Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Datadog Provider
  4. API Docs
  5. GithubOidcIdentityMapping
Viewing docs for Datadog v5.20.0
published on Wednesday, Nov 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

datadog.GithubOidcIdentityMapping

datadog logo
Viewing docs for Datadog v5.20.0
published on Wednesday, Nov 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-datadog

    Provides a GitHub Actions OIDC identity mapping (called a persona mapping in the Datadog API) for Datadog workload identity federation. The mapping allows a GitHub Actions workload whose OIDC token matches the claimMatchers patterns to authenticate as the Datadog user or service account identified by accountIdentifier. The identity creating the mapping must have every permission assigned to the target identity. Creating the initial mapping requires API and application credentials with the Workload Identity Federation write permission; a provider already using federation cannot bootstrap its own mapping. Mappings cannot be updated; changing any attribute replaces the mapping. This resource uses a public beta API and is subject to change.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

const readOnly = datadog.getRole({
    filter: "Datadog Read Only Role",
});
const terraform = new datadog.ServiceAccount("terraform", {
    email: "terraform-service-account@example.com",
    name: "Terraform service account",
    roles: [readOnly.then(readOnly => readOnly.id)],
});
const terraformGithubOidcIdentityMapping = new datadog.GithubOidcIdentityMapping("terraform", {
    accountIdentifier: terraform.id,
    claimMatchers: [{
        sub: "repo:my-org/terraform:ref:refs/heads/main",
        repository: "^my-org/terraform$",
    }],
});

    import pulumi
import pulumi_datadog as datadog

read_only = datadog.get_role(filter="Datadog Read Only Role")
terraform = datadog.ServiceAccount("terraform",
    email="terraform-service-account@example.com",
    name="Terraform service account",
    roles=[read_only.id])
terraform_github_oidc_identity_mapping = datadog.GithubOidcIdentityMapping("terraform",
    account_identifier=terraform.id,
    claim_matchers=[{
        "sub": "repo:my-org/terraform:ref:refs/heads/main",
        "repository": "^my-org/terraform$",
    }])

    package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v5/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		readOnly, err := datadog.GetRole(ctx, &datadog.LookupRoleArgs{
			Filter: "Datadog Read Only Role",
		}, nil)
		if err != nil {
			return err
		}
		terraform, err := datadog.NewServiceAccount(ctx, "terraform", &datadog.ServiceAccountArgs{
			Email: pulumi.String("terraform-service-account@example.com"),
			Name:  pulumi.String("Terraform service account"),
			Roles: pulumi.StringArray{
				pulumi.String(readOnly.Id),
			},
		})
		if err != nil {
			return err
		}
		_, err = datadog.NewGithubOidcIdentityMapping(ctx, "terraform", &datadog.GithubOidcIdentityMappingArgs{
			AccountIdentifier: terraform.ID(),
			ClaimMatchers: datadog.GithubOidcIdentityMappingClaimMatchersArgs{
				map[string]string{
					"sub":        "repo:my-org/terraform:ref:refs/heads/main",
					"repository": "^my-org/terraform$",
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    var readOnly = Datadog.GetRole.Invoke(new()
    {
        Filter = "Datadog Read Only Role",
    });

    var terraform = new Datadog.ServiceAccount("terraform", new()
    {
        Email = "terraform-service-account@example.com",
        Name = "Terraform service account",
        Roles = new[]
        {
            readOnly.Apply(getRoleResult => getRoleResult.Id),
        },
    });

    var terraformGithubOidcIdentityMapping = new Datadog.GithubOidcIdentityMapping("terraform", new()
    {
        AccountIdentifier = terraform.Id,
        ClaimMatchers = new[]
        {
            
