gcp.iam.FolderAccessPolicy

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as time from "@pulumiverse/time";

const folder = new gcp.organizations.Folder("folder", {
    displayName: "ap-folder-",
    parent: "organizations/123456789",
    deletionProtection: false,
});
const project = new gcp.organizations.Project("project", {
    projectId: "ap-project-",
    name: "ap-project-",
    folderId: folder.folderId,
    billingAccount: "000000-0000000-0000000-000000",
    deletionPolicy: "DELETE",
}, {
    dependsOn: [folder],
});
const iamApi = new gcp.projects.Service("iam_api", {
    project: project.projectId,
    service: "iam.googleapis.com",
    disableOnDestroy: false,
}, {
    dependsOn: [project],
});
const waitForPropagation = new time.Sleep("wait_for_propagation", {createDuration: "30s"}, {
    dependsOn: [
        folder,
        iamApi,
    ],
});
const testSa = new gcp.serviceaccount.Account("test_sa", {
    accountId: "svc-acc-",
    displayName: "Test Service Account for Access Policy",
    project: project.projectId,
}, {
    dependsOn: [waitForPropagation],
});
const example = new gcp.iam.FolderAccessPolicy("example", {
    folder: folder.folderId,
    location: "global",
    accessPolicyId: "my-folder-policy-",
    details: {
        rules: [{
            effect: "ALLOW",
            principals: [pulumi.interpolate`principal://iam.googleapis.com/projects/-/serviceAccounts/${testSa.email}`],
            operation: {
                permissions: ["eventarc.googleapis.com/messageBuses.publish"],
            },
        }],
    },
}, {
    dependsOn: [
        waitForPropagation,
        testSa,
    ],
});

import pulumi
import pulumi_gcp as gcp
import pulumiverse_time as time

folder = gcp.organizations.Folder("folder",
    display_name="ap-folder-",
    parent="organizations/123456789",
    deletion_protection=False)
project = gcp.organizations.Project("project",
    project_id="ap-project-",
    name="ap-project-",
    folder_id=folder.folder_id,
    billing_account="000000-0000000-0000000-000000",
    deletion_policy="DELETE",
    opts = pulumi.ResourceOptions(depends_on=[folder]))
iam_api = gcp.projects.Service("iam_api",
    project=project.project_id,
    service="iam.googleapis.com",
    disable_on_destroy=False,
    opts = pulumi.ResourceOptions(depends_on=[project]))
wait_for_propagation = time.Sleep("wait_for_propagation", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[
        folder,
        iam_api,
    ]))
test_sa = gcp.serviceaccount.Account("test_sa",
    account_id="svc-acc-",
    display_name="Test Service Account for Access Policy",
    project=project.project_id,
    opts = pulumi.ResourceOptions(depends_on=[wait_for_propagation]))
example = gcp.iam.FolderAccessPolicy("example",
    folder=folder.folder_id,
    location="global",
    access_policy_id="my-folder-policy-",
    details={
        "rules": [{
            "effect": "ALLOW",
            "principals": [test_sa.email.apply(lambda email: f"principal://iam.googleapis.com/projects/-/serviceAccounts/{email}")],
            "operation": {
                "permissions": ["eventarc.googleapis.com/messageBuses.publish"],
            },
        }],
    },
    opts = pulumi.ResourceOptions(depends_on=[
            wait_for_propagation,
            test_sa,
        ]))

