confluentcloud.ServiceAccount

confluentcloud.ServiceAccount provides a Service Account resource that enables creating, editing, and deleting service accounts on Confluent Cloud.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as confluentcloud from "@pulumi/confluentcloud";

const example_sa = new confluentcloud.ServiceAccount("example-sa", {
    displayName: "orders-app-sa",
    description: "Service Account for orders app",
});

import pulumi
import pulumi_confluentcloud as confluentcloud

example_sa = confluentcloud.ServiceAccount("example-sa",
    display_name="orders-app-sa",
    description="Service Account for orders app")

package main

import (
	"github.com/pulumi/pulumi-confluentcloud/sdk/v2/go/confluentcloud"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := confluentcloud.NewServiceAccount(ctx, "example-sa", &confluentcloud.ServiceAccountArgs{
			DisplayName: pulumi.String("orders-app-sa"),
			Description: pulumi.String("Service Account for orders app"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using ConfluentCloud = Pulumi.ConfluentCloud;

return await Deployment.RunAsync(() => 
{
    var example_sa = new ConfluentCloud.ServiceAccount("example-sa", new()
    {
        DisplayName = "orders-app-sa",
        Description = "Service Account for orders app",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.confluentcloud.ServiceAccount;
import com.pulumi.confluentcloud.ServiceAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example_sa = new ServiceAccount("example-sa", ServiceAccountArgs.builder()
            .displayName("orders-app-sa")
            .description("Service Account for orders app")
            .build());

    }
}

resources:
  example-sa:
    type: confluentcloud:ServiceAccount
    properties:
      displayName: orders-app-sa
      description: Service Account for orders app

pulumi {
  required_providers {
    confluentcloud = {
      source = "pulumi/confluentcloud"
    }
  }
}

resource "confluentcloud_serviceaccount" "example-sa" {
  display_name = "orders-app-sa"
  description  = "Service Account for orders app"
}

Getting Started

The following end-to-end examples might help to get started with confluentcloud.ServiceAccount resource:

• basic-kafka-acls: Basic Kafka cluster with authorization using ACLs
• basic-kafka-acls-with-alias: Basic Kafka cluster with authorization using ACLs
• standard-kafka-acls: Standard Kafka cluster with authorization using ACLs
• standard-kafka-rbac: Standard Kafka cluster with authorization using RBAC
• dedicated-public-kafka-acls: Dedicated Kafka cluster that is accessible over the public internet with authorization using ACLs
• dedicated-public-kafka-rbac: Dedicated Kafka cluster that is accessible over the public internet with authorization using RBAC
• dedicated-privatelink-aws-kafka-acls: Dedicated Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using ACLs
• dedicated-privatelink-aws-kafka-rbac: Dedicated Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using RBAC
• dedicated-privatelink-azure-kafka-rbac: Dedicated Kafka cluster on Azure that is accessible via PrivateLink connections with authorization using RBAC
• dedicated-privatelink-azure-kafka-acls: Dedicated Kafka cluster on Azure that is accessible via PrivateLink connections with authorization using ACLs
• dedicated-private-service-connect-gcp-kafka-acls: Dedicated Kafka cluster on GCP that is accessible via Private Service Connect connections with authorization using ACLs
• dedicated-private-service-connect-gcp-kafka-rbac: Dedicated Kafka cluster on GCP that is accessible via Private Service Connect connections with authorization using RBAC
• dedicated-vnet-peering-azure-kafka-acls: Dedicated Kafka cluster on Azure that is accessible via VPC Peering connections with authorization using ACLs
• dedicated-vnet-peering-azure-kafka-rbac: Dedicated Kafka cluster on Azure that is accessible via VPC Peering connections with authorization using RBAC
• dedicated-vpc-peering-aws-kafka-acls: Dedicated Kafka cluster on AWS that is accessible via VPC Peering connections with authorization using ACLs
• dedicated-vpc-peering-aws-kafka-rbac: Dedicated Kafka cluster on AWS that is accessible via VPC Peering connections with authorization using RBAC
• dedicated-vpc-peering-gcp-kafka-acls: Dedicated Kafka cluster on GCP that is accessible via VPC Peering connections with authorization using ACLs
• dedicated-vpc-peering-gcp-kafka-rbac: Dedicated Kafka cluster on GCP that is accessible via VPC Peering connections with authorization using RBAC
• dedicated-transit-gateway-attachment-aws-kafka-acls: Dedicated Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using ACLs
• dedicated-transit-gateway-attachment-aws-kafka-rbac: Dedicated Kafka cluster on AWS that is accessible via Transit Gateway Endpoint with authorization using RBAC
• enterprise-privatelinkattachment-aws-kafka-acls: Enterprise Kafka cluster on AWS that is accessible via PrivateLink connections with authorization using ACLs

Create ServiceAccount Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ServiceAccount(name: string, args?: ServiceAccountArgs, opts?: CustomResourceOptions);

@overload
def ServiceAccount(resource_name: str,
                   args: Optional[ServiceAccountArgs] = None,
                   opts: Optional[ResourceOptions] = None)

@overload
def ServiceAccount(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   assigned_resource_owner: Optional[str] = None,
                   description: Optional[str] = None,
                   display_name: Optional[str] = None)

func NewServiceAccount(ctx *Context, name string, args *ServiceAccountArgs, opts ...ResourceOption) (*ServiceAccount, error)

public ServiceAccount(string name, ServiceAccountArgs? args = null, CustomResourceOptions? opts = null)

public ServiceAccount(String name, ServiceAccountArgs args)
public ServiceAccount(String name, ServiceAccountArgs args, CustomResourceOptions options)

type: confluentcloud:ServiceAccount
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "confluentcloud_service_account" "name" {
    # resource properties
}

Parameters

Constructor example

The following reference example uses placeholder values for all input properties.

var serviceAccountResource = new ConfluentCloud.ServiceAccount("serviceAccountResource", new()
{
    AssignedResourceOwner = "string",
    Description = "string",
    DisplayName = "string",
});

example, err := confluentcloud.NewServiceAccount(ctx, "serviceAccountResource", &confluentcloud.ServiceAccountArgs{
	AssignedResourceOwner: pulumi.String("string"),
	Description:           pulumi.String("string"),
	DisplayName:           pulumi.String("string"),
})

resource "confluentcloud_service_account" "serviceAccountResource" {
  lifecycle {
    create_before_destroy = true
  }
  assigned_resource_owner = "string"
  description             = "string"
  display_name            = "string"
}

var serviceAccountResource = new ServiceAccount("serviceAccountResource", ServiceAccountArgs.builder()
    .assignedResourceOwner("string")
    .description("string")
    .displayName("string")
    .build());

service_account_resource = confluentcloud.ServiceAccount("serviceAccountResource",
    assigned_resource_owner="string",
    description="string",
    display_name="string")

const serviceAccountResource = new confluentcloud.ServiceAccount("serviceAccountResource", {
    assignedResourceOwner: "string",
    description: "string",
    displayName: "string",
});

type: confluentcloud:ServiceAccount
properties:
    assignedResourceOwner: string
    description: string
    displayName: string

ServiceAccount Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The ServiceAccount resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the ServiceAccount resource produces the following output properties:

Look up Existing ServiceAccount Resource

Get an existing ServiceAccount resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ServiceAccountState, opts?: CustomResourceOptions): ServiceAccount

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        api_version: Optional[str] = None,
        assigned_resource_owner: Optional[str] = None,
        description: Optional[str] = None,
        display_name: Optional[str] = None,
        kind: Optional[str] = None) -> ServiceAccount

func GetServiceAccount(ctx *Context, name string, id IDInput, state *ServiceAccountState, opts ...ResourceOption) (*ServiceAccount, error)

public static ServiceAccount Get(string name, Input<string> id, ServiceAccountState? state, CustomResourceOptions? opts = null)

public static ServiceAccount get(String name, Output<String> id, ServiceAccountState state, CustomResourceOptions options)

resources:  _:    type: confluentcloud:ServiceAccount    get:      id: ${id}

import {
  to = confluentcloud_service_account.example
  id = "${id}"
}

Import

Note: CONFLUENT_CLOUD_API_KEY and CONFLUENT_CLOUD_API_SECRET environment variables must be set before importing a Service Account.

Note: If your configuration sets assignedResourceOwner, set the IMPORT_SERVICE_ACCOUNT_ASSIGNED_RESOURCE_OWNER environment variable to that same value before importing. The API never returns it, so without it the attribute is empty in imported state and the first plan after importing will want to replace the Service Account. The variable applies to every Service Account imported in the same run, so import ones with different values in separate runs. Terraform cannot verify the value you supply.

You can import a Service Account by using Service Account ID, for example:

$ export CONFLUENT_CLOUD_API_KEY="<cloud_api_key>"
$ export CONFLUENT_CLOUD_API_SECRET="<cloud_api_secret>"

Only if your configuration sets assigned_resource_owner:

$ export IMPORT_SERVICE_ACCOUNT_ASSIGNED_RESOURCE_OWNER="<assigned_resource_owner>"
$ pulumi import confluentcloud:index/serviceAccount:ServiceAccount my_sa sa-abc123

To add assignedResourceOwner to a Service Account that Terraform already manages, re-import the Service Account. Adding the attribute to its configuration alone plans a replacement:

1. Add assignedResourceOwner to the Service Account’s configuration.
2. Remove the Service Account from Terraform state. This does not delete it.

$ terraform state rm confluent_service_account.my_sa

3. With the credentials above still exported, import it again with the variable set to the configured value.

$ export IMPORT_SERVICE_ACCOUNT_ASSIGNED_RESOURCE_OWNER="<assigned_resource_owner>"
$ pulumi import confluentcloud:index/serviceAccount:ServiceAccount my_sa sa-abc123

4. Confirm that the plan shows no changes.

$ pulumi preview

Re-importing only records the value in Terraform state; it does not grant ownership. Set it to the principal that already owns the Service Account, for example the one assigned when the Service Account was created outside Terraform.

Warning: Do not forget to delete terminal command history afterwards for security purposes.

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository

Confluent Cloud pulumi/pulumi-confluentcloud

License

Apache-2.0

Notes

This Pulumi package is based on the confluent Terraform Provider.