            {
                { "sub", "repo:my-org/terraform:ref:refs/heads/main" },
                { "repository", "^my-org/terraform$" },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.DatadogFunctions;
import com.pulumi.datadog.inputs.GetRoleArgs;
import com.pulumi.datadog.ServiceAccount;
import com.pulumi.datadog.ServiceAccountArgs;
import com.pulumi.datadog.GithubOidcIdentityMapping;
import com.pulumi.datadog.GithubOidcIdentityMappingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var readOnly = DatadogFunctions.getRole(GetRoleArgs.builder()
            .filter("Datadog Read Only Role")
            .build());

        var terraform = new ServiceAccount("terraform", ServiceAccountArgs.builder()
            .email("terraform-service-account@example.com")
            .name("Terraform service account")
            .roles(readOnly.id())
            .build());

        var terraformGithubOidcIdentityMapping = new GithubOidcIdentityMapping("terraformGithubOidcIdentityMapping", GithubOidcIdentityMappingArgs.builder()
            .accountIdentifier(terraform.id())
            .claimMatchers(com.pulumi.datadog.inputs.GithubOidcIdentityMappingClaimMatchersArgs.builder()
                .sub("repo:my-org/terraform:ref:refs/heads/main")
                .repository("^my-org/terraform$")
                .build())
            .build());

    }
}

    resources:
  terraform:
    type: datadog:ServiceAccount
    properties:
      email: terraform-service-account@example.com
      name: Terraform service account
      roles:
        - ${readOnly.id}
  terraformGithubOidcIdentityMapping:
    type: datadog:GithubOidcIdentityMapping
    name: terraform
    properties:
      accountIdentifier: ${terraform.id}
      claimMatchers:
        - sub: repo:my-org/terraform:ref:refs/heads/main
          repository: ^my-org/terraform$
variables:
  readOnly:
    fn::invoke:
      function: datadog:getRole
      arguments:
        filter: Datadog Read Only Role

    terraform {
  required_providers {
    datadog = {
      source = "pulumi/datadog"
    }
  }
}

data "datadog_role" "readOnly" {
  filter = "Datadog Read Only Role"
}

resource "datadog_service_account" "terraform" {
  lifecycle {
    create_before_destroy = true
  }
  email = "terraform-service-account@example.com"
  name  = "Terraform service account"
  roles = [data.datadog_role.readOnly.id]
}
resource "datadog_github_oidc_identity_mapping" "terraform" {
  lifecycle {
    create_before_destroy = true
  }
  account_identifier = datadog_service_account.terraform.id
  claim_matchers = [{
    "sub"        = "repo:my-org/terraform:ref:refs/heads/main"
    "repository" = "^my-org/terraform$"
  }]
}

    Create GithubOidcIdentityMapping Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GithubOidcIdentityMapping(name: string, args: GithubOidcIdentityMappingArgs, opts?: CustomResourceOptions);
    @overload
def GithubOidcIdentityMapping(resource_name: str,
                              args: GithubOidcIdentityMappingArgs,
                              opts: Optional[ResourceOptions] = None)

@overload
def GithubOidcIdentityMapping(resource_name: str,
                              opts: Optional[ResourceOptions] = None,
                              account_identifier: Optional[str] = None,
                              claim_matchers: Optional[GithubOidcIdentityMappingClaimMatchersArgs] = None)
    func NewGithubOidcIdentityMapping(ctx *Context, name string, args GithubOidcIdentityMappingArgs, opts ...ResourceOption) (*GithubOidcIdentityMapping, error)
    public GithubOidcIdentityMapping(string name, GithubOidcIdentityMappingArgs args, CustomResourceOptions? opts = null)
    public GithubOidcIdentityMapping(String name, GithubOidcIdentityMappingArgs args)
public GithubOidcIdentityMapping(String name, GithubOidcIdentityMappingArgs args, CustomResourceOptions options)

    type: datadog:GithubOidcIdentityMapping
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "datadog_github_oidc_identity_mapping" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GithubOidcIdentityMappingArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GithubOidcIdentityMappingArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GithubOidcIdentityMappingArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GithubOidcIdentityMappingArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GithubOidcIdentityMappingArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var githubOidcIdentityMappingResource = new Datadog.GithubOidcIdentityMapping("githubOidcIdentityMappingResource", new()
{
    AccountIdentifier = "string",
    ClaimMatchers = new Datadog.Inputs.GithubOidcIdentityMappingClaimMatchersArgs
    {
        Sub = "string",
        RefType = "string",
        RepositoryId = "string",
        EnterpriseId = "string",
        Environment = "string",
        EventName = "string",
        JobWorkflowRef = "string",
        Ref = "string",
        Actor = "string",
        Enterprise = "string",
        RepositoryOwner = "string",
        Repository = "string",
        RepositoryOwnerId = "string",
        RepositoryVisibility = "string",
        RunnerEnvironment = "string",
        ActorId = "string",
        Workflow = "string",
        WorkflowRef = "string",
    },
});

