pulumiservice.buildStackScopedPermissions

Pulumi Cloud v0.39.0, Apr 28 26

This provider is currently in preview.

Viewing docs for Pulumi Cloud v0.39.0
published on Tuesday, Apr 28, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-pulumiservice

This provider is currently in preview.

Viewing docs for Pulumi Cloud v0.39.0
published on Tuesday, Apr 28, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-pulumiservice

Builds an OrganizationRole.permissions descriptor that grants the supplied scopes only on the named stack. The stackId is the stack’s opaque Pulumi Cloud identifier — distinct from the organization/project/stack triple. The result is directly assignable to OrganizationRole.permissions. To grant scopes on more than one entity in a single role, hand-roll a group whose entries list pulls the output of each helper.

Using buildStackScopedPermissions

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function buildStackScopedPermissions(args: BuildStackScopedPermissionsArgs, opts?: InvokeOptions): Promise<BuildStackScopedPermissionsResult>
function buildStackScopedPermissionsOutput(args: BuildStackScopedPermissionsOutputArgs, opts?: InvokeOptions): Output<BuildStackScopedPermissionsResult>

def build_stack_scoped_permissions(permissions: Optional[Sequence[str]] = None,
                                   stack_id: Optional[str] = None,
                                   opts: Optional[InvokeOptions] = None) -> BuildStackScopedPermissionsResult
def build_stack_scoped_permissions_output(permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                                   stack_id: Optional[pulumi.Input[str]] = None,
                                   opts: Optional[InvokeOptions] = None) -> Output[BuildStackScopedPermissionsResult]

func BuildStackScopedPermissions(ctx *Context, args *BuildStackScopedPermissionsArgs, opts ...InvokeOption) (*BuildStackScopedPermissionsResult, error)
func BuildStackScopedPermissionsOutput(ctx *Context, args *BuildStackScopedPermissionsOutputArgs, opts ...InvokeOption) BuildStackScopedPermissionsResultOutput

> Note: This function is named BuildStackScopedPermissions in the Go SDK.

public static class BuildStackScopedPermissions 
{
    public static Task<BuildStackScopedPermissionsResult> InvokeAsync(BuildStackScopedPermissionsArgs args, InvokeOptions? opts = null)
    public static Output<BuildStackScopedPermissionsResult> Invoke(BuildStackScopedPermissionsInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<BuildStackScopedPermissionsResult> buildStackScopedPermissions(BuildStackScopedPermissionsArgs args, InvokeOptions options)
public static Output<BuildStackScopedPermissionsResult> buildStackScopedPermissions(BuildStackScopedPermissionsArgs args, InvokeOptions options)

fn::invoke:
  function: pulumiservice:buildStackScopedPermissions
  arguments:
    # arguments dictionary

The following arguments are supported:

Permissions List<string>: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
StackId string: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

Permissions []string: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
StackId string: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

permissions List<String>: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
stackId String: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

permissions string[]: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
stackId string: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

permissions Sequence[str]: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
stack_id str: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

permissions List<String>: The set of stack:* scopes to grant on the target stack (e.g. stack:read, stack:edit, stack:admin). Discover valid scope names via the getOrganizationRoleScopes data source.
stackId String: The target stack's opaque Pulumi Cloud identifier (not the organization/project/stack triple).

buildStackScopedPermissions Result

The following output properties are available:

Permissions Dictionary<string, object>: A kind: allow descriptor with an on: { stack: <id> } modifier, ready to assign to OrganizationRole.permissions.

Permissions map[string]interface{}: A kind: allow descriptor with an on: { stack: <id> } modifier, ready to assign to OrganizationRole.permissions.

permissions Map<String,Object>: A kind: allow descriptor with an on: { stack: <id> } modifier, ready to assign to OrganizationRole.permissions.

permissions {[key: string]: any}: A kind: allow descriptor with an on: { stack: <id> } modifier, ready to assign to OrganizationRole.permissions.

permissions Mapping[str, Any]: A kind: allow descriptor with an on: { stack: <id> } modifier, ready to assign to OrganizationRole.permissions.