IAMCustomRole

Allows management of a customized Cloud IAM organization role. For more information see the official documentation and API.

Warning: Note that custom roles in GCP have the concept of a soft-delete. There are two issues that may arise from this and how roles are propagated. 1) creating a role may involve undeleting and then updating a role with the same name, possibly causing confusing behavior between undelete and update. 2) A deleted role is permanently deleted after 7 days, but it can take up to 30 more days (i.e. between 7 and 37 days after deletion) before the role name is made available again. This means a deleted role that has been deleted for more than 7 days cannot be changed at all by the provider, and new roles cannot share that name.

Example Usage

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
    public MyStack()
    {
        var my_custom_role = new Gcp.Organizations.IAMCustomRole("my-custom-role", new Gcp.Organizations.IAMCustomRoleArgs
        {
            Description = "A description",
            OrgId = "123456789",
            Permissions = 
            {
                "iam.roles.list",
                "iam.roles.create",
                "iam.roles.delete",
            },
            RoleId = "myCustomRole",
            Title = "My Custom Role",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v5/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIAMCustomRole(ctx, "my_custom_role", &organizations.IAMCustomRoleArgs{
			Description: pulumi.String("A description"),
			OrgId:       pulumi.String("123456789"),
			Permissions: pulumi.StringArray{
				pulumi.String("iam.roles.list"),
				pulumi.String("iam.roles.create"),
				pulumi.String("iam.roles.delete"),
			},
			RoleId: pulumi.String("myCustomRole"),
			Title:  pulumi.String("My Custom Role"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
import pulumi
import pulumi_gcp as gcp

my_custom_role = gcp.organizations.IAMCustomRole("my-custom-role",
    description="A description",
    org_id="123456789",
    permissions=[
        "iam.roles.list",
        "iam.roles.create",
        "iam.roles.delete",
    ],
    role_id="myCustomRole",
    title="My Custom Role")
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const my_custom_role = new gcp.organizations.IAMCustomRole("my-custom-role", {
    description: "A description",
    orgId: "123456789",
    permissions: [
        "iam.roles.list",
        "iam.roles.create",
        "iam.roles.delete",
    ],
    roleId: "myCustomRole",
    title: "My Custom Role",
});

Create a IAMCustomRole Resource

new IAMCustomRole(name: string, args: IAMCustomRoleArgs, opts?: CustomResourceOptions);
@overload
def IAMCustomRole(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  description: Optional[str] = None,
                  org_id: Optional[str] = None,
                  permissions: Optional[Sequence[str]] = None,
                  role_id: Optional[str] = None,
                  stage: Optional[str] = None,
                  title: Optional[str] = None)
@overload
def IAMCustomRole(resource_name: str,
                  args: IAMCustomRoleArgs,
                  opts: Optional[ResourceOptions] = None)
func NewIAMCustomRole(ctx *Context, name string, args IAMCustomRoleArgs, opts ...ResourceOption) (*IAMCustomRole, error)
public IAMCustomRole(string name, IAMCustomRoleArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args IAMCustomRoleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args IAMCustomRoleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args IAMCustomRoleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args IAMCustomRoleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

IAMCustomRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IAMCustomRole resource accepts the following input properties:

OrgId string
The numeric ID of the organization in which you want to create a custom role.
Permissions List<string>
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
RoleId string
The role id to use for this role.
Title string
A human-readable title for the role.
Description string
A human-readable description for the role.
Stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
OrgId string
The numeric ID of the organization in which you want to create a custom role.
Permissions []string
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
RoleId string
The role id to use for this role.
Title string
A human-readable title for the role.
Description string
A human-readable description for the role.
Stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
orgId string
The numeric ID of the organization in which you want to create a custom role.
permissions string[]
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
roleId string
The role id to use for this role.
title string
A human-readable title for the role.
description string
A human-readable description for the role.
stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
org_id str
The numeric ID of the organization in which you want to create a custom role.
permissions Sequence[str]
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
role_id str
The role id to use for this role.
title str
A human-readable title for the role.
description str
A human-readable description for the role.
stage str
The current launch stage of the role. Defaults to GA. List of possible stages is here.

Outputs

All input properties are implicitly available as output properties. Additionally, the IAMCustomRole resource produces the following output properties:

Deleted bool
(Optional) The current deleted state of the role.
Id string
The provider-assigned unique ID for this managed resource.
Name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
Deleted bool
(Optional) The current deleted state of the role.
Id string
The provider-assigned unique ID for this managed resource.
Name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
deleted boolean
(Optional) The current deleted state of the role.
id string
The provider-assigned unique ID for this managed resource.
name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
deleted bool
(Optional) The current deleted state of the role.
id str
The provider-assigned unique ID for this managed resource.
name str
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.

Look up an Existing IAMCustomRole Resource

Get an existing IAMCustomRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IAMCustomRoleState, opts?: CustomResourceOptions): IAMCustomRole
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        deleted: Optional[bool] = None,
        description: Optional[str] = None,
        name: Optional[str] = None,
        org_id: Optional[str] = None,
        permissions: Optional[Sequence[str]] = None,
        role_id: Optional[str] = None,
        stage: Optional[str] = None,
        title: Optional[str] = None) -> IAMCustomRole
func GetIAMCustomRole(ctx *Context, name string, id IDInput, state *IAMCustomRoleState, opts ...ResourceOption) (*IAMCustomRole, error)
public static IAMCustomRole Get(string name, Input<string> id, IAMCustomRoleState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

Deleted bool
(Optional) The current deleted state of the role.
Description string
A human-readable description for the role.
Name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
OrgId string
The numeric ID of the organization in which you want to create a custom role.
Permissions List<string>
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
RoleId string
The role id to use for this role.
Stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
Title string
A human-readable title for the role.
Deleted bool
(Optional) The current deleted state of the role.
Description string
A human-readable description for the role.
Name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
OrgId string
The numeric ID of the organization in which you want to create a custom role.
Permissions []string
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
RoleId string
The role id to use for this role.
Stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
Title string
A human-readable title for the role.
deleted boolean
(Optional) The current deleted state of the role.
description string
A human-readable description for the role.
name string
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
orgId string
The numeric ID of the organization in which you want to create a custom role.
permissions string[]
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
roleId string
The role id to use for this role.
stage string
The current launch stage of the role. Defaults to GA. List of possible stages is here.
title string
A human-readable title for the role.
deleted bool
(Optional) The current deleted state of the role.
description str
A human-readable description for the role.
name str
The name of the role in the format organizations/{{org_id}}/roles/{{role_id}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.
org_id str
The numeric ID of the organization in which you want to create a custom role.
permissions Sequence[str]
The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
role_id str
The role id to use for this role.
stage str
The current launch stage of the role. Defaults to GA. List of possible stages is here.
title str
A human-readable title for the role.

Import

Customized IAM organization role can be imported using their URI, e.g.

 $ pulumi import gcp:organizations/iAMCustomRole:IAMCustomRole my-custom-role organizations/123456789/roles/myCustomRole

Package Details

Repository
https://github.com/pulumi/pulumi-gcp
License
Apache-2.0
Notes
This Pulumi package is based on the google-beta Terraform Provider.