Google Cloud Classic v6.57.0, May 30 23

gcp.accessapproval.getProjectServiceAccount

Explore with Pulumi AI

Get the email address of a project’s Access Approval service account.

Each Google Cloud project has a unique service account used by Access Approval. When using Access Approval with a custom signing key, this account needs to be granted the cloudkms.signerVerifier IAM role on the Cloud KMS key used to sign approvals.

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var serviceAccount = Gcp.AccessApproval.GetProjectServiceAccount.Invoke(new()
    {
        ProjectId = "my-project",
    });

    var iam = new Gcp.Kms.CryptoKeyIAMMember("iam", new()
    {
        CryptoKeyId = google_kms_crypto_key.Crypto_key.Id,
        Role = "roles/cloudkms.signerVerifier",
        Member = $"serviceAccount:{serviceAccount.Apply(getProjectServiceAccountResult => getProjectServiceAccountResult.AccountEmail)}",
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/accessapproval"
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		serviceAccount, err := accessapproval.GetProjectServiceAccount(ctx, &accessapproval.GetProjectServiceAccountArgs{
			ProjectId: "my-project",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewCryptoKeyIAMMember(ctx, "iam", &kms.CryptoKeyIAMMemberArgs{
			CryptoKeyId: pulumi.Any(google_kms_crypto_key.Crypto_key.Id),
			Role:        pulumi.String("roles/cloudkms.signerVerifier"),
			Member:      pulumi.String(fmt.Sprintf("serviceAccount:%v", serviceAccount.AccountEmail)),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.accessapproval.AccessapprovalFunctions;
import com.pulumi.gcp.accessapproval.inputs.GetProjectServiceAccountArgs;
import com.pulumi.gcp.kms.CryptoKeyIAMMember;
import com.pulumi.gcp.kms.CryptoKeyIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var serviceAccount = AccessapprovalFunctions.getProjectServiceAccount(GetProjectServiceAccountArgs.builder()
            .projectId("my-project")
            .build());

        var iam = new CryptoKeyIAMMember("iam", CryptoKeyIAMMemberArgs.builder()        
            .cryptoKeyId(google_kms_crypto_key.crypto_key().id())
            .role("roles/cloudkms.signerVerifier")
            .member(String.format("serviceAccount:%s", serviceAccount.applyValue(getProjectServiceAccountResult -> getProjectServiceAccountResult.accountEmail())))
            .build());

    }
}

import pulumi
import pulumi_gcp as gcp

service_account = gcp.accessapproval.get_project_service_account(project_id="my-project")
iam = gcp.kms.CryptoKeyIAMMember("iam",
    crypto_key_id=google_kms_crypto_key["crypto_key"]["id"],
    role="roles/cloudkms.signerVerifier",
    member=f"serviceAccount:{service_account.account_email}")

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const serviceAccount = gcp.accessapproval.getProjectServiceAccount({
    projectId: "my-project",
});
const iam = new gcp.kms.CryptoKeyIAMMember("iam", {
    cryptoKeyId: google_kms_crypto_key.crypto_key.id,
    role: "roles/cloudkms.signerVerifier",
    member: serviceAccount.then(serviceAccount => `serviceAccount:${serviceAccount.accountEmail}`),
});

resources:
  iam:
    type: gcp:kms:CryptoKeyIAMMember
    properties:
      cryptoKeyId: ${google_kms_crypto_key.crypto_key.id}
      role: roles/cloudkms.signerVerifier
      member: serviceAccount:${serviceAccount.accountEmail}
variables:
  serviceAccount:
    fn::invoke:
      Function: gcp:accessapproval:getProjectServiceAccount
      Arguments:
        projectId: my-project

Using getProjectServiceAccount

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getProjectServiceAccount(args: GetProjectServiceAccountArgs, opts?: InvokeOptions): Promise<GetProjectServiceAccountResult>
function getProjectServiceAccountOutput(args: GetProjectServiceAccountOutputArgs, opts?: InvokeOptions): Output<GetProjectServiceAccountResult>

def get_project_service_account(project_id: Optional[str] = None,
                                opts: Optional[InvokeOptions] = None) -> GetProjectServiceAccountResult
def get_project_service_account_output(project_id: Optional[pulumi.Input[str]] = None,
                                opts: Optional[InvokeOptions] = None) -> Output[GetProjectServiceAccountResult]

func GetProjectServiceAccount(ctx *Context, args *GetProjectServiceAccountArgs, opts ...InvokeOption) (*GetProjectServiceAccountResult, error)
func GetProjectServiceAccountOutput(ctx *Context, args *GetProjectServiceAccountOutputArgs, opts ...InvokeOption) GetProjectServiceAccountResultOutput

> Note: This function is named GetProjectServiceAccount in the Go SDK.

public static class GetProjectServiceAccount 
{
    public static Task<GetProjectServiceAccountResult> InvokeAsync(GetProjectServiceAccountArgs args, InvokeOptions? opts = null)
    public static Output<GetProjectServiceAccountResult> Invoke(GetProjectServiceAccountInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetProjectServiceAccountResult> getProjectServiceAccount(GetProjectServiceAccountArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet

fn::invoke:
  function: gcp:accessapproval/getProjectServiceAccount:getProjectServiceAccount
  arguments:
    # arguments dictionary

The following arguments are supported:

ProjectId string: The project ID the service account was created for.

ProjectId string: The project ID the service account was created for.

projectId String: The project ID the service account was created for.

projectId string: The project ID the service account was created for.

project_id str: The project ID the service account was created for.

projectId String: The project ID the service account was created for.

getProjectServiceAccount Result

The following output properties are available:

AccountEmail string: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
Id string: The provider-assigned unique ID for this managed resource.
Name string: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
ProjectId string

AccountEmail string: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
Id string: The provider-assigned unique ID for this managed resource.
Name string: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
ProjectId string

accountEmail String: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
id String: The provider-assigned unique ID for this managed resource.
name String: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
projectId String

accountEmail string: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
id string: The provider-assigned unique ID for this managed resource.
name string: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
projectId string

account_email str: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
id str: The provider-assigned unique ID for this managed resource.
name str: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
project_id str

accountEmail String: The email address of the service account. This value is often used to refer to the service account in order to grant IAM permissions.
id String: The provider-assigned unique ID for this managed resource.
name String: The Access Approval service account resource name. Format is "projects/{project_id}/serviceAccount".
projectId String

Package Details

Repository: Google Cloud (GCP) Classic pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.