IamAuditConfig

Allows management of audit logging config for a given service for a Google Cloud Platform Organization.

Example Usage

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
    public MyStack()
    {
        var config = new Gcp.Organizations.IamAuditConfig("config", new Gcp.Organizations.IamAuditConfigArgs
        {
            AuditLogConfigs = 
            {
                new Gcp.Organizations.Inputs.IamAuditConfigAuditLogConfigArgs
                {
                    ExemptedMembers = 
                    {
                        "user:joebloggs@hashicorp.com",
                    },
                    LogType = "DATA_READ",
                },
            },
            OrgId = "your-organization-id",
            Service = "allServices",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIamAuditConfig(ctx, "config", &organizations.IamAuditConfigArgs{
			AuditLogConfigs: organizations.IamAuditConfigAuditLogConfigArray{
				&organizations.IamAuditConfigAuditLogConfigArgs{
					ExemptedMembers: pulumi.StringArray{
						pulumi.String("user:joebloggs@hashicorp.com"),
					},
					LogType: pulumi.String("DATA_READ"),
				},
			},
			OrgId:   pulumi.String("your-organization-id"),
			Service: pulumi.String("allServices"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
import pulumi
import pulumi_gcp as gcp

config = gcp.organizations.IamAuditConfig("config",
    audit_log_configs=[gcp.organizations.IamAuditConfigAuditLogConfigArgs(
        exempted_members=["user:joebloggs@hashicorp.com"],
        log_type="DATA_READ",
    )],
    org_id="your-organization-id",
    service="allServices")
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const config = new gcp.organizations.IamAuditConfig("config", {
    auditLogConfigs: [{
        exemptedMembers: ["user:joebloggs@hashicorp.com"],
        logType: "DATA_READ",
    }],
    orgId: "your-organization-id",
    service: "allServices",
});

Create a IamAuditConfig Resource

new IamAuditConfig(name: string, args: IamAuditConfigArgs, opts?: CustomResourceOptions);
@overload
def IamAuditConfig(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   audit_log_configs: Optional[Sequence[IamAuditConfigAuditLogConfigArgs]] = None,
                   org_id: Optional[str] = None,
                   service: Optional[str] = None)
@overload
def IamAuditConfig(resource_name: str,
                   args: IamAuditConfigArgs,
                   opts: Optional[ResourceOptions] = None)
func NewIamAuditConfig(ctx *Context, name string, args IamAuditConfigArgs, opts ...ResourceOption) (*IamAuditConfig, error)
public IamAuditConfig(string name, IamAuditConfigArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args IamAuditConfigArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args IamAuditConfigArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args IamAuditConfigArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args IamAuditConfigArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

IamAuditConfig Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IamAuditConfig resource accepts the following input properties:

AuditLogConfigs List<IamAuditConfigAuditLogConfigArgs>
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
OrgId string
The numeric ID of the organization in which you want to manage the audit logging config.
Service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
AuditLogConfigs []IamAuditConfigAuditLogConfig
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
OrgId string
The numeric ID of the organization in which you want to manage the audit logging config.
Service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
auditLogConfigs IamAuditConfigAuditLogConfigArgs[]
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
orgId string
The numeric ID of the organization in which you want to manage the audit logging config.
service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
audit_log_configs Sequence[IamAuditConfigAuditLogConfigArgs]
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
org_id str
The numeric ID of the organization in which you want to manage the audit logging config.
service str
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

Outputs

All input properties are implicitly available as output properties. Additionally, the IamAuditConfig resource produces the following output properties:

Etag string
The etag of iam policy
Id string
The provider-assigned unique ID for this managed resource.
Etag string
The etag of iam policy
Id string
The provider-assigned unique ID for this managed resource.
etag string
The etag of iam policy
id string
The provider-assigned unique ID for this managed resource.
etag str
The etag of iam policy
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing IamAuditConfig Resource

Get an existing IamAuditConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IamAuditConfigState, opts?: CustomResourceOptions): IamAuditConfig
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        audit_log_configs: Optional[Sequence[IamAuditConfigAuditLogConfigArgs]] = None,
        etag: Optional[str] = None,
        org_id: Optional[str] = None,
        service: Optional[str] = None) -> IamAuditConfig
func GetIamAuditConfig(ctx *Context, name string, id IDInput, state *IamAuditConfigState, opts ...ResourceOption) (*IamAuditConfig, error)
public static IamAuditConfig Get(string name, Input<string> id, IamAuditConfigState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

AuditLogConfigs List<IamAuditConfigAuditLogConfigArgs>
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
Etag string
The etag of iam policy
OrgId string
The numeric ID of the organization in which you want to manage the audit logging config.
Service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
AuditLogConfigs []IamAuditConfigAuditLogConfig
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
Etag string
The etag of iam policy
OrgId string
The numeric ID of the organization in which you want to manage the audit logging config.
Service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
auditLogConfigs IamAuditConfigAuditLogConfigArgs[]
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
etag string
The etag of iam policy
orgId string
The numeric ID of the organization in which you want to manage the audit logging config.
service string
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.
audit_log_configs Sequence[IamAuditConfigAuditLogConfigArgs]
The configuration for logging of each type of permission. This can be specified multiple times. Structure is documented below.
etag str
The etag of iam policy
org_id str
The numeric ID of the organization in which you want to manage the audit logging config.
service str
Service which will be enabled for audit logging. The special value allServices covers all services. Note that if there are google_organization_iam_audit_config resources covering both allServices and a specific service then the union of the two AuditConfigs is used for that service: the log_types specified in each audit_log_config are enabled, and the exempted_members in each audit_log_config are exempted.

Supporting Types

IamAuditConfigAuditLogConfig

LogType string
Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
ExemptedMembers List<string>

Identities that do not cause logging for this type of permission. Each entry can have one of the following values:

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
  • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
LogType string
Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
ExemptedMembers []string

Identities that do not cause logging for this type of permission. Each entry can have one of the following values:

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
  • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
logType string
Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
exemptedMembers string[]

Identities that do not cause logging for this type of permission. Each entry can have one of the following values:

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
  • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
log_type str
Permission type for which logging is to be configured. Must be one of DATA_READ, DATA_WRITE, or ADMIN_READ.
exempted_members Sequence[str]

Identities that do not cause logging for this type of permission. Each entry can have one of the following values:

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
  • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.

Import

IAM audit config imports use the identifier of the resource in question and the service, e.g.

 $ pulumi import gcp:organizations/iamAuditConfig:IamAuditConfig config "your-organization-id foo.googleapis.com"

Package Details

Repository
https://github.com/pulumi/pulumi-gcp
License
Apache-2.0
Notes
This Pulumi package is based on the google-beta Terraform Provider.