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		folder, err := organizations.NewFolder(ctx, "folder", &organizations.FolderArgs{
			DisplayName:        pulumi.String("ap-folder-"),
			Parent:             pulumi.String("organizations/123456789"),
			DeletionProtection: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		project, err := organizations.NewProject(ctx, "project", &organizations.ProjectArgs{
			ProjectId:      pulumi.String("ap-project-"),
			Name:           pulumi.String("ap-project-"),
			FolderId:       folder.FolderId,
			BillingAccount: pulumi.String("000000-0000000-0000000-000000"),
			DeletionPolicy: pulumi.String("DELETE"),
		}, pulumi.DependsOn([]pulumi.Resource{
			folder,
		}))
		if err != nil {
			return err
		}
		iamApi, err := projects.NewService(ctx, "iam_api", &projects.ServiceArgs{
			Project:          project.ProjectId,
			Service:          pulumi.String("iam.googleapis.com"),
			DisableOnDestroy: pulumi.Bool(false),
		}, pulumi.DependsOn([]pulumi.Resource{
			project,
		}))
		if err != nil {
			return err
		}
		waitForPropagation, err := time.NewSleep(ctx, "wait_for_propagation", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			folder,
			iamApi,
		}))
		if err != nil {
			return err
		}
		testSa, err := serviceaccount.NewAccount(ctx, "test_sa", &serviceaccount.AccountArgs{
			AccountId:   pulumi.String("svc-acc-"),
			DisplayName: pulumi.String("Test Service Account for Access Policy"),
			Project:     project.ProjectId,
		}, pulumi.DependsOn([]pulumi.Resource{
			waitForPropagation,
		}))
		if err != nil {
			return err
		}
		_, err = iam.NewFolderAccessPolicy(ctx, "example", &iam.FolderAccessPolicyArgs{
			Folder:         folder.FolderId,
			Location:       pulumi.String("global"),
			AccessPolicyId: pulumi.String("my-folder-policy-"),
			Details: &iam.FolderAccessPolicyDetailsArgs{
				Rules: iam.FolderAccessPolicyDetailsRuleArray{
					&iam.FolderAccessPolicyDetailsRuleArgs{
						Effect: pulumi.String("ALLOW"),
						Principals: pulumi.StringArray{
							testSa.Email.ApplyT(func(email string) (string, error) {
								return fmt.Sprintf("principal://iam.googleapis.com/projects/-/serviceAccounts/%v", email), nil
							}).(pulumi.StringOutput),
						},
						Operation: &iam.FolderAccessPolicyDetailsRuleOperationArgs{
							Permissions: pulumi.StringArray{
								pulumi.String("eventarc.googleapis.com/messageBuses.publish"),
							},
						},
					},
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			waitForPropagation,
			testSa,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    var folder = new Gcp.Organizations.Folder("folder", new()
    {
        DisplayName = "ap-folder-",
        Parent = "organizations/123456789",
        DeletionProtection = false,
    });

    var project = new Gcp.Organizations.Project("project", new()
    {
        ProjectId = "ap-project-",
        Name = "ap-project-",
        FolderId = folder.FolderId,
        BillingAccount = "000000-0000000-0000000-000000",
        DeletionPolicy = "DELETE",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            folder,
        },
    });

    var iamApi = new Gcp.Projects.Service("iam_api", new()
    {
        Project = project.ProjectId,
        ServiceName = "iam.googleapis.com",
        DisableOnDestroy = false,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            project,
        },
    });

    var waitForPropagation = new Time.Sleep("wait_for_propagation", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            folder,
            iamApi,
        },
    });

    var testSa = new Gcp.ServiceAccount.Account("test_sa", new()
    {
        AccountId = "svc-acc-",
        DisplayName = "Test Service Account for Access Policy",
        Project = project.ProjectId,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitForPropagation,
        },
    });

