout)
        if superuser is not None:
            _setter("superuser", superuser)
        if valid_until is not None:
            _setter("valid_until", valid_until)

    @property
    @pulumi.getter(name="assumeRole")
    def assume_role(self) -> Optional[pulumi.Input[str]]:
        """
        Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        """
        return pulumi.get(self, "assume_role")

    @assume_role.setter
    def assume_role(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "assume_role", value)

    @property
    @pulumi.getter(name="bypassRowLevelSecurity")
    def bypass_row_level_security(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role bypasses every
        row-level security (RLS) policy.  Default value is `false`.
        """
        return pulumi.get(self, "bypass_row_level_security")

    @bypass_row_level_security.setter
    def bypass_row_level_security(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "bypass_row_level_security", value)

    @property
    @pulumi.getter(name="connectionLimit")
    def connection_limit(self) -> Optional[pulumi.Input[int]]:
        """
        If this role can log in, this specifies how
        many concurrent connections the role can establish. `-1` (the default) means no
        limit.
        """
        return pulumi.get(self, "connection_limit")

    @connection_limit.setter
    def connection_limit(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "connection_limit", value)

    @property
    @pulumi.getter(name="createDatabase")
    def create_database(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines a role's ability to execute `CREATE
        DATABASE`.  Default value is `false`.
        """
        return pulumi.get(self, "create_database")

    @create_database.setter
    def create_database(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "create_database", value)

    @property
    @pulumi.getter(name="createRole")
    def create_role(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines a role's ability to execute `CREATE ROLE`.
        A role with this privilege can also alter and drop other roles.  Default value
        is `false`.
        """
        return pulumi.get(self, "create_role")

    @create_role.setter
    def create_role(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "create_role", value)

    @property
    @pulumi.getter
    def encrypted(self) -> Optional[pulumi.Input[str]]:
        warnings.warn("""Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""", DeprecationWarning)
        pulumi.log.warn("""encrypted is deprecated: Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""")

        return pulumi.get(self, "encrypted")

    @encrypted.setter
    def encrypted(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "encrypted", value)

    @property
    @pulumi.getter(name="encryptedPassword")
    def encrypted_password(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether the password is stored
        encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
        is always set (to the conservative and safe value), but may interfere with the
        behavior of
        [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        """
        return pulumi.get(self, "encrypted_password")

    @encrypted_password.setter
    def encrypted_password(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "encrypted_password", value)

    @property
    @pulumi.getter(name="idleInTransactionSessionTimeout")
    def idle_in_transaction_session_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        """
        return pulumi.get(self, "idle_in_transaction_session_timeout")

    @idle_in_transaction_session_timeout.setter
    def idle_in_transaction_session_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "idle_in_transaction_session_timeout", value)

    @property
    @pulumi.getter
    def inherit(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role "inherits" the privileges of
        roles it is a member of.  Default value is `true`.
        """
        return pulumi.get(self, "inherit")

    @inherit.setter
    def inherit(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "inherit", value)

    @property
    @pulumi.getter
    def login(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether role is allowed to log in.  Roles without
        this attribute are useful for managing database privileges, but are not users
        in the usual sense of the word.  Default value is `false`.
        """
        return pulumi.get(self, "login")

    @login.setter
    def login(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "login", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the role. Must be unique on the PostgreSQL
        server instance where it is configured.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def password(self) -> Optional[pulumi.Input[str]]:
        """
        Sets the role's password. A password is only of use
        for roles having the `login` attribute set to true.
        """
        return pulumi.get(self, "password")

    @password.setter
    def password(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "password", value)

    @property
    @pulumi.getter
    def replication(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether a role is allowed to initiate
        streaming replication or put the system in and out of backup mode.  Default
        value is `false`
        """
        return pulumi.get(self, "replication")

    @replication.setter
    def replication(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "replication", value)

    @property
    @pulumi.getter
    def roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Defines list of roles which will be granted to this new role.
        """
        return pulumi.get(self, "roles")

    @roles.setter
    def roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "roles", value)

