Docs Packages
  1. Pulumi Registry
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. binaryauthorization
  5. Attestor
gcp logo
Google Cloud Classic v6.57.0, May 30 23

gcp.binaryauthorization.Attestor

Explore with Pulumi AI

An attestor that attests to container image artifacts.

To get more information about Attestor, see:

Example Usage

Binary Authorization Attestor Basic

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var note = new Gcp.ContainerAnalysis.Note("note", new()
    {
        AttestationAuthority = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityArgs
        {
            Hint = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityHintArgs
            {
                HumanReadableName = "Attestor Note",
            },
        },
    });

    var attestor = new Gcp.BinaryAuthorization.Attestor("attestor", new()
    {
        AttestationAuthorityNote = new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNoteArgs
        {
            NoteReference = note.Name,
            PublicKeys = new[]
            {
                new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNotePublicKeyArgs
                {
                    AsciiArmoredPgpPublicKey = @"mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl
bB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0
oR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6
V39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD
Mpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX
83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y
IiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L
uY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6
0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC
51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U
WTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h
MAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l
+OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1
qoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg
=6Bvm
",
                },
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/binaryauthorization"
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/containeranalysis"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		note, err := containeranalysis.NewNote(ctx, "note", &containeranalysis.NoteArgs{
			AttestationAuthority: &containeranalysis.NoteAttestationAuthorityArgs{
				Hint: &containeranalysis.NoteAttestationAuthorityHintArgs{
					HumanReadableName: pulumi.String("Attestor Note"),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = binaryauthorization.NewAttestor(ctx, "attestor", &binaryauthorization.AttestorArgs{
			AttestationAuthorityNote: &binaryauthorization.AttestorAttestationAuthorityNoteArgs{
				NoteReference: note.Name,
				PublicKeys: binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArray{
					&binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArgs{
						AsciiArmoredPgpPublicKey: pulumi.String("mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl\nbB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0\noR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6\nV39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD\nMpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX\n83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y\nIiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L\nuY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6\n0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC\n51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U\nWTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h\nMAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l\n+OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1\nqoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg\n=6Bvm\n"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.containeranalysis.Note;
import com.pulumi.gcp.containeranalysis.NoteArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityHintArgs;
import com.pulumi.gcp.binaryauthorization.Attestor;
import com.pulumi.gcp.binaryauthorization.AttestorArgs;
import com.pulumi.gcp.binaryauthorization.inputs.AttestorAttestationAuthorityNoteArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var note = new Note("note", NoteArgs.builder()        
            .attestationAuthority(NoteAttestationAuthorityArgs.builder()
                .hint(NoteAttestationAuthorityHintArgs.builder()
                    .humanReadableName("Attestor Note")
                    .build())
                .build())
            .build());

        var attestor = new Attestor("attestor", AttestorArgs.builder()        
            .attestationAuthorityNote(AttestorAttestationAuthorityNoteArgs.builder()
                .noteReference(note.name())
                .publicKeys(AttestorAttestationAuthorityNotePublicKeyArgs.builder()
                    .asciiArmoredPgpPublicKey("""
mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl
bB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0
oR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6
V39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD
Mpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX
83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y
IiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L
uY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6
0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC
51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U
WTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h
MAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l
+OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1
qoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg
=6Bvm
                    """)
                    .build())
                .build())
            .build());

    }
}

import pulumi
import pulumi_gcp as gcp

note = gcp.containeranalysis.Note("note", attestation_authority=gcp.containeranalysis.NoteAttestationAuthorityArgs(
    hint=gcp.containeranalysis.NoteAttestationAuthorityHintArgs(
        human_readable_name="Attestor Note",
    ),
))
attestor = gcp.binaryauthorization.Attestor("attestor", attestation_authority_note=gcp.binaryauthorization.AttestorAttestationAuthorityNoteArgs(
    note_reference=note.name,
    public_keys=[gcp.binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArgs(
        ascii_armored_pgp_public_key="""mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl
bB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0
oR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6
V39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD
Mpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX
83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y
IiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L
uY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6
0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC
51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U
WTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h
MAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l
+OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1
qoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg
=6Bvm
""",
    )],
))