    example, err := datadog.NewGithubOidcIdentityMapping(ctx, "githubOidcIdentityMappingResource", &datadog.GithubOidcIdentityMappingArgs{
	AccountIdentifier: pulumi.String("string"),
	ClaimMatchers: &datadog.GithubOidcIdentityMappingClaimMatchersArgs{
		Sub:                  pulumi.String("string"),
		RefType:              pulumi.String("string"),
		RepositoryId:         pulumi.String("string"),
		EnterpriseId:         pulumi.String("string"),
		Environment:          pulumi.String("string"),
		EventName:            pulumi.String("string"),
		JobWorkflowRef:       pulumi.String("string"),
		Ref:                  pulumi.String("string"),
		Actor:                pulumi.String("string"),
		Enterprise:           pulumi.String("string"),
		RepositoryOwner:      pulumi.String("string"),
		Repository:           pulumi.String("string"),
		RepositoryOwnerId:    pulumi.String("string"),
		RepositoryVisibility: pulumi.String("string"),
		RunnerEnvironment:    pulumi.String("string"),
		ActorId:              pulumi.String("string"),
		Workflow:             pulumi.String("string"),
		WorkflowRef:          pulumi.String("string"),
	},
})

    resource "datadog_github_oidc_identity_mapping" "githubOidcIdentityMappingResource" {
  lifecycle {
    create_before_destroy = true
  }
  account_identifier = "string"
  claim_matchers = {
    sub                   = "string"
    ref_type              = "string"
    repository_id         = "string"
    enterprise_id         = "string"
    environment           = "string"
    event_name            = "string"
    job_workflow_ref      = "string"
    ref                   = "string"
    actor                 = "string"
    enterprise            = "string"
    repository_owner      = "string"
    repository            = "string"
    repository_owner_id   = "string"
    repository_visibility = "string"
    runner_environment    = "string"
    actor_id              = "string"
    workflow              = "string"
    workflow_ref          = "string"
  }
}

    var githubOidcIdentityMappingResource = new GithubOidcIdentityMapping("githubOidcIdentityMappingResource", GithubOidcIdentityMappingArgs.builder()
    .accountIdentifier("string")
    .claimMatchers(GithubOidcIdentityMappingClaimMatchersArgs.builder()
        .sub("string")
        .refType("string")
        .repositoryId("string")
        .enterpriseId("string")
        .environment("string")
        .eventName("string")
        .jobWorkflowRef("string")
        .ref("string")
        .actor("string")
        .enterprise("string")
        .repositoryOwner("string")
        .repository("string")
        .repositoryOwnerId("string")
        .repositoryVisibility("string")
        .runnerEnvironment("string")
        .actorId("string")
        .workflow("string")
        .workflowRef("string")
        .build())
    .build());

    github_oidc_identity_mapping_resource = datadog.GithubOidcIdentityMapping("githubOidcIdentityMappingResource",
    account_identifier="string",
    claim_matchers={
        "sub": "string",
        "ref_type": "string",
        "repository_id": "string",
        "enterprise_id": "string",
        "environment": "string",
        "event_name": "string",
        "job_workflow_ref": "string",
        "ref": "string",
        "actor": "string",
        "enterprise": "string",
        "repository_owner": "string",
        "repository": "string",
        "repository_owner_id": "string",
        "repository_visibility": "string",
        "runner_environment": "string",
        "actor_id": "string",
        "workflow": "string",
        "workflow_ref": "string",
    })

    const githubOidcIdentityMappingResource = new datadog.GithubOidcIdentityMapping("githubOidcIdentityMappingResource", {
    accountIdentifier: "string",
    claimMatchers: {
        sub: "string",
        refType: "string",
        repositoryId: "string",
        enterpriseId: "string",
        environment: "string",
        eventName: "string",
        jobWorkflowRef: "string",
        ref: "string",
        actor: "string",
        enterprise: "string",
        repositoryOwner: "string",
        repository: "string",
        repositoryOwnerId: "string",
        repositoryVisibility: "string",
        runnerEnvironment: "string",
        actorId: "string",
        workflow: "string",
        workflowRef: "string",
    },
});