    @property
    @pulumi.getter(name="searchPaths")
    def search_paths(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Alters the search path of this new role. Note that
        due to limitations in the implementation, values cannot contain the substring
        `", "`.
        """
        return pulumi.get(self, "search_paths")

    @search_paths.setter
    def search_paths(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "search_paths", value)

    @property
    @pulumi.getter(name="skipDropRole")
    def skip_drop_role(self) -> Optional[pulumi.Input[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, the
        [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
        in each of the respective databases must occur before the ROLE can be dropped
        from the catalog.  Set this option to true when there are multiple databases
        in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
        This is the third and final step taken when removing a ROLE from a database.
        """
        return pulumi.get(self, "skip_drop_role")

    @skip_drop_role.setter
    def skip_drop_role(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "skip_drop_role", value)

    @property
    @pulumi.getter(name="skipReassignOwned")
    def skip_reassign_owned(self) -> Optional[pulumi.Input[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, a
        [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
        must be executed on each of the respective databases before the `DROP ROLE`
        can be executed to dropped the ROLE from the catalog.  This is the first and
        second steps taken when removing a ROLE from a database (the second step being
        an implicit
        [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        """
        return pulumi.get(self, "skip_reassign_owned")

    @skip_reassign_owned.setter
    def skip_reassign_owned(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "skip_reassign_owned", value)

    @property
    @pulumi.getter(name="statementTimeout")
    def statement_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        """
        return pulumi.get(self, "statement_timeout")

    @statement_timeout.setter
    def statement_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "statement_timeout", value)

    @property
    @pulumi.getter
    def superuser(self) -> Optional[pulumi.Input[bool]]:
        """
        Defines whether the role is a "superuser", and
        therefore can override all access restrictions within the database.  Default
        value is `false`.
        """
        return pulumi.get(self, "superuser")

    @superuser.setter
    def superuser(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "superuser", value)

    @property
    @pulumi.getter(name="validUntil")
    def valid_until(self) -> Optional[pulumi.Input[str]]:
        """
        Defines the date and time after which the role's
        password is no longer valid.  Established connections past this `valid_time`
        will have to be manually terminated.  This value corresponds to a PostgreSQL
        datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
        set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        return pulumi.get(self, "valid_until")

    @valid_until.setter
    def valid_until(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "valid_until", value)