    var example = new Gcp.Iam.FolderAccessPolicy("example", new()
    {
        Folder = folder.FolderId,
        Location = "global",
        AccessPolicyId = "my-folder-policy-",
        Details = new Gcp.Iam.Inputs.FolderAccessPolicyDetailsArgs
        {
            Rules = new[]
            {
                new Gcp.Iam.Inputs.FolderAccessPolicyDetailsRuleArgs
                {
                    Effect = "ALLOW",
                    Principals = new[]
                    {
                        testSa.Email.Apply(email => $"principal://iam.googleapis.com/projects/-/serviceAccounts/{email}"),
                    },
                    Operation = new Gcp.Iam.Inputs.FolderAccessPolicyDetailsRuleOperationArgs
                    {
                        Permissions = new[]
                        {
                            "eventarc.googleapis.com/messageBuses.publish",
                        },
                    },
                },
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitForPropagation,
            testSa,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Folder;
import com.pulumi.gcp.organizations.FolderArgs;
import com.pulumi.gcp.organizations.Project;
import com.pulumi.gcp.organizations.ProjectArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumiverse.time.Sleep;
import com.pulumiverse.time.SleepArgs;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.iam.FolderAccessPolicy;
import com.pulumi.gcp.iam.FolderAccessPolicyArgs;
import com.pulumi.gcp.iam.inputs.FolderAccessPolicyDetailsArgs;
import com.pulumi.gcp.iam.inputs.FolderAccessPolicyDetailsRuleArgs;
import com.pulumi.gcp.iam.inputs.FolderAccessPolicyDetailsRuleOperationArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var folder = new Folder("folder", FolderArgs.builder()
            .displayName("ap-folder-")
            .parent("organizations/123456789")
            .deletionProtection(false)
            .build());

        var project = new Project("project", ProjectArgs.builder()
            .projectId("ap-project-")
            .name("ap-project-")
            .folderId(folder.folderId())
            .billingAccount("000000-0000000-0000000-000000")
            .deletionPolicy("DELETE")
            .build(), CustomResourceOptions.builder()
                .dependsOn(folder)
                .build());

        var iamApi = new Service("iamApi", ServiceArgs.builder()
            .project(project.projectId())
            .service("iam.googleapis.com")
            .disableOnDestroy(false)
            .build(), CustomResourceOptions.builder()
                .dependsOn(project)
                .build());

        var waitForPropagation = new Sleep("waitForPropagation", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    folder,
                    iamApi)
                .build());

        var testSa = new Account("testSa", AccountArgs.builder()
            .accountId("svc-acc-")
            .displayName("Test Service Account for Access Policy")
            .project(project.projectId())
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitForPropagation)
                .build());

        var example = new FolderAccessPolicy("example", FolderAccessPolicyArgs.builder()
            .folder(folder.folderId())
            .location("global")
            .accessPolicyId("my-folder-policy-")
            .details(FolderAccessPolicyDetailsArgs.builder()
                .rules(FolderAccessPolicyDetailsRuleArgs.builder()
                    .effect("ALLOW")
                    .principals(testSa.email().applyValue(_email -> String.format("principal://iam.googleapis.com/projects/-/serviceAccounts/%s", _email)))
                    .operation(FolderAccessPolicyDetailsRuleOperationArgs.builder()
                        .permissions("eventarc.googleapis.com/messageBuses.publish")
                        .build())
                    .build())
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    waitForPropagation,
                    testSa)
                .build());

    }
}

resources:
  folder:
    type: gcp:organizations:Folder
    properties:
      displayName: ap-folder-
      parent: organizations/123456789
      deletionProtection: false
  project:
    type: gcp:organizations:Project
    properties:
      projectId: ap-project-
      name: ap-project-
      folderId: ${folder.folderId}
      billingAccount: 000000-0000000-0000000-000000
      deletionPolicy: DELETE
    options:
      dependsOn:
        - ${folder}
  iamApi:
    type: gcp:projects:Service
    name: iam_api
    properties:
      project: ${project.projectId}
      service: iam.googleapis.com
      disableOnDestroy: false
    options:
      dependsOn:
        - ${project}
  waitForPropagation:
    type: time:Sleep
    name: wait_for_propagation
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${folder}
        - ${iamApi}
  testSa:
    type: gcp:serviceaccount:Account
    name: test_sa
    properties:
      accountId: svc-acc-
      displayName: Test Service Account for Access Policy
      project: ${project.projectId}
    options:
      dependsOn:
        - ${waitForPropagation}
  example:
    type: gcp:iam:FolderAccessPolicy
    properties:
      folder: ${folder.folderId}
      location: global
      accessPolicyId: my-folder-policy-
      details:
        rules:
          - effect: ALLOW
            principals:
              - principal://iam.googleapis.com/projects/-/serviceAccounts/${testSa.email}
            operation:
              permissions:
                - eventarc.googleapis.com/messageBuses.publish
    options:
      dependsOn:
        - ${waitForPropagation}
        - ${testSa}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
    time = {
      source = "pulumi/time"
    }
  }
}