    type: datadog:GithubOidcIdentityMapping
properties:
    accountIdentifier: string
    claimMatchers:
        actor: string
        actorId: string
        enterprise: string
        enterpriseId: string
        environment: string
        eventName: string
        jobWorkflowRef: string
        ref: string
        refType: string
        repository: string
        repositoryId: string
        repositoryOwner: string
        repositoryOwnerId: string
        repositoryVisibility: string
        runnerEnvironment: string
        sub: string
        workflow: string
        workflowRef: string

    GithubOidcIdentityMapping Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GithubOidcIdentityMapping resource accepts the following input properties:

    AccountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    ClaimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    AccountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    ClaimMatchers GithubOidcIdentityMappingClaimMatchersArgs
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    account_identifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    claim_matchers object
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier String
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    claimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    claimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    account_identifier str
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    claim_matchers GithubOidcIdentityMappingClaimMatchersArgs
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier String
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    claimMatchers Property Map
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GithubOidcIdentityMapping resource produces the following output properties:

    AccountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    Id string
    The provider-assigned unique ID for this managed resource.
    AccountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    Id string
    The provider-assigned unique ID for this managed resource.
    account_uuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    id string
    The provider-assigned unique ID for this managed resource.
    accountUuid String
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    id String
    The provider-assigned unique ID for this managed resource.
    accountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    id string
    The provider-assigned unique ID for this managed resource.
    account_uuid str
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    id str
    The provider-assigned unique ID for this managed resource.
    accountUuid String
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing GithubOidcIdentityMapping Resource

    Get an existing GithubOidcIdentityMapping resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GithubOidcIdentityMappingState, opts?: CustomResourceOptions): GithubOidcIdentityMapping
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_identifier: Optional[str] = None,
        account_uuid: Optional[str] = None,
        claim_matchers: Optional[GithubOidcIdentityMappingClaimMatchersArgs] = None) -> GithubOidcIdentityMapping
    func GetGithubOidcIdentityMapping(ctx *Context, name string, id IDInput, state *GithubOidcIdentityMappingState, opts ...ResourceOption) (*GithubOidcIdentityMapping, error)
    public static GithubOidcIdentityMapping Get(string name, Input<string> id, GithubOidcIdentityMappingState? state, CustomResourceOptions? opts = null)
    public static GithubOidcIdentityMapping get(String name, Output<String> id, GithubOidcIdentityMappingState state, CustomResourceOptions options)
    resources:  _:    type: datadog:GithubOidcIdentityMapping    get:      id: ${id}
    import {
  to = datadog_github_oidc_identity_mapping.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    AccountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    ClaimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    AccountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    AccountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    ClaimMatchers GithubOidcIdentityMappingClaimMatchersArgs
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    account_identifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    account_uuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    claim_matchers object
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier String
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    accountUuid String
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    claimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier string
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    accountUuid string
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    claimMatchers GithubOidcIdentityMappingClaimMatchers
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    account_identifier str
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    account_uuid str
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    claim_matchers GithubOidcIdentityMappingClaimMatchersArgs
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
    accountIdentifier String
    The email or handle of the Datadog user or service account that the GitHub workload authenticates as. For a Terraform-managed service account, prefer the stable UUID exported by datadog_service_account.id; Datadog accepts it as the service account identifier. Datadog normalizes an email to the account's handle, so the handle form is the only value that survives pulumi import unchanged — importing a mapping configured by email produces a diff on this attribute, which forces replacement. String length must be at least 1.
    accountUuid String
    The UUID of the Datadog user or service account resolved from accountIdentifier.
    claimMatchers Property Map
    GitHub Actions OIDC claims to match against. Each argument is a regular expression; sub is required and all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).

