1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. iam
  5. WorkforcePoolProviderScimTenant
Viewing docs for Google Cloud v9.15.0
published on Thursday, Mar 12, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

gcp.iam.WorkforcePoolProviderScimTenant

gcp logo
Viewing docs for Google Cloud v9.15.0
published on Thursday, Mar 12, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

    Represents a SCIM tenant configuration for a Workforce Pool Provider. The SCIM tenant configuration allows for the synchronization of user/group identities from external identity provider into Google Cloud using the System for Cross-domain Identity Management (SCIM) protocol.

    To get more information about WorkforcePoolProviderScimTenant, see:

    Example Usage

    Iam Workforce Pool Provider Scim Tenant Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const pool = new gcp.iam.WorkforcePool("pool", {
    workforcePoolId: "example-pool",
    parent: "organizations/123456789",
    location: "global",
});
const provider = new gcp.iam.WorkforcePoolProvider("provider", {
    location: "global",
    workforcePoolId: pool.workforcePoolId,
    providerId: "example-prvdr",
    attributeMapping: {
        "google.subject": "assertion.sub",
    },
    oidc: {
        issuerUri: "https://accounts.thirdparty.com",
        clientId: "client-id",
        clientSecret: {
            value: {
                plainText: "client-secret",
            },
        },
        webSsoConfig: {
            responseType: "CODE",
            assertionClaimsBehavior: "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
            additionalScopes: [
                "groups",
                "roles",
            ],
        },
    },
    displayName: "Display name",
    description: "A sample OIDC workforce pool provider.",
    disabled: false,
    attributeCondition: "true",
});
const example = new gcp.iam.WorkforcePoolProviderScimTenant("example", {
    location: "global",
    workforcePoolId: pool.workforcePoolId,
    providerId: provider.providerId,
    scimTenantId: "example-scim-tenant",
    displayName: "Example SCIM Tenant",
    description: "A basic SCIM tenant for IAM Workforce Pool Provider",
    claimMapping: {
        "google.subject": "user.externalId",
        "google.group": "group.externalId",
    },
    hardDelete: true,
});

    import pulumi
import pulumi_gcp as gcp

pool = gcp.iam.WorkforcePool("pool",
    workforce_pool_id="example-pool",
    parent="organizations/123456789",
    location="global")
provider = gcp.iam.WorkforcePoolProvider("provider",
    location="global",
    workforce_pool_id=pool.workforce_pool_id,
    provider_id="example-prvdr",
    attribute_mapping={
        "google.subject": "assertion.sub",
    },
    oidc={
        "issuer_uri": "https://accounts.thirdparty.com",
        "client_id": "client-id",
        "client_secret": {
            "value": {
                "plain_text": "client-secret",
            },
        },
        "web_sso_config": {
            "response_type": "CODE",
            "assertion_claims_behavior": "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
            "additional_scopes": [
                "groups",
                "roles",
            ],
        },
    },
    display_name="Display name",
    description="A sample OIDC workforce pool provider.",
    disabled=False,
    attribute_condition="true")
example = gcp.iam.WorkforcePoolProviderScimTenant("example",
    location="global",
    workforce_pool_id=pool.workforce_pool_id,
    provider_id=provider.provider_id,
    scim_tenant_id="example-scim-tenant",
    display_name="Example SCIM Tenant",
    description="A basic SCIM tenant for IAM Workforce Pool Provider",
    claim_mapping={
        "google.subject": "user.externalId",
        "google.group": "group.externalId",
    },
    hard_delete=True)

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		provider, err := iam.NewWorkforcePoolProvider(ctx, "provider", &iam.WorkforcePoolProviderArgs{
			Location:        pulumi.String("global"),
			WorkforcePoolId: pool.WorkforcePoolId,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Oidc: &iam.WorkforcePoolProviderOidcArgs{
				IssuerUri: pulumi.String("https://accounts.thirdparty.com"),
				ClientId:  pulumi.String("client-id"),
				ClientSecret: &iam.WorkforcePoolProviderOidcClientSecretArgs{
					Value: &iam.WorkforcePoolProviderOidcClientSecretValueArgs{
						PlainText: pulumi.String("client-secret"),
					},
				},
				WebSsoConfig: &iam.WorkforcePoolProviderOidcWebSsoConfigArgs{
					ResponseType:            pulumi.String("CODE"),
					AssertionClaimsBehavior: pulumi.String("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"),
					AdditionalScopes: pulumi.StringArray{
						pulumi.String("groups"),
						pulumi.String("roles"),
					},
				},
			},
			DisplayName:        pulumi.String("Display name"),
			Description:        pulumi.String("A sample OIDC workforce pool provider."),
			Disabled:           pulumi.Bool(false),
			AttributeCondition: pulumi.String("true"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProviderScimTenant(ctx, "example", &iam.WorkforcePoolProviderScimTenantArgs{
			Location:        pulumi.String("global"),
			WorkforcePoolId: pool.WorkforcePoolId,
			ProviderId:      provider.ProviderId,
			ScimTenantId:    pulumi.String("example-scim-tenant"),
			DisplayName:     pulumi.String("Example SCIM Tenant"),
			Description:     pulumi.String("A basic SCIM tenant for IAM Workforce Pool Provider"),
			ClaimMapping: pulumi.StringMap{
				"google.subject": pulumi.String("user.externalId"),
				"google.group":   pulumi.String("group.externalId"),
			},
			HardDelete: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var pool = new Gcp.Iam.WorkforcePool("pool", new()
    {
        WorkforcePoolId = "example-pool",
        Parent = "organizations/123456789",
        Location = "global",
    });

    var provider = new Gcp.Iam.WorkforcePoolProvider("provider", new()
    {
        Location = "global",
        WorkforcePoolId = pool.WorkforcePoolId,
        ProviderId = "example-prvdr",
        AttributeMapping = 
        {
            { "google.subject", "assertion.sub" },
        },
        Oidc = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcArgs
        {
            IssuerUri = "https://accounts.thirdparty.com",
            ClientId = "client-id",
            ClientSecret = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcClientSecretArgs
            {
                Value = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcClientSecretValueArgs
                {
                    PlainText = "client-secret",
                },
            },
            WebSsoConfig = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcWebSsoConfigArgs
            {
                ResponseType = "CODE",
                AssertionClaimsBehavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
                AdditionalScopes = new[]
                {
                    "groups",
                    "roles",
                },
            },
        },
        DisplayName = "Display name",
        Description = "A sample OIDC workforce pool provider.",
        Disabled = false,
        AttributeCondition = "true",
    });

    var example = new Gcp.Iam.WorkforcePoolProviderScimTenant("example", new()
    {
        Location = "global",
        WorkforcePoolId = pool.WorkforcePoolId,
        ProviderId = provider.ProviderId,
        ScimTenantId = "example-scim-tenant",
        DisplayName = "Example SCIM Tenant",
        Description = "A basic SCIM tenant for IAM Workforce Pool Provider",
        ClaimMapping = 
        {
            { "google.subject", "user.externalId" },
            { "google.group", "group.externalId" },
        },
        HardDelete = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretValueArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcWebSsoConfigArgs;
import com.pulumi.gcp.iam.WorkforcePoolProviderScimTenant;
import com.pulumi.gcp.iam.WorkforcePoolProviderScimTenantArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());

        var provider = new WorkforcePoolProvider("provider", WorkforcePoolProviderArgs.builder()
            .location("global")
            .workforcePoolId(pool.workforcePoolId())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .oidc(WorkforcePoolProviderOidcArgs.builder()
                .issuerUri("https://accounts.thirdparty.com")
                .clientId("client-id")
                .clientSecret(WorkforcePoolProviderOidcClientSecretArgs.builder()
                    .value(WorkforcePoolProviderOidcClientSecretValueArgs.builder()
                        .plainText("client-secret")
                        .build())
                    .build())
                .webSsoConfig(WorkforcePoolProviderOidcWebSsoConfigArgs.builder()
                    .responseType("CODE")
                    .assertionClaimsBehavior("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS")
                    .additionalScopes(                    
                        "groups",
                        "roles")
                    .build())
                .build())
            .displayName("Display name")
            .description("A sample OIDC workforce pool provider.")
            .disabled(false)
            .attributeCondition("true")
            .build());

        var example = new WorkforcePoolProviderScimTenant("example", WorkforcePoolProviderScimTenantArgs.builder()
            .location("global")
            .workforcePoolId(pool.workforcePoolId())
            .providerId(provider.providerId())
            .scimTenantId("example-scim-tenant")
            .displayName("Example SCIM Tenant")
            .description("A basic SCIM tenant for IAM Workforce Pool Provider")
            .claimMapping(Map.ofEntries(
                Map.entry("google.subject", "user.externalId"),
                Map.entry("google.group", "group.externalId")
            ))
            .hardDelete(true)
            .build());

    }
}

    resources:
  pool:
    type: gcp:iam:WorkforcePool
    properties:
      workforcePoolId: example-pool
      parent: organizations/123456789
      location: global
  provider:
    type: gcp:iam:WorkforcePoolProvider
    properties:
      location: global
      workforcePoolId: ${pool.workforcePoolId}
      providerId: example-prvdr
      attributeMapping:
        google.subject: assertion.sub
      oidc:
        issuerUri: https://accounts.thirdparty.com
        clientId: client-id
        clientSecret:
          value:
            plainText: client-secret
        webSsoConfig:
          responseType: CODE
          assertionClaimsBehavior: MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS
          additionalScopes:
            - groups
            - roles
      displayName: Display name
      description: A sample OIDC workforce pool provider.
      disabled: false
      attributeCondition: 'true'
  example:
    type: gcp:iam:WorkforcePoolProviderScimTenant
    properties:
      location: global
      workforcePoolId: ${pool.workforcePoolId}
      providerId: ${provider.providerId}
      scimTenantId: example-scim-tenant
      displayName: Example SCIM Tenant
      description: A basic SCIM tenant for IAM Workforce Pool Provider
      claimMapping:
        google.subject: user.externalId
        google.group: group.externalId
      hardDelete: true # state, base_uri, purge_time and service_agent are output only, not settable

    Create WorkforcePoolProviderScimTenant Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new WorkforcePoolProviderScimTenant(name: string, args: WorkforcePoolProviderScimTenantArgs, opts?: CustomResourceOptions);
    @overload
def WorkforcePoolProviderScimTenant(resource_name: str,
                                    args: WorkforcePoolProviderScimTenantArgs,
                                    opts: Optional[ResourceOptions] = None)

@overload
def WorkforcePoolProviderScimTenant(resource_name: str,
                                    opts: Optional[ResourceOptions] = None,
                                    location: Optional[str] = None,
                                    provider_id: Optional[str] = None,
                                    scim_tenant_id: Optional[str] = None,
                                    workforce_pool_id: Optional[str] = None,
                                    claim_mapping: Optional[Mapping[str, str]] = None,
                                    description: Optional[str] = None,
                                    display_name: Optional[str] = None,
                                    hard_delete: Optional[bool] = None)
    func NewWorkforcePoolProviderScimTenant(ctx *Context, name string, args WorkforcePoolProviderScimTenantArgs, opts ...ResourceOption) (*WorkforcePoolProviderScimTenant, error)
    public WorkforcePoolProviderScimTenant(string name, WorkforcePoolProviderScimTenantArgs args, CustomResourceOptions? opts = null)
    public WorkforcePoolProviderScimTenant(String name, WorkforcePoolProviderScimTenantArgs args)
public WorkforcePoolProviderScimTenant(String name, WorkforcePoolProviderScimTenantArgs args, CustomResourceOptions options)

    type: gcp:iam:WorkforcePoolProviderScimTenant
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args WorkforcePoolProviderScimTenantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args WorkforcePoolProviderScimTenantArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args WorkforcePoolProviderScimTenantArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args WorkforcePoolProviderScimTenantArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args WorkforcePoolProviderScimTenantArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var workforcePoolProviderScimTenantResource = new Gcp.Iam.WorkforcePoolProviderScimTenant("workforcePoolProviderScimTenantResource", new()
{
    Location = "string",
    ProviderId = "string",
    ScimTenantId = "string",
    WorkforcePoolId = "string",
    ClaimMapping = 
    {
        { "string", "string" },
    },
    Description = "string",
    DisplayName = "string",
    HardDelete = false,
});

    example, err := iam.NewWorkforcePoolProviderScimTenant(ctx, "workforcePoolProviderScimTenantResource", &iam.WorkforcePoolProviderScimTenantArgs{
	Location:        pulumi.String("string"),
	ProviderId:      pulumi.String("string"),
	ScimTenantId:    pulumi.String("string"),
	WorkforcePoolId: pulumi.String("string"),
	ClaimMapping: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Description: pulumi.String("string"),
	DisplayName: pulumi.String("string"),
	HardDelete:  pulumi.Bool(false),
})

    var workforcePoolProviderScimTenantResource = new WorkforcePoolProviderScimTenant("workforcePoolProviderScimTenantResource", WorkforcePoolProviderScimTenantArgs.builder()
    .location("string")
    .providerId("string")
    .scimTenantId("string")
    .workforcePoolId("string")
    .claimMapping(Map.of("string", "string"))
    .description("string")
    .displayName("string")
    .hardDelete(false)
    .build());

    workforce_pool_provider_scim_tenant_resource = gcp.iam.WorkforcePoolProviderScimTenant("workforcePoolProviderScimTenantResource",
    location="string",
    provider_id="string",
    scim_tenant_id="string",
    workforce_pool_id="string",
    claim_mapping={
        "string": "string",
    },
    description="string",
    display_name="string",
    hard_delete=False)

    const workforcePoolProviderScimTenantResource = new gcp.iam.WorkforcePoolProviderScimTenant("workforcePoolProviderScimTenantResource", {
    location: "string",
    providerId: "string",
    scimTenantId: "string",
    workforcePoolId: "string",
    claimMapping: {
        string: "string",
    },
    description: "string",
    displayName: "string",
    hardDelete: false,
});

    type: gcp:iam:WorkforcePoolProviderScimTenant
properties:
    claimMapping:
        string: string
    description: string
    displayName: string
    hardDelete: false
    location: string
    providerId: string
    scimTenantId: string
    workforcePoolId: string

    WorkforcePoolProviderScimTenant Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The WorkforcePoolProviderScimTenant resource accepts the following input properties:

    Location string
    The location for the resource.
    ProviderId string
    The ID of the provider.
    ScimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    WorkforcePoolId string
    The ID of the workforce pool.
    ClaimMapping Dictionary<string, string>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    Description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    DisplayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    HardDelete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    Location string
    The location for the resource.
    ProviderId string
    The ID of the provider.
    ScimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    WorkforcePoolId string
    The ID of the workforce pool.
    ClaimMapping map[string]string
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    Description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    DisplayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    HardDelete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location String
    The location for the resource.
    providerId String
    The ID of the provider.
    scimTenantId String
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    workforcePoolId String
    The ID of the workforce pool.
    claimMapping Map<String,String>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description String
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName String
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete Boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location string
    The location for the resource.
    providerId string
    The ID of the provider.
    scimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    workforcePoolId string
    The ID of the workforce pool.
    claimMapping {[key: string]: string}
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location str
    The location for the resource.
    provider_id str
    The ID of the provider.
    scim_tenant_id str
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    workforce_pool_id str
    The ID of the workforce pool.
    claim_mapping Mapping[str, str]
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description str
    A user-specified description of the provider. Cannot exceed 256 characters.
    display_name str
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hard_delete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location String
    The location for the resource.
    providerId String
    The ID of the provider.
    scimTenantId String
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    workforcePoolId String
    The ID of the workforce pool.
    claimMapping Map<String>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description String
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName String
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete Boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the WorkforcePoolProviderScimTenant resource produces the following output properties:

    BaseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    PurgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    ServiceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    State string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    BaseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    PurgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    ServiceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    State string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    baseUri String
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    purgeTime String
    The timestamp that represents the time when the SCIM tenant is purged.
    serviceAgent String
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state String
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    baseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    purgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    serviceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    base_uri str
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    purge_time str
    The timestamp that represents the time when the SCIM tenant is purged.
    service_agent str
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state str
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    baseUri String
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    purgeTime String
    The timestamp that represents the time when the SCIM tenant is purged.
    serviceAgent String
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state String
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.

    Look up Existing WorkforcePoolProviderScimTenant Resource

    Get an existing WorkforcePoolProviderScimTenant resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: WorkforcePoolProviderScimTenantState, opts?: CustomResourceOptions): WorkforcePoolProviderScimTenant
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        base_uri: Optional[str] = None,
        claim_mapping: Optional[Mapping[str, str]] = None,
        description: Optional[str] = None,
        display_name: Optional[str] = None,
        hard_delete: Optional[bool] = None,
        location: Optional[str] = None,
        name: Optional[str] = None,
        provider_id: Optional[str] = None,
        purge_time: Optional[str] = None,
        scim_tenant_id: Optional[str] = None,
        service_agent: Optional[str] = None,
        state: Optional[str] = None,
        workforce_pool_id: Optional[str] = None) -> WorkforcePoolProviderScimTenant
    func GetWorkforcePoolProviderScimTenant(ctx *Context, name string, id IDInput, state *WorkforcePoolProviderScimTenantState, opts ...ResourceOption) (*WorkforcePoolProviderScimTenant, error)
    public static WorkforcePoolProviderScimTenant Get(string name, Input<string> id, WorkforcePoolProviderScimTenantState? state, CustomResourceOptions? opts = null)
    public static WorkforcePoolProviderScimTenant get(String name, Output<String> id, WorkforcePoolProviderScimTenantState state, CustomResourceOptions options)
    resources:  _:    type: gcp:iam:WorkforcePoolProviderScimTenant    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    BaseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    ClaimMapping Dictionary<string, string>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    Description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    DisplayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    HardDelete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    Location string
    The location for the resource.
    Name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    ProviderId string
    The ID of the provider.
    PurgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    ScimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    ServiceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    State string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    WorkforcePoolId string
    The ID of the workforce pool.
    BaseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    ClaimMapping map[string]string
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    Description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    DisplayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    HardDelete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    Location string
    The location for the resource.
    Name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    ProviderId string
    The ID of the provider.
    PurgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    ScimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    ServiceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    State string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    WorkforcePoolId string
    The ID of the workforce pool.
    baseUri String
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    claimMapping Map<String,String>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description String
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName String
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete Boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location String
    The location for the resource.
    name String
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    providerId String
    The ID of the provider.
    purgeTime String
    The timestamp that represents the time when the SCIM tenant is purged.
    scimTenantId String
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    serviceAgent String
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state String
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    workforcePoolId String
    The ID of the workforce pool.
    baseUri string
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    claimMapping {[key: string]: string}
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description string
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName string
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location string
    The location for the resource.
    name string
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    providerId string
    The ID of the provider.
    purgeTime string
    The timestamp that represents the time when the SCIM tenant is purged.
    scimTenantId string
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    serviceAgent string
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state string
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    workforcePoolId string
    The ID of the workforce pool.
    base_uri str
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    claim_mapping Mapping[str, str]
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description str
    A user-specified description of the provider. Cannot exceed 256 characters.
    display_name str
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hard_delete bool
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location str
    The location for the resource.
    name str
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    provider_id str
    The ID of the provider.
    purge_time str
    The timestamp that represents the time when the SCIM tenant is purged.
    scim_tenant_id str
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    service_agent str
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state str
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    workforce_pool_id str
    The ID of the workforce pool.
    baseUri String
    Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
    claimMapping Map<String>
    Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.
    description String
    A user-specified description of the provider. Cannot exceed 256 characters.
    displayName String
    A user-specified display name for the scim tenant. Cannot exceed 32 characters.
    hardDelete Boolean
    Deletes the SCIM tenant immediately. This operation cannot be undone.
    location String
    The location for the resource.
    name String
    Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
    providerId String
    The ID of the provider.
    purgeTime String
    The timestamp that represents the time when the SCIM tenant is purged.
    scimTenantId String
    The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
    serviceAgent String
    Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
    state String
    The current state of the scim tenant.

    • ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
    • DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently deleted after approximately 30 days.
    workforcePoolId String
    The ID of the workforce pool.

    Import

    WorkforcePoolProviderScimTenant can be imported using any of these accepted formats:

    • locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}
    • {{location}}/{{workforce_pool_id}}/{{provider_id}}/{{scim_tenant_id}}

    When using the pulumi import command, WorkforcePoolProviderScimTenant can be imported using one of the formats above. For example:

    $ pulumi import gcp:iam/workforcePoolProviderScimTenant:WorkforcePoolProviderScimTenant default locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}
$ pulumi import gcp:iam/workforcePoolProviderScimTenant:WorkforcePoolProviderScimTenant default {{location}}/{{workforce_pool_id}}/{{provider_id}}/{{scim_tenant_id}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Viewing docs for Google Cloud v9.15.0
    published on Thursday, Mar 12, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gcp
      Try Pulumi Cloud free. Your team will thank you.