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const note = new gcp.containeranalysis.Note("note", {attestationAuthority: {
    hint: {
        humanReadableName: "Attestor Note",
    },
}});
const attestor = new gcp.binaryauthorization.Attestor("attestor", {attestationAuthorityNote: {
    noteReference: note.name,
    publicKeys: [{
        asciiArmoredPgpPublicKey: `mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl
bB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0
oR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6
V39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD
Mpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX
83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y
IiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L
uY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6
0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC
51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U
WTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h
MAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l
+OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1
qoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg
=6Bvm
`,
    }],
}});

resources:
  attestor:
    type: gcp:binaryauthorization:Attestor
    properties:
      attestationAuthorityNote:
        noteReference: ${note.name}
        publicKeys:
          - asciiArmoredPgpPublicKey: |
              mQENBFtP0doBCADF+joTiXWKVuP8kJt3fgpBSjT9h8ezMfKA4aXZctYLx5wslWQl
              bB7Iu2ezkECNzoEeU7WxUe8a61pMCh9cisS9H5mB2K2uM4Jnf8tgFeXn3akJDVo0
              oR1IC+Dp9mXbRSK3MAvKkOwWlG99sx3uEdvmeBRHBOO+grchLx24EThXFOyP9Fk6
              V39j6xMjw4aggLD15B4V0v9JqBDdJiIYFzszZDL6pJwZrzcP0z8JO4rTZd+f64bD
              Mpj52j/pQfA8lZHOaAgb1OrthLdMrBAjoDjArV4Ek7vSbrcgYWcI6BhsQrFoxKdX
              83TZKai55ZCfCLIskwUIzA1NLVwyzCS+fSN/ABEBAAG0KCJUZXN0IEF0dGVzdG9y
              IiA8ZGFuYWhvZmZtYW5AZ29vZ2xlLmNvbT6JAU4EEwEIADgWIQRfWkqHt6hpTA1L
              uY060eeM4dc66AUCW0/R2gIbLwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRA6
              0eeM4dc66HdpCAC4ot3b0OyxPb0Ip+WT2U0PbpTBPJklesuwpIrM4Lh0N+1nVRLC
              51WSmVbM8BiAFhLbN9LpdHhds1kUrHF7+wWAjdR8sqAj9otc6HGRM/3qfa2qgh+U
              WTEk/3us/rYSi7T7TkMuutRMIa1IkR13uKiW56csEMnbOQpn9rDqwIr5R8nlZP5h
              MAU9vdm1DIv567meMqTaVZgR3w7bck2P49AO8lO5ERFpVkErtu/98y+rUy9d789l
              +OPuS1NGnxI1YKsNaWJF4uJVuvQuZ1twrhCbGNtVorO2U12+cEq+YtUxj7kmdOC1
              qoIRW6y0+UlAc+MbqfL0ziHDOAmcqz1GnROg
              =6Bvm              
  note:
    type: gcp:containeranalysis:Note
    properties:
      attestationAuthority:
        hint:
          humanReadableName: Attestor Note

Binary Authorization Attestor Kms

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Location = "global",
    });

    var crypto_key = new Gcp.Kms.CryptoKey("crypto-key", new()
    {
        KeyRing = keyring.Id,
        Purpose = "ASYMMETRIC_SIGN",
        VersionTemplate = new Gcp.Kms.Inputs.CryptoKeyVersionTemplateArgs
        {
            Algorithm = "RSA_SIGN_PKCS1_4096_SHA512",
        },
    });

    var version = Gcp.Kms.GetKMSCryptoKeyVersion.Invoke(new()
    {
        CryptoKey = crypto_key.Id,
    });

    var note = new Gcp.ContainerAnalysis.Note("note", new()
    {
        AttestationAuthority = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityArgs
        {
            Hint = new Gcp.ContainerAnalysis.Inputs.NoteAttestationAuthorityHintArgs
            {
                HumanReadableName = "Attestor Note",
            },
        },
    });