    Supporting Types

    GithubOidcIdentityMappingClaimMatchers, GithubOidcIdentityMappingClaimMatchersArgs

    Sub string
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    Actor string
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    ActorId string
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    Enterprise string
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    EnterpriseId string
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    Environment string
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    EventName string
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    JobWorkflowRef string
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    Ref string
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    RefType string
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    Repository string
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryId string
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryOwner string
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryOwnerId string
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryVisibility string
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    RunnerEnvironment string
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    Workflow string
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    WorkflowRef string
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    Sub string
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    Actor string
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    ActorId string
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    Enterprise string
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    EnterpriseId string
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    Environment string
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    EventName string
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    JobWorkflowRef string
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    Ref string
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    RefType string
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    Repository string
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryId string
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryOwner string
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryOwnerId string
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    RepositoryVisibility string
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    RunnerEnvironment string
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    Workflow string
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    WorkflowRef string
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    sub string
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    actor string
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    actor_id string
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise string
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise_id string
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    environment string
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    event_name string
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    job_workflow_ref string
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref string
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref_type string
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository string
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_id string
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_owner string
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_owner_id string
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_visibility string
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    runner_environment string
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow string
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow_ref string
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    sub String
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    actor String
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    actorId String
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise String
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterpriseId String
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    environment String
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    eventName String
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    jobWorkflowRef String
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref String
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    refType String
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository String
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryId String
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwner String
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwnerId String
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryVisibility String
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    runnerEnvironment String
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow String
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflowRef String
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    sub string
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    actor string
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    actorId string
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise string
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterpriseId string
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    environment string
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    eventName string
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    jobWorkflowRef string
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref string
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    refType string
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository string
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryId string
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwner string
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwnerId string
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryVisibility string
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    runnerEnvironment string
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow string
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflowRef string
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    sub str
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    actor str
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    actor_id str
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise str
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise_id str
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    environment str
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    event_name str
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    job_workflow_ref str
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref str
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref_type str
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository str
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_id str
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_owner str
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_owner_id str
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository_visibility str
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    runner_environment str
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow str
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow_ref str
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    sub String
    Regular expression matched against the required sub claim of the GitHub Actions OIDC token. It must start with the literal repo:<OWNER>/ prefix; the owner cannot be a regex. String length must be at least 1.
    actor String
    Regular expression matched against the actor claim of the GitHub Actions OIDC token. String length must be at least 1.
    actorId String
    Regular expression matched against the actorId claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterprise String
    Regular expression matched against the enterprise claim of the GitHub Actions OIDC token. String length must be at least 1.
    enterpriseId String
    Regular expression matched against the enterpriseId claim of the GitHub Actions OIDC token. String length must be at least 1.
    environment String
    Regular expression matched against the environment claim of the GitHub Actions OIDC token. String length must be at least 1.
    eventName String
    Regular expression matched against the eventName claim of the GitHub Actions OIDC token. String length must be at least 1.
    jobWorkflowRef String
    Regular expression matched against the jobWorkflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.
    ref String
    Regular expression matched against the ref claim of the GitHub Actions OIDC token. String length must be at least 1.
    refType String
    Regular expression matched against the refType claim of the GitHub Actions OIDC token. String length must be at least 1.
    repository String
    Regular expression matched against the repository claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryId String
    Regular expression matched against the repositoryId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwner String
    Regular expression matched against the repositoryOwner claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryOwnerId String
    Regular expression matched against the repositoryOwnerId claim of the GitHub Actions OIDC token. String length must be at least 1.
    repositoryVisibility String
    Regular expression matched against the repositoryVisibility claim of the GitHub Actions OIDC token. String length must be at least 1.
    runnerEnvironment String
    Regular expression matched against the runnerEnvironment claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflow String
    Regular expression matched against the workflow claim of the GitHub Actions OIDC token. String length must be at least 1.
    workflowRef String
    Regular expression matched against the workflowRef claim of the GitHub Actions OIDC token. String length must be at least 1.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import datadog:index/githubOidcIdentityMapping:GithubOidcIdentityMapping terraform "00000000-0000-0000-0000-000000000000"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Datadog pulumi/pulumi-datadog
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the datadog Terraform Provider.
    datadog logo
    Viewing docs for Datadog v5.20.0
    published on Wednesday, Nov 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-datadog

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial