Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Google Cloud (GCP)
  4. API Docs
  5. iam
  6. getWorkloadIdentityPoolJwks
Viewing docs for Google Cloud v10.2.0
published on Tuesday, Oct 20, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

gcp.iam.getWorkloadIdentityPoolJwks

gcp logo
Viewing docs for Google Cloud v10.2.0
published on Tuesday, Oct 20, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

    Get the JSON Web Key Set (JWKS) public keys (/openid/jwks) for an Agent Workload Identity Pool from GCP.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const oidc = gcp.iam.getWorkloadIdentityPoolOpenidConfig({
    resourceName: "https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration",
});
const example = oidc.then(oidc => gcp.iam.getWorkloadIdentityPoolJwks({
    resourceName: oidc.jwksUri,
}));

    import pulumi
import pulumi_gcp as gcp

oidc = gcp.iam.get_workload_identity_pool_openid_config(resource_name="https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration")
example = gcp.iam.get_workload_identity_pool_jwks(resource_name=oidc.jwks_uri)

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v10/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		oidc, err := iam.GetWorkloadIdentityPoolOpenidConfig(ctx, &iam.GetWorkloadIdentityPoolOpenidConfigArgs{
			ResourceName: "https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration",
		}, nil)
		if err != nil {
			return err
		}
		_, err = iam.GetWorkloadIdentityPoolJwks(ctx, &iam.GetWorkloadIdentityPoolJwksArgs{
			ResourceName: oidc.JwksUri,
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var oidc = Gcp.Iam.GetWorkloadIdentityPoolOpenidConfig.Invoke(new()
    {
        ResourceName = "https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration",
    });

    var example = Gcp.Iam.GetWorkloadIdentityPoolJwks.Invoke(new()
    {
        ResourceName = oidc.Apply(getWorkloadIdentityPoolOpenidConfigResult => getWorkloadIdentityPoolOpenidConfigResult.JwksUri),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.IamFunctions;
import com.pulumi.gcp.iam.inputs.GetWorkloadIdentityPoolOpenidConfigArgs;
import com.pulumi.gcp.iam.inputs.GetWorkloadIdentityPoolJwksArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var oidc = IamFunctions.getWorkloadIdentityPoolOpenidConfig(GetWorkloadIdentityPoolOpenidConfigArgs.builder()
            .resourceName("https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration")
            .build());

        final var example = IamFunctions.getWorkloadIdentityPoolJwks(GetWorkloadIdentityPoolJwksArgs.builder()
            .resourceName(oidc.jwksUri())
            .build());

    }
}

    variables:
  oidc:
    fn::invoke:
      function: gcp:iam:getWorkloadIdentityPoolOpenidConfig
      arguments:
        resourceName: https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration
  example:
    fn::invoke:
      function: gcp:iam:getWorkloadIdentityPoolJwks
      arguments:
        resourceName: ${oidc.jwksUri}

    terraform {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_iam_workload_identity_pool_openid_config" "oidc" {
  resource_name = "https://sts.googleapis.com/v1/organizations/433637338589/locations/global/workloadIdentityPools/agents.global.org-433637338589.system.id.goog/.well-known/openid-configuration"
}
data "gcp_iam_workload_identity_pool_jwks" "example" {
  resource_name = data.gcp_iam_workload_identity_pool_openid_config.oidc.jwks_uri
}

    Using getWorkloadIdentityPoolJwks

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getWorkloadIdentityPoolJwks(args: GetWorkloadIdentityPoolJwksArgs, opts?: InvokeOptions): Promise<GetWorkloadIdentityPoolJwksResult>
function getWorkloadIdentityPoolJwksOutput(args: GetWorkloadIdentityPoolJwksOutputArgs, opts?: InvokeOutputOptions): Output<GetWorkloadIdentityPoolJwksResult>
    def get_workload_identity_pool_jwks(resource_name: Optional[str] = None,
                                    opts: Optional[InvokeOptions] = None) -> GetWorkloadIdentityPoolJwksResult
def get_workload_identity_pool_jwks_output(resource_name: pulumi.Input[Optional[str]] = None,
                                    opts: Optional[InvokeOutputOptions] = None) -> Output[GetWorkloadIdentityPoolJwksResult]
    func GetWorkloadIdentityPoolJwks(ctx *Context, args *GetWorkloadIdentityPoolJwksArgs, opts ...InvokeOption) (*GetWorkloadIdentityPoolJwksResult, error)
func GetWorkloadIdentityPoolJwksOutput(ctx *Context, args *GetWorkloadIdentityPoolJwksOutputArgs, opts ...InvokeOption) GetWorkloadIdentityPoolJwksResultOutput

    > Note: This function is named GetWorkloadIdentityPoolJwks in the Go SDK.