resource "gcp_organizations_folder" "folder" {
  display_name        = "ap-folder-"
  parent              = "organizations/123456789"
  deletion_protection = false
}
resource "gcp_organizations_project" "project" {
  depends_on      = [gcp_organizations_folder.folder]
  project_id      = "ap-project-"
  name            = "ap-project-"
  folder_id       = gcp_organizations_folder.folder.folder_id
  billing_account = "000000-0000000-0000000-000000"
  deletion_policy = "DELETE"
}
resource "gcp_projects_service" "iam_api" {
  depends_on         = [gcp_organizations_project.project]
  project            = gcp_organizations_project.project.project_id
  service            = "iam.googleapis.com"
  disable_on_destroy = false
}
resource "time_sleep" "wait_for_propagation" {
  depends_on      = [gcp_organizations_folder.folder, gcp_projects_service.iam_api]
  create_duration = "30s"
}
resource "gcp_serviceaccount_account" "test_sa" {
  depends_on   = [time_sleep.wait_for_propagation]
  account_id   = "svc-acc-"
  display_name = "Test Service Account for Access Policy"
  project      = gcp_organizations_project.project.project_id
}
resource "gcp_iam_folderaccesspolicy" "example" {
  depends_on       = [time_sleep.wait_for_propagation, gcp_serviceaccount_account.test_sa]
  folder           = gcp_organizations_folder.folder.folder_id
  location         = "global"
  access_policy_id = "my-folder-policy-"
  details = {
    rules = [{
      "effect"     = "ALLOW"
      "principals" = ["principal://iam.googleapis.com/projects/-/serviceAccounts/${gcp_serviceaccount_account.test_sa.email}"]
      "operation" = {
        "permissions" = ["eventarc.googleapis.com/messageBuses.publish"]
      }
    }]
  }
}

var folderAccessPolicyResource = new Gcp.Iam.FolderAccessPolicy("folderAccessPolicyResource", new()
{
    AccessPolicyId = "string",
    Folder = "string",
    Location = "string",
    Annotations = 
    {
        { "string", "string" },
    },
    DeletionPolicy = "string",
    Details = new Gcp.Iam.Inputs.FolderAccessPolicyDetailsArgs
    {
        Rules = new[]
        {
            new Gcp.Iam.Inputs.FolderAccessPolicyDetailsRuleArgs
            {
                Effect = "string",
                Operation = new Gcp.Iam.Inputs.FolderAccessPolicyDetailsRuleOperationArgs
                {
                    Permissions = new[]
                    {
                        "string",
                    },
                    ExcludedPermissions = new[]
                    {
                        "string",
                    },
                },
                Principals = new[]
                {
                    "string",
                },
                Conditions = new[]
                {
                    new Gcp.Iam.Inputs.FolderAccessPolicyDetailsRuleConditionArgs
                    {
                        Service = "string",
                        Expression = "string",
                    },
                },
                Description = "string",
                ExcludedPrincipals = new[]
                {
                    "string",
                },
            },
        },
    },
    DisplayName = "string",
});