    var attestor = new Gcp.BinaryAuthorization.Attestor("attestor", new()
    {
        AttestationAuthorityNote = new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNoteArgs
        {
            NoteReference = note.Name,
            PublicKeys = new[]
            {
                new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNotePublicKeyArgs
                {
                    Id = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.Id),
                    PkixPublicKey = new Gcp.BinaryAuthorization.Inputs.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs
                    {
                        PublicKeyPem = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.PublicKeys[0]?.Pem),
                        SignatureAlgorithm = version.Apply(getKMSCryptoKeyVersionResult => getKMSCryptoKeyVersionResult.PublicKeys[0]?.Algorithm),
                    },
                },
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/binaryauthorization"
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/containeranalysis"
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		_, err = kms.NewCryptoKey(ctx, "crypto-key", &kms.CryptoKeyArgs{
			KeyRing: keyring.ID(),
			Purpose: pulumi.String("ASYMMETRIC_SIGN"),
			VersionTemplate: &kms.CryptoKeyVersionTemplateArgs{
				Algorithm: pulumi.String("RSA_SIGN_PKCS1_4096_SHA512"),
			},
		})
		if err != nil {
			return err
		}
		version := kms.GetKMSCryptoKeyVersionOutput(ctx, kms.GetKMSCryptoKeyVersionOutputArgs{
			CryptoKey: crypto_key.ID(),
		}, nil)
		note, err := containeranalysis.NewNote(ctx, "note", &containeranalysis.NoteArgs{
			AttestationAuthority: &containeranalysis.NoteAttestationAuthorityArgs{
				Hint: &containeranalysis.NoteAttestationAuthorityHintArgs{
					HumanReadableName: pulumi.String("Attestor Note"),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = binaryauthorization.NewAttestor(ctx, "attestor", &binaryauthorization.AttestorArgs{
			AttestationAuthorityNote: &binaryauthorization.AttestorAttestationAuthorityNoteArgs{
				NoteReference: note.Name,
				PublicKeys: binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArray{
					&binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArgs{
						Id: version.ApplyT(func(version kms.GetKMSCryptoKeyVersionResult) (*string, error) {
							return &version.Id, nil
						}).(pulumi.StringPtrOutput),
						PkixPublicKey: &binaryauthorization.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs{
							PublicKeyPem: version.ApplyT(func(version kms.GetKMSCryptoKeyVersionResult) (*string, error) {
								return &version.PublicKeys[0].Pem, nil
							}).(pulumi.StringPtrOutput),
							SignatureAlgorithm: version.ApplyT(func(version kms.GetKMSCryptoKeyVersionResult) (*string, error) {
								return &version.PublicKeys[0].Algorithm, nil
							}).(pulumi.StringPtrOutput),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.kms.CryptoKey;
import com.pulumi.gcp.kms.CryptoKeyArgs;
import com.pulumi.gcp.kms.inputs.CryptoKeyVersionTemplateArgs;
import com.pulumi.gcp.kms.KmsFunctions;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyVersionArgs;
import com.pulumi.gcp.containeranalysis.Note;
import com.pulumi.gcp.containeranalysis.NoteArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityArgs;
import com.pulumi.gcp.containeranalysis.inputs.NoteAttestationAuthorityHintArgs;
import com.pulumi.gcp.binaryauthorization.Attestor;
import com.pulumi.gcp.binaryauthorization.AttestorArgs;
import com.pulumi.gcp.binaryauthorization.inputs.AttestorAttestationAuthorityNoteArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()        
            .location("global")
            .build());

        var crypto_key = new CryptoKey("crypto-key", CryptoKeyArgs.builder()        
            .keyRing(keyring.id())
            .purpose("ASYMMETRIC_SIGN")
            .versionTemplate(CryptoKeyVersionTemplateArgs.builder()
                .algorithm("RSA_SIGN_PKCS1_4096_SHA512")
                .build())
            .build());

        final var version = KmsFunctions.getKMSCryptoKeyVersion(GetKMSCryptoKeyVersionArgs.builder()
            .cryptoKey(crypto_key.id())
            .build());

        var note = new Note("note", NoteArgs.builder()        
            .attestationAuthority(NoteAttestationAuthorityArgs.builder()
                .hint(NoteAttestationAuthorityHintArgs.builder()
                    .humanReadableName("Attestor Note")
                    .build())
                .build())
            .build());

        var attestor = new Attestor("attestor", AttestorArgs.builder()        
            .attestationAuthorityNote(AttestorAttestationAuthorityNoteArgs.builder()
                .noteReference(note.name())
                .publicKeys(AttestorAttestationAuthorityNotePublicKeyArgs.builder()
                    .id(version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult).applyValue(version -> version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult.id())))
                    .pkixPublicKey(AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs.builder()
                        .publicKeyPem(version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult).applyValue(version -> version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult.publicKeys()[0].pem())))
                        .signatureAlgorithm(version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult).applyValue(version -> version.applyValue(getKMSCryptoKeyVersionResult -> getKMSCryptoKeyVersionResult.publicKeys()[0].algorithm())))
                        .build())
                    .build())
                .build())
            .build());