class Role(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 assume_role: Optional[pulumi.Input[str]] = None,
                 bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
                 connection_limit: Optional[pulumi.Input[int]] = None,
                 create_database: Optional[pulumi.Input[bool]] = None,
                 create_role: Optional[pulumi.Input[bool]] = None,
                 encrypted: Optional[pulumi.Input[str]] = None,
                 encrypted_password: Optional[pulumi.Input[bool]] = None,
                 idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
                 inherit: Optional[pulumi.Input[bool]] = None,
                 login: Optional[pulumi.Input[bool]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 password: Optional[pulumi.Input[str]] = None,
                 replication: Optional[pulumi.Input[bool]] = None,
                 roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 skip_drop_role: Optional[pulumi.Input[bool]] = None,
                 skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
                 statement_timeout: Optional[pulumi.Input[int]] = None,
                 superuser: Optional[pulumi.Input[bool]] = None,
                 valid_until: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        Create a Role resource with the given unique name, props, and options.
        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] assume_role: Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        :param pulumi.Input[bool] bypass_row_level_security: Defines whether a role bypasses every
               row-level security (RLS) policy.  Default value is `false`.
        :param pulumi.Input[int] connection_limit: If this role can log in, this specifies how
               many concurrent connections the role can establish. `-1` (the default) means no
               limit.
        :param pulumi.Input[bool] create_database: Defines a role's ability to execute `CREATE
               DATABASE`.  Default value is `false`.
        :param pulumi.Input[bool] create_role: Defines a role's ability to execute `CREATE ROLE`.
               A role with this privilege can also alter and drop other roles.  Default value
               is `false`.
        :param pulumi.Input[bool] encrypted_password: Defines whether the password is stored
               encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
               is always set (to the conservative and safe value), but may interfere with the
               behavior of
               [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        :param pulumi.Input[int] idle_in_transaction_session_timeout: Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        :param pulumi.Input[bool] inherit: Defines whether a role "inherits" the privileges of
               roles it is a member of.  Default value is `true`.
        :param pulumi.Input[bool] login: Defines whether role is allowed to log in.  Roles without
               this attribute are useful for managing database privileges, but are not users
               in the usual sense of the word.  Default value is `false`.
        :param pulumi.Input[str] name: The name of the role. Must be unique on the PostgreSQL
               server instance where it is configured.
        :param pulumi.Input[str] password: Sets the role's password. A password is only of use
               for roles having the `login` attribute set to true.
        :param pulumi.Input[bool] replication: Defines whether a role is allowed to initiate
               streaming replication or put the system in and out of backup mode.  Default
               value is `false`
        :param pulumi.Input[Sequence[pulumi.Input[str]]] roles: Defines list of roles which will be granted to this new role.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] search_paths: Alters the search path of this new role. Note that
               due to limitations in the implementation, values cannot contain the substring
               `", "`.
        :param pulumi.Input[bool] skip_drop_role: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, the
               [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
               in each of the respective databases must occur before the ROLE can be dropped
               from the catalog.  Set this option to true when there are multiple databases
               in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
               This is the third and final step taken when removing a ROLE from a database.
        :param pulumi.Input[bool] skip_reassign_owned: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, a
               [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
               must be executed on each of the respective databases before the `DROP ROLE`
               can be executed to dropped the ROLE from the catalog.  This is the first and
               second steps taken when removing a ROLE from a database (the second step being
               an implicit
               [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        :param pulumi.Input[int] statement_timeout: Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        :param pulumi.Input[bool] superuser: Defines whether the role is a "superuser", and
               therefore can override all access restrictions within the database.  Default
               value is `false`.
        :param pulumi.Input[str] valid_until: Defines the date and time after which the role's
               password is no longer valid.  Established connections past this `valid_time`
               will have to be manually terminated.  This value corresponds to a PostgreSQL
               datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
               set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: Optional[RoleArgs] = None,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Create a Role resource with the given unique name, props, and options.
        :param str resource_name: The name of the resource.
        :param RoleArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(RoleArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            kwargs = kwargs or {}
            def _setter(key, value):
                kwargs[key] = value
            RoleArgs._configure(_setter, **kwargs)
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 assume_role: Optional[pulumi.Input[str]] = None,
                 bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
                 connection_limit: Optional[pulumi.Input[int]] = None,
                 create_database: Optional[pulumi.Input[bool]] = None,
                 create_role: Optional[pulumi.Input[bool]] = None,
                 encrypted: Optional[pulumi.Input[str]] = None,
                 encrypted_password: Optional[pulumi.Input[bool]] = None,
                 idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
                 inherit: Optional[pulumi.Input[bool]] = None,
                 login: Optional[pulumi.Input[bool]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 password: Optional[pulumi.Input[str]] = None,
                 replication: Optional[pulumi.Input[bool]] = None,
                 roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 skip_drop_role: Optional[pulumi.Input[bool]] = None,
                 skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
                 statement_timeout: Optional[pulumi.Input[int]] = None,
                 superuser: Optional[pulumi.Input[bool]] = None,
                 valid_until: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = RoleArgs.__new__(RoleArgs)