example, err := iam.NewFolderAccessPolicy(ctx, "folderAccessPolicyResource", &iam.FolderAccessPolicyArgs{
	AccessPolicyId: pulumi.String("string"),
	Folder:         pulumi.String("string"),
	Location:       pulumi.String("string"),
	Annotations: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	DeletionPolicy: pulumi.String("string"),
	Details: &iam.FolderAccessPolicyDetailsArgs{
		Rules: iam.FolderAccessPolicyDetailsRuleArray{
			&iam.FolderAccessPolicyDetailsRuleArgs{
				Effect: pulumi.String("string"),
				Operation: &iam.FolderAccessPolicyDetailsRuleOperationArgs{
					Permissions: pulumi.StringArray{
						pulumi.String("string"),
					},
					ExcludedPermissions: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
				Principals: pulumi.StringArray{
					pulumi.String("string"),
				},
				Conditions: iam.FolderAccessPolicyDetailsRuleConditionArray{
					&iam.FolderAccessPolicyDetailsRuleConditionArgs{
						Service:    pulumi.String("string"),
						Expression: pulumi.String("string"),
					},
				},
				Description: pulumi.String("string"),
				ExcludedPrincipals: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
		},
	},
	DisplayName: pulumi.String("string"),
})

resource "gcp_iam_folderaccesspolicy" "folderAccessPolicyResource" {
  access_policy_id = "string"
  folder           = "string"
  location         = "string"
  annotations = {
    "string" = "string"
  }
  deletion_policy = "string"
  details = {
    rules = [{
      "effect" = "string"
      "operation" = {
        "permissions"         = ["string"]
        "excludedPermissions" = ["string"]
      }
      "principals" = ["string"]
      "conditions" = [{
        "service"    = "string"
        "expression" = "string"
      }]
      "description"        = "string"
      "excludedPrincipals" = ["string"]
    }]
  }
  display_name = "string"
}

var folderAccessPolicyResource = new FolderAccessPolicy("folderAccessPolicyResource", FolderAccessPolicyArgs.builder()
    .accessPolicyId("string")
    .folder("string")
    .location("string")
    .annotations(Map.of("string", "string"))
    .deletionPolicy("string")
    .details(FolderAccessPolicyDetailsArgs.builder()
        .rules(FolderAccessPolicyDetailsRuleArgs.builder()
            .effect("string")
            .operation(FolderAccessPolicyDetailsRuleOperationArgs.builder()
                .permissions("string")
                .excludedPermissions("string")
                .build())
            .principals("string")
            .conditions(FolderAccessPolicyDetailsRuleConditionArgs.builder()
                .service("string")
                .expression("string")
                .build())
            .description("string")
            .excludedPrincipals("string")
            .build())
        .build())
    .displayName("string")
    .build());

folder_access_policy_resource = gcp.iam.FolderAccessPolicy("folderAccessPolicyResource",
    access_policy_id="string",
    folder="string",
    location="string",
    annotations={
        "string": "string",
    },
    deletion_policy="string",
    details={
        "rules": [{
            "effect": "string",
            "operation": {
                "permissions": ["string"],
                "excluded_permissions": ["string"],
            },
            "principals": ["string"],
            "conditions": [{
                "service": "string",
                "expression": "string",
            }],
            "description": "string",
            "excluded_principals": ["string"],
        }],
    },
    display_name="string")

const folderAccessPolicyResource = new gcp.iam.FolderAccessPolicy("folderAccessPolicyResource", {
    accessPolicyId: "string",
    folder: "string",
    location: "string",
    annotations: {
        string: "string",
    },
    deletionPolicy: "string",
    details: {
        rules: [{
            effect: "string",
            operation: {
                permissions: ["string"],
                excludedPermissions: ["string"],
            },
            principals: ["string"],
            conditions: [{
                service: "string",
                expression: "string",
            }],
            description: "string",
            excludedPrincipals: ["string"],
        }],
    },
    displayName: "string",
});

type: gcp:iam:FolderAccessPolicy
properties:
    accessPolicyId: string
    annotations:
        string: string
    deletionPolicy: string
    details:
        rules:
            - conditions:
                - expression: string
                  service: string
              description: string
              effect: string
              excludedPrincipals:
                - string
              operation:
                excludedPermissions:
                    - string
                permissions:
                    - string
              principals:
                - string
    displayName: string
    folder: string
    location: string