    }
}

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
crypto_key = gcp.kms.CryptoKey("crypto-key",
    key_ring=keyring.id,
    purpose="ASYMMETRIC_SIGN",
    version_template=gcp.kms.CryptoKeyVersionTemplateArgs(
        algorithm="RSA_SIGN_PKCS1_4096_SHA512",
    ))
version = gcp.kms.get_kms_crypto_key_version_output(crypto_key=crypto_key.id)
note = gcp.containeranalysis.Note("note", attestation_authority=gcp.containeranalysis.NoteAttestationAuthorityArgs(
    hint=gcp.containeranalysis.NoteAttestationAuthorityHintArgs(
        human_readable_name="Attestor Note",
    ),
))
attestor = gcp.binaryauthorization.Attestor("attestor", attestation_authority_note=gcp.binaryauthorization.AttestorAttestationAuthorityNoteArgs(
    note_reference=note.name,
    public_keys=[gcp.binaryauthorization.AttestorAttestationAuthorityNotePublicKeyArgs(
        id=version.id,
        pkix_public_key=gcp.binaryauthorization.AttestorAttestationAuthorityNotePublicKeyPkixPublicKeyArgs(
            public_key_pem=version.public_keys[0].pem,
            signature_algorithm=version.public_keys[0].algorithm,
        ),
    )],
))

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {location: "global"});
const crypto_key = new gcp.kms.CryptoKey("crypto-key", {
    keyRing: keyring.id,
    purpose: "ASYMMETRIC_SIGN",
    versionTemplate: {
        algorithm: "RSA_SIGN_PKCS1_4096_SHA512",
    },
});
const version = gcp.kms.getKMSCryptoKeyVersionOutput({
    cryptoKey: crypto_key.id,
});
const note = new gcp.containeranalysis.Note("note", {attestationAuthority: {
    hint: {
        humanReadableName: "Attestor Note",
    },
}});
const attestor = new gcp.binaryauthorization.Attestor("attestor", {attestationAuthorityNote: {
    noteReference: note.name,
    publicKeys: [{
        id: version.apply(version => version.id),
        pkixPublicKey: {
            publicKeyPem: version.apply(version => version.publicKeys?.[0]?.pem),
            signatureAlgorithm: version.apply(version => version.publicKeys?.[0]?.algorithm),
        },
    }],
}});

resources:
  attestor:
    type: gcp:binaryauthorization:Attestor
    properties:
      attestationAuthorityNote:
        noteReference: ${note.name}
        publicKeys:
          - id: ${version.id}
            pkixPublicKey:
              publicKeyPem: ${version.publicKeys[0].pem}
              signatureAlgorithm: ${version.publicKeys[0].algorithm}
  note:
    type: gcp:containeranalysis:Note
    properties:
      attestationAuthority:
        hint:
          humanReadableName: Attestor Note
  crypto-key:
    type: gcp:kms:CryptoKey
    properties:
      keyRing: ${keyring.id}
      purpose: ASYMMETRIC_SIGN
      versionTemplate:
        algorithm: RSA_SIGN_PKCS1_4096_SHA512
  keyring:
    type: gcp:kms:KeyRing
    properties:
      location: global
variables:
  version:
    fn::invoke:
      Function: gcp:kms:getKMSCryptoKeyVersion
      Arguments:
        cryptoKey: ${["crypto-key"].id}

Create Attestor Resource

new Attestor(name: string, args: AttestorArgs, opts?: CustomResourceOptions);
@overload
def Attestor(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             attestation_authority_note: Optional[AttestorAttestationAuthorityNoteArgs] = None,
             description: Optional[str] = None,
             name: Optional[str] = None,
             project: Optional[str] = None)
@overload
def Attestor(resource_name: str,
             args: AttestorArgs,
             opts: Optional[ResourceOptions] = None)
func NewAttestor(ctx *Context, name string, args AttestorArgs, opts ...ResourceOption) (*Attestor, error)
public Attestor(string name, AttestorArgs args, CustomResourceOptions? opts = null)
public Attestor(String name, AttestorArgs args)
public Attestor(String name, AttestorArgs args, CustomResourceOptions options)

type: gcp:binaryauthorization:Attestor
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
name string
The unique name of the resource.
args AttestorArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args AttestorArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args AttestorArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args AttestorArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args AttestorArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Attestor Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The Attestor resource accepts the following input properties:

AttestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

Description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

Name string

The resource name.

Project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

AttestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

Description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

Name string

The resource name.

Project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description String

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name String

The resource name.

project String

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name string

The resource name.

project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestation_authority_note AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description str

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name str

The resource name.

project str

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote Property Map

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description String

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name String

The resource name.

project String

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

Outputs

All input properties are implicitly available as output properties. Additionally, the Attestor resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id string

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

Look up Existing Attestor Resource

Get an existing Attestor resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AttestorState, opts?: CustomResourceOptions): Attestor
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        attestation_authority_note: Optional[AttestorAttestationAuthorityNoteArgs] = None,
        description: Optional[str] = None,
        name: Optional[str] = None,
        project: Optional[str] = None) -> Attestor
func GetAttestor(ctx *Context, name string, id IDInput, state *AttestorState, opts ...ResourceOption) (*Attestor, error)
public static Attestor Get(string name, Input<string> id, AttestorState? state, CustomResourceOptions? opts = null)
public static Attestor get(String name, Output<String> id, AttestorState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
AttestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

Description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

Name string

The resource name.

Project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

AttestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

Description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

Name string

The resource name.

Project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description String

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name String

The resource name.

project String

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description string

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name string

The resource name.

project string

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestation_authority_note AttestorAttestationAuthorityNoteArgs

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description str

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name str

The resource name.

project str

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

attestationAuthorityNote Property Map

A Container Analysis ATTESTATION_AUTHORITY Note, created by the user. Structure is documented below.

description String

A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

name String

The resource name.

project String

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

Supporting Types

AttestorAttestationAuthorityNote

NoteReference string

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

DelegationServiceAccountEmail string

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

PublicKeys List<AttestorAttestationAuthorityNotePublicKey>

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

NoteReference string

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

DelegationServiceAccountEmail string

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

PublicKeys []AttestorAttestationAuthorityNotePublicKey

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

noteReference String

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

delegationServiceAccountEmail String

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

publicKeys List<AttestorAttestationAuthorityNotePublicKey>

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

noteReference string

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

delegationServiceAccountEmail string

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

publicKeys AttestorAttestationAuthorityNotePublicKey[]

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

note_reference str

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

delegation_service_account_email str

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

public_keys Sequence[AttestorAttestationAuthorityNotePublicKey]

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

noteReference String

The resource name of a ATTESTATION_AUTHORITY Note, created by the user. If the Note is in a different project from the Attestor, it should be specified in the format projects/*/notes/* (or the legacy providers/*/notes/*). This field may not be updated. An attestation by this attestor is stored as a Container Analysis ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note.

delegationServiceAccountEmail String

(Output) This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the noteReference in Container Analysis (containeranalysis.notes.occurrences.viewer). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.

publicKeys List<Property Map>

Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. Structure is documented below.

AttestorAttestationAuthorityNotePublicKey

AsciiArmoredPgpPublicKey string

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

Comment string

A descriptive comment. This field may be updated.

Id string

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

PkixPublicKey AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

AsciiArmoredPgpPublicKey string

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

Comment string

A descriptive comment. This field may be updated.

Id string

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

PkixPublicKey AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

asciiArmoredPgpPublicKey String

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

comment String

A descriptive comment. This field may be updated.

id String

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

pkixPublicKey AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

asciiArmoredPgpPublicKey string

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

comment string

A descriptive comment. This field may be updated.

id string

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

pkixPublicKey AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

ascii_armored_pgp_public_key str

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

comment str

A descriptive comment. This field may be updated.

id str

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

pkix_public_key AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

asciiArmoredPgpPublicKey String

ASCII-armored representation of a PGP public key, as the entire output by the command gpg --export --armor foo@example.com (either LF or CRLF line endings). When using this field, id should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If id is provided by the caller, it will be overwritten by the API-calculated ID.

comment String

A descriptive comment. This field may be updated.

id String

The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on publicKey cases below for details.

pkixPublicKey Property Map

A raw PKIX SubjectPublicKeyInfo format public key. NOTE: id may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If id is left blank, a default one will be computed based on the digest of the DER encoding of the public key. Structure is documented below.

AttestorAttestationAuthorityNotePublicKeyPkixPublicKey

PublicKeyPem string

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

SignatureAlgorithm string

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

PublicKeyPem string

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

SignatureAlgorithm string

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

publicKeyPem String

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

signatureAlgorithm String

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

publicKeyPem string

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

signatureAlgorithm string

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

public_key_pem str

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

signature_algorithm str

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

publicKeyPem String

A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

signatureAlgorithm String

The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in publicKeyPem (i.e. this algorithm must match that of the public key).

Import

Attestor can be imported using any of these accepted formats

 $ pulumi import gcp:binaryauthorization/attestor:Attestor default projects/{{project}}/attestors/{{name}}

 $ pulumi import gcp:binaryauthorization/attestor:Attestor default {{project}}/{{name}}

 $ pulumi import gcp:binaryauthorization/attestor:Attestor default {{name}}

Package Details

Repository
Google Cloud (GCP) Classic pulumi/pulumi-gcp
License
Apache-2.0
Notes

This Pulumi package is based on the google-beta Terraform Provider.