            __props__.__dict__["assume_role"] = assume_role
            __props__.__dict__["bypass_row_level_security"] = bypass_row_level_security
            __props__.__dict__["connection_limit"] = connection_limit
            __props__.__dict__["create_database"] = create_database
            __props__.__dict__["create_role"] = create_role
            __props__.__dict__["encrypted"] = encrypted
            __props__.__dict__["encrypted_password"] = encrypted_password
            __props__.__dict__["idle_in_transaction_session_timeout"] = idle_in_transaction_session_timeout
            __props__.__dict__["inherit"] = inherit
            __props__.__dict__["login"] = login
            __props__.__dict__["name"] = name
            __props__.__dict__["password"] = None if password is None else pulumi.Output.secret(password)
            __props__.__dict__["replication"] = replication
            __props__.__dict__["roles"] = roles
            __props__.__dict__["search_paths"] = search_paths
            __props__.__dict__["skip_drop_role"] = skip_drop_role
            __props__.__dict__["skip_reassign_owned"] = skip_reassign_owned
            __props__.__dict__["statement_timeout"] = statement_timeout
            __props__.__dict__["superuser"] = superuser
            __props__.__dict__["valid_until"] = valid_until
        secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["password"])
        opts = pulumi.ResourceOptions.merge(opts, secret_opts)
        super(Role, __self__).__init__(
            'postgresql:index/role:Role',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            assume_role: Optional[pulumi.Input[str]] = None,
            bypass_row_level_security: Optional[pulumi.Input[bool]] = None,
            connection_limit: Optional[pulumi.Input[int]] = None,
            create_database: Optional[pulumi.Input[bool]] = None,
            create_role: Optional[pulumi.Input[bool]] = None,
            encrypted: Optional[pulumi.Input[str]] = None,
            encrypted_password: Optional[pulumi.Input[bool]] = None,
            idle_in_transaction_session_timeout: Optional[pulumi.Input[int]] = None,
            inherit: Optional[pulumi.Input[bool]] = None,
            login: Optional[pulumi.Input[bool]] = None,
            name: Optional[pulumi.Input[str]] = None,
            password: Optional[pulumi.Input[str]] = None,
            replication: Optional[pulumi.Input[bool]] = None,
            roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            search_paths: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            skip_drop_role: Optional[pulumi.Input[bool]] = None,
            skip_reassign_owned: Optional[pulumi.Input[bool]] = None,
            statement_timeout: Optional[pulumi.Input[int]] = None,
            superuser: Optional[pulumi.Input[bool]] = None,
            valid_until: Optional[pulumi.Input[str]] = None) -> 'Role':
        """
        Get an existing Role resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] assume_role: Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        :param pulumi.Input[bool] bypass_row_level_security: Defines whether a role bypasses every
               row-level security (RLS) policy.  Default value is `false`.
        :param pulumi.Input[int] connection_limit: If this role can log in, this specifies how
               many concurrent connections the role can establish. `-1` (the default) means no
               limit.
        :param pulumi.Input[bool] create_database: Defines a role's ability to execute `CREATE
               DATABASE`.  Default value is `false`.
        :param pulumi.Input[bool] create_role: Defines a role's ability to execute `CREATE ROLE`.
               A role with this privilege can also alter and drop other roles.  Default value
               is `false`.
        :param pulumi.Input[bool] encrypted_password: Defines whether the password is stored
               encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
               is always set (to the conservative and safe value), but may interfere with the
               behavior of
               [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        :param pulumi.Input[int] idle_in_transaction_session_timeout: Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        :param pulumi.Input[bool] inherit: Defines whether a role "inherits" the privileges of
               roles it is a member of.  Default value is `true`.
        :param pulumi.Input[bool] login: Defines whether role is allowed to log in.  Roles without
               this attribute are useful for managing database privileges, but are not users
               in the usual sense of the word.  Default value is `false`.
        :param pulumi.Input[str] name: The name of the role. Must be unique on the PostgreSQL
               server instance where it is configured.
        :param pulumi.Input[str] password: Sets the role's password. A password is only of use
               for roles having the `login` attribute set to true.
        :param pulumi.Input[bool] replication: Defines whether a role is allowed to initiate
               streaming replication or put the system in and out of backup mode.  Default
               value is `false`
        :param pulumi.Input[Sequence[pulumi.Input[str]]] roles: Defines list of roles which will be granted to this new role.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] search_paths: Alters the search path of this new role. Note that
               due to limitations in the implementation, values cannot contain the substring
               `", "`.
        :param pulumi.Input[bool] skip_drop_role: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, the
               [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
               in each of the respective databases must occur before the ROLE can be dropped
               from the catalog.  Set this option to true when there are multiple databases
               in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
               This is the third and final step taken when removing a ROLE from a database.
        :param pulumi.Input[bool] skip_reassign_owned: When a PostgreSQL ROLE exists in multiple
               databases and the ROLE is dropped, a
               [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
               must be executed on each of the respective databases before the `DROP ROLE`
               can be executed to dropped the ROLE from the catalog.  This is the first and
               second steps taken when removing a ROLE from a database (the second step being
               an implicit
               [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        :param pulumi.Input[int] statement_timeout: Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        :param pulumi.Input[bool] superuser: Defines whether the role is a "superuser", and
               therefore can override all access restrictions within the database.  Default
               value is `false`.
        :param pulumi.Input[str] valid_until: Defines the date and time after which the role's
               password is no longer valid.  Established connections past this `valid_time`
               will have to be manually terminated.  This value corresponds to a PostgreSQL
               datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
               set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _RoleState.__new__(_RoleState)

        __props__.__dict__["assume_role"] = assume_role
        __props__.__dict__["bypass_row_level_security"] = bypass_row_level_security
        __props__.__dict__["connection_limit"] = connection_limit
        __props__.__dict__["create_database"] = create_database
        __props__.__dict__["create_role"] = create_role
        __props__.__dict__["encrypted"] = encrypted
        __props__.__dict__["encrypted_password"] = encrypted_password
        __props__.__dict__["idle_in_transaction_session_timeout"] = idle_in_transaction_session_timeout
        __props__.__dict__["inherit"] = inherit
        __props__.__dict__["login"] = login
        __props__.__dict__["name"] = name
        __props__.__dict__["password"] = password
        __props__.__dict__["replication"] = replication
        __props__.__dict__["roles"] = roles
        __props__.__dict__["search_paths"] = search_paths
        __props__.__dict__["skip_drop_role"] = skip_drop_role
        __props__.__dict__["skip_reassign_owned"] = skip_reassign_owned
        __props__.__dict__["statement_timeout"] = statement_timeout
        __props__.__dict__["superuser"] = superuser
        __props__.__dict__["valid_until"] = valid_until
        return Role(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="assumeRole")
    def assume_role(self) -> pulumi.Output[Optional[str]]:
        """
        Defines the role to switch to at login via [`SET ROLE`](https://www.postgresql.org/docs/current/sql-set-role.html).
        """
        return pulumi.get(self, "assume_role")

    @property
    @pulumi.getter(name="bypassRowLevelSecurity")
    def bypass_row_level_security(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether a role bypasses every
        row-level security (RLS) policy.  Default value is `false`.
        """
        return pulumi.get(self, "bypass_row_level_security")

    @property
    @pulumi.getter(name="connectionLimit")
    def connection_limit(self) -> pulumi.Output[Optional[int]]:
        """
        If this role can log in, this specifies how
        many concurrent connections the role can establish. `-1` (the default) means no
        limit.
        """
        return pulumi.get(self, "connection_limit")

    @property
    @pulumi.getter(name="createDatabase")
    def create_database(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines a role's ability to execute `CREATE
        DATABASE`.  Default value is `false`.
        """
        return pulumi.get(self, "create_database")

    @property
    @pulumi.getter(name="createRole")
    def create_role(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines a role's ability to execute `CREATE ROLE`.
        A role with this privilege can also alter and drop other roles.  Default value
        is `false`.
        """
        return pulumi.get(self, "create_role")

    @property
    @pulumi.getter
    def encrypted(self) -> pulumi.Output[Optional[str]]:
        warnings.warn("""Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""", DeprecationWarning)
        pulumi.log.warn("""encrypted is deprecated: Rename PostgreSQL role resource attribute \"encrypted\" to \"encrypted_password\"""")

        return pulumi.get(self, "encrypted")