    public static class GetWorkloadIdentityPoolJwks 
{
    public static Task<GetWorkloadIdentityPoolJwksResult> InvokeAsync(GetWorkloadIdentityPoolJwksArgs args, InvokeOptions? opts = null)
    public static Output<GetWorkloadIdentityPoolJwksResult> Invoke(GetWorkloadIdentityPoolJwksInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetWorkloadIdentityPoolJwksResult> Invoke(GetWorkloadIdentityPoolJwksInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetWorkloadIdentityPoolJwksResult> getWorkloadIdentityPoolJwks(GetWorkloadIdentityPoolJwksArgs args, InvokeOptions options)
public static Output<GetWorkloadIdentityPoolJwksResult> getWorkloadIdentityPoolJwks(GetWorkloadIdentityPoolJwksArgs args, InvokeOptions options)
public static Output<GetWorkloadIdentityPoolJwksResult> getWorkloadIdentityPoolJwks(GetWorkloadIdentityPoolJwksArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: gcp:iam/getWorkloadIdentityPoolJwks:getWorkloadIdentityPoolJwks
  arguments:
    # arguments dictionary
    data "gcp_iam_get_workload_identity_pool_jwks" "name" {
    # arguments
}

    The following arguments are supported:

    ResourceName string
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    ResourceName string
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    resource_name string
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    resourceName String
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    resourceName string
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    resource_name str
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    resourceName String
    The JWKS URI to retrieve the public keys from (e.g. from google_iam_workload_identity_pool_openid_config.jwks_uri).

    getWorkloadIdentityPoolJwks Result

    The following output properties are available:

    Id string
    The provider-assigned unique ID for this managed resource.
    JwksJson string
    The raw JSON string representation of the JWKS response.
    Keys List<GetWorkloadIdentityPoolJwksKey>
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    ResourceName string
    Id string
    The provider-assigned unique ID for this managed resource.
    JwksJson string
    The raw JSON string representation of the JWKS response.
    Keys []GetWorkloadIdentityPoolJwksKey
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    ResourceName string
    id string
    The provider-assigned unique ID for this managed resource.
    jwks_json string
    The raw JSON string representation of the JWKS response.
    keys list(object)
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    resource_name string
    id String
    The provider-assigned unique ID for this managed resource.
    jwksJson String
    The raw JSON string representation of the JWKS response.
    keys List<GetWorkloadIdentityPoolJwksKey>
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    resourceName String
    id string
    The provider-assigned unique ID for this managed resource.
    jwksJson string
    The raw JSON string representation of the JWKS response.
    keys GetWorkloadIdentityPoolJwksKey[]
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    resourceName string
    id str
    The provider-assigned unique ID for this managed resource.
    jwks_json str
    The raw JSON string representation of the JWKS response.
    keys Sequence[GetWorkloadIdentityPoolJwksKey]
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    resource_name str
    id String
    The provider-assigned unique ID for this managed resource.
    jwksJson String
    The raw JSON string representation of the JWKS response.
    keys List<Property Map>
    The list of public keys in the JSON Web Key Set. Structure is documented below.
    resourceName String

    Supporting Types

    GetWorkloadIdentityPoolJwksKey

    Alg string
    The algorithm intended for use with the key (e.g. RS256).
    E string
    The exponent for the RSA public key.
    Kid string
    The unique identifier for the key.
    Kty string
    The key type (e.g. RSA).
    N string
    The modulus for the RSA public key.
    Use string
    The intended use of the public key (e.g. sig).
    Alg string
    The algorithm intended for use with the key (e.g. RS256).
    E string
    The exponent for the RSA public key.
    Kid string
    The unique identifier for the key.
    Kty string
    The key type (e.g. RSA).
    N string
    The modulus for the RSA public key.
    Use string
    The intended use of the public key (e.g. sig).
    alg string
    The algorithm intended for use with the key (e.g. RS256).
    e string
    The exponent for the RSA public key.
    kid string
    The unique identifier for the key.
    kty string
    The key type (e.g. RSA).
    n string
    The modulus for the RSA public key.
    use string
    The intended use of the public key (e.g. sig).
    alg String
    The algorithm intended for use with the key (e.g. RS256).
    e String
    The exponent for the RSA public key.
    kid String
    The unique identifier for the key.
    kty String
    The key type (e.g. RSA).
    n String
    The modulus for the RSA public key.
    use String
    The intended use of the public key (e.g. sig).
    alg string
    The algorithm intended for use with the key (e.g. RS256).
    e string
    The exponent for the RSA public key.
    kid string
    The unique identifier for the key.
    kty string
    The key type (e.g. RSA).
    n string
    The modulus for the RSA public key.
    use string
    The intended use of the public key (e.g. sig).
    alg str
    The algorithm intended for use with the key (e.g. RS256).
    e str
    The exponent for the RSA public key.
    kid str
    The unique identifier for the key.
    kty str
    The key type (e.g. RSA).
    n str
    The modulus for the RSA public key.
    use str
    The intended use of the public key (e.g. sig).
    alg String
    The algorithm intended for use with the key (e.g. RS256).
    e String
    The exponent for the RSA public key.
    kid String
    The unique identifier for the key.
    kty String
    The key type (e.g. RSA).
    n String
    The modulus for the RSA public key.
    use String
    The intended use of the public key (e.g. sig).

    Package Details

    Repository
    Google Cloud (GCP) pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Viewing docs for Google Cloud v10.2.0
    published on Tuesday, Oct 20, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gcp

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial