Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Packages
  2. Alibaba Cloud Provider
  3. API Docs
  4. cloudsso
  5. AccessManagement
Alibaba Cloud v3.83.0 published on Monday, Jul 21, 2025 by Pulumi
pulumi/pulumi-alicloud

alicloud.cloudsso.AccessManagement

Explore with Pulumi AI

alicloud logo
Alibaba Cloud v3.83.0 published on Monday, Jul 21, 2025 by Pulumi
pulumi/pulumi-alicloud

    Provides a Cloud SSO Access Assignment resource.

    For information about Cloud SSO Access Assignment and how to use it, see What is Access Assignment.

    NOTE: When you configure access assignment for the first time, access configuration will be automatically deployed.

    NOTE: Available since v1.145.0.

    NOTE: Cloud SSO Only Support cn-shanghai And us-west-1 Region

    Create AccessManagement Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AccessManagement(name: string, args: AccessManagementArgs, opts?: CustomResourceOptions);
    @overload
def AccessManagement(resource_name: str,
                     args: AccessManagementArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def AccessManagement(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     access_configuration_id: Optional[str] = None,
                     directory_id: Optional[str] = None,
                     principal_id: Optional[str] = None,
                     principal_type: Optional[str] = None,
                     target_id: Optional[str] = None,
                     target_type: Optional[str] = None,
                     deprovision_strategy: Optional[str] = None)
    func NewAccessManagement(ctx *Context, name string, args AccessManagementArgs, opts ...ResourceOption) (*AccessManagement, error)
    public AccessManagement(string name, AccessManagementArgs args, CustomResourceOptions? opts = null)
    public AccessManagement(String name, AccessManagementArgs args)
public AccessManagement(String name, AccessManagementArgs args, CustomResourceOptions options)

    type: alicloud:cloudsso:AccessManagement
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args AccessManagementArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AccessManagementArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AccessManagementArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AccessManagementArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AccessManagementArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var accessManagementResource = new AliCloud.CloudSso.AccessManagement("accessManagementResource", new()
{
    AccessConfigurationId = "string",
    DirectoryId = "string",
    PrincipalId = "string",
    PrincipalType = "string",
    TargetId = "string",
    TargetType = "string",
    DeprovisionStrategy = "string",
});

    example, err := cloudsso.NewAccessManagement(ctx, "accessManagementResource", &cloudsso.AccessManagementArgs{
	AccessConfigurationId: pulumi.String("string"),
	DirectoryId:           pulumi.String("string"),
	PrincipalId:           pulumi.String("string"),
	PrincipalType:         pulumi.String("string"),
	TargetId:              pulumi.String("string"),
	TargetType:            pulumi.String("string"),
	DeprovisionStrategy:   pulumi.String("string"),
})

    var accessManagementResource = new AccessManagement("accessManagementResource", AccessManagementArgs.builder()
    .accessConfigurationId("string")
    .directoryId("string")
    .principalId("string")
    .principalType("string")
    .targetId("string")
    .targetType("string")
    .deprovisionStrategy("string")
    .build());

    access_management_resource = alicloud.cloudsso.AccessManagement("accessManagementResource",
    access_configuration_id="string",
    directory_id="string",
    principal_id="string",
    principal_type="string",
    target_id="string",
    target_type="string",
    deprovision_strategy="string")

    const accessManagementResource = new alicloud.cloudsso.AccessManagement("accessManagementResource", {
    accessConfigurationId: "string",
    directoryId: "string",
    principalId: "string",
    principalType: "string",
    targetId: "string",
    targetType: "string",
    deprovisionStrategy: "string",
});

    type: alicloud:cloudsso:AccessManagement
properties:
    accessConfigurationId: string
    deprovisionStrategy: string
    directoryId: string
    principalId: string
    principalType: string
    targetId: string
    targetType: string

    AccessManagement Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AccessManagement resource accepts the following input properties:

    AccessConfigurationId string
    The ID of the access configuration.
    DirectoryId string
    The ID of the Directory.
    PrincipalId string
    The ID of the CloudSSO identity.
    PrincipalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    TargetId string
    The ID of the task object.
    TargetType string
    The type of the task object. Valid values: RD-Account.
    DeprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    AccessConfigurationId string
    The ID of the access configuration.
    DirectoryId string
    The ID of the Directory.
    PrincipalId string
    The ID of the CloudSSO identity.
    PrincipalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    TargetId string
    The ID of the task object.
    TargetType string
    The type of the task object. Valid values: RD-Account.
    DeprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    accessConfigurationId String
    The ID of the access configuration.
    directoryId String
    The ID of the Directory.
    principalId String
    The ID of the CloudSSO identity.
    principalType String
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId String
    The ID of the task object.
    targetType String
    The type of the task object. Valid values: RD-Account.
    deprovisionStrategy String
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    accessConfigurationId string
    The ID of the access configuration.
    directoryId string
    The ID of the Directory.
    principalId string
    The ID of the CloudSSO identity.
    principalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId string
    The ID of the task object.
    targetType string
    The type of the task object. Valid values: RD-Account.
    deprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    access_configuration_id str
    The ID of the access configuration.
    directory_id str
    The ID of the Directory.
    principal_id str
    The ID of the CloudSSO identity.
    principal_type str
    The type of the CloudSSO identity. Valid values: User, Group.
    target_id str
    The ID of the task object.
    target_type str
    The type of the task object. Valid values: RD-Account.
    deprovision_strategy str
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    accessConfigurationId String
    The ID of the access configuration.
    directoryId String
    The ID of the Directory.
    principalId String
    The ID of the CloudSSO identity.
    principalType String
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId String
    The ID of the task object.
    targetType String
    The type of the task object. Valid values: RD-Account.
    deprovisionStrategy String
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AccessManagement resource produces the following output properties:

    CreateTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    Id string
    The provider-assigned unique ID for this managed resource.
    CreateTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    Id string
    The provider-assigned unique ID for this managed resource.
    createTime String
    (Available since v1.254.0) The time when the access permissions were assigned.
    id String
    The provider-assigned unique ID for this managed resource.
    createTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    id string
    The provider-assigned unique ID for this managed resource.
    create_time str
    (Available since v1.254.0) The time when the access permissions were assigned.
    id str
    The provider-assigned unique ID for this managed resource.
    createTime String
    (Available since v1.254.0) The time when the access permissions were assigned.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AccessManagement Resource

    Get an existing AccessManagement resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AccessManagementState, opts?: CustomResourceOptions): AccessManagement
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_configuration_id: Optional[str] = None,
        create_time: Optional[str] = None,
        deprovision_strategy: Optional[str] = None,
        directory_id: Optional[str] = None,
        principal_id: Optional[str] = None,
        principal_type: Optional[str] = None,
        target_id: Optional[str] = None,
        target_type: Optional[str] = None) -> AccessManagement
    func GetAccessManagement(ctx *Context, name string, id IDInput, state *AccessManagementState, opts ...ResourceOption) (*AccessManagement, error)
    public static AccessManagement Get(string name, Input<string> id, AccessManagementState? state, CustomResourceOptions? opts = null)
    public static AccessManagement get(String name, Output<String> id, AccessManagementState state, CustomResourceOptions options)
    resources:  _:    type: alicloud:cloudsso:AccessManagement    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessConfigurationId string
    The ID of the access configuration.
    CreateTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    DeprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    DirectoryId string
    The ID of the Directory.
    PrincipalId string
    The ID of the CloudSSO identity.
    PrincipalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    TargetId string
    The ID of the task object.
    TargetType string
    The type of the task object. Valid values: RD-Account.
    AccessConfigurationId string
    The ID of the access configuration.
    CreateTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    DeprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    DirectoryId string
    The ID of the Directory.
    PrincipalId string
    The ID of the CloudSSO identity.
    PrincipalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    TargetId string
    The ID of the task object.
    TargetType string
    The type of the task object. Valid values: RD-Account.
    accessConfigurationId String
    The ID of the access configuration.
    createTime String
    (Available since v1.254.0) The time when the access permissions were assigned.
    deprovisionStrategy String
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    directoryId String
    The ID of the Directory.
    principalId String
    The ID of the CloudSSO identity.
    principalType String
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId String
    The ID of the task object.
    targetType String
    The type of the task object. Valid values: RD-Account.
    accessConfigurationId string
    The ID of the access configuration.
    createTime string
    (Available since v1.254.0) The time when the access permissions were assigned.
    deprovisionStrategy string
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    directoryId string
    The ID of the Directory.
    principalId string
    The ID of the CloudSSO identity.
    principalType string
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId string
    The ID of the task object.
    targetType string
    The type of the task object. Valid values: RD-Account.
    access_configuration_id str
    The ID of the access configuration.
    create_time str
    (Available since v1.254.0) The time when the access permissions were assigned.
    deprovision_strategy str
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    directory_id str
    The ID of the Directory.
    principal_id str
    The ID of the CloudSSO identity.
    principal_type str
    The type of the CloudSSO identity. Valid values: User, Group.
    target_id str
    The ID of the task object.
    target_type str
    The type of the task object. Valid values: RD-Account.
    accessConfigurationId String
    The ID of the access configuration.
    createTime String
    (Available since v1.254.0) The time when the access permissions were assigned.
    deprovisionStrategy String
    Specifies whether to de-provision the access configuration when you remove the access permissions from the CloudSSO identity. Valid values: DeprovisionForLastAccessAssignmentOnAccount and None. Default Value: DeprovisionForLastAccessAssignmentOnAccount. NOTE: When deprovision_strategy is DeprovisionForLastAccessAssignmentOnAccount, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation.
    directoryId String
    The ID of the Directory.
    principalId String
    The ID of the CloudSSO identity.
    principalType String
    The type of the CloudSSO identity. Valid values: User, Group.
    targetId String
    The ID of the task object.
    targetType String
    The type of the task object. Valid values: RD-Account.

    Import

    Cloud SSO Access Assignment can be imported using the id, e.g.

    $ pulumi import alicloud:cloudsso/accessManagement:AccessManagement example <directory_id>:<access_configuration_id>:<target_type>:<target_id>:<principal_type>:<principal_id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Alibaba Cloud pulumi/pulumi-alicloud
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the alicloud Terraform Provider.
    alicloud logo
    Alibaba Cloud v3.83.0 published on Monday, Jul 21, 2025 by Pulumi
    pulumi/pulumi-alicloud