    @property
    @pulumi.getter(name="encryptedPassword")
    def encrypted_password(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether the password is stored
        encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
        is always set (to the conservative and safe value), but may interfere with the
        behavior of
        [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
        """
        return pulumi.get(self, "encrypted_password")

    @property
    @pulumi.getter(name="idleInTransactionSessionTimeout")
    def idle_in_transaction_session_timeout(self) -> pulumi.Output[Optional[int]]:
        """
        Terminate any session with an open transaction that has been idle for longer than the specified duration in milliseconds
        """
        return pulumi.get(self, "idle_in_transaction_session_timeout")

    @property
    @pulumi.getter
    def inherit(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether a role "inherits" the privileges of
        roles it is a member of.  Default value is `true`.
        """
        return pulumi.get(self, "inherit")

    @property
    @pulumi.getter
    def login(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether role is allowed to log in.  Roles without
        this attribute are useful for managing database privileges, but are not users
        in the usual sense of the word.  Default value is `false`.
        """
        return pulumi.get(self, "login")

    @property
    @pulumi.getter
    def name(self) -> pulumi.Output[str]:
        """
        The name of the role. Must be unique on the PostgreSQL
        server instance where it is configured.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def password(self) -> pulumi.Output[Optional[str]]:
        """
        Sets the role's password. A password is only of use
        for roles having the `login` attribute set to true.
        """
        return pulumi.get(self, "password")

    @property
    @pulumi.getter
    def replication(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether a role is allowed to initiate
        streaming replication or put the system in and out of backup mode.  Default
        value is `false`
        """
        return pulumi.get(self, "replication")

    @property
    @pulumi.getter
    def roles(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        Defines list of roles which will be granted to this new role.
        """
        return pulumi.get(self, "roles")

    @property
    @pulumi.getter(name="searchPaths")
    def search_paths(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        Alters the search path of this new role. Note that
        due to limitations in the implementation, values cannot contain the substring
        `", "`.
        """
        return pulumi.get(self, "search_paths")

    @property
    @pulumi.getter(name="skipDropRole")
    def skip_drop_role(self) -> pulumi.Output[Optional[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, the
        [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
        in each of the respective databases must occur before the ROLE can be dropped
        from the catalog.  Set this option to true when there are multiple databases
        in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
        This is the third and final step taken when removing a ROLE from a database.
        """
        return pulumi.get(self, "skip_drop_role")

    @property
    @pulumi.getter(name="skipReassignOwned")
    def skip_reassign_owned(self) -> pulumi.Output[Optional[bool]]:
        """
        When a PostgreSQL ROLE exists in multiple
        databases and the ROLE is dropped, a
        [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
        must be executed on each of the respective databases before the `DROP ROLE`
        can be executed to dropped the ROLE from the catalog.  This is the first and
        second steps taken when removing a ROLE from a database (the second step being
        an implicit
        [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
        """
        return pulumi.get(self, "skip_reassign_owned")

    @property
    @pulumi.getter(name="statementTimeout")
    def statement_timeout(self) -> pulumi.Output[Optional[int]]:
        """
        Defines [`statement_timeout`](https://www.postgresql.org/docs/current/runtime-config-client.html#RUNTIME-CONFIG-CLIENT-STATEMENT) setting for this role which allows to abort any statement that takes more than the specified amount of time.
        """
        return pulumi.get(self, "statement_timeout")

    @property
    @pulumi.getter
    def superuser(self) -> pulumi.Output[Optional[bool]]:
        """
        Defines whether the role is a "superuser", and
        therefore can override all access restrictions within the database.  Default
        value is `false`.
        """
        return pulumi.get(self, "superuser")

    @property
    @pulumi.getter(name="validUntil")
    def valid_until(self) -> pulumi.Output[Optional[str]]:
        """
        Defines the date and time after which the role's
        password is no longer valid.  Established connections past this `valid_time`
        will have to be manually terminated.  This value corresponds to a PostgreSQL
        datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
        set to `infinity`.  Default is `NULL`, therefore `infinity`.
        """
        return pulumi.get(self, "valid_until")

