Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. stackit
  4. API Docs
  5. ServiceAccountFederatedIdentityProvider
Viewing docs for stackit v0.0.7
published on Monday, Aug 17, 2026 by stackitcloud
Schema (JSON)
stackitcloud/pulumi-stackit

stackit.ServiceAccountFederatedIdentityProvider

stackit logo
Viewing docs for stackit v0.0.7
published on Monday, Aug 17, 2026 by stackitcloud
Schema (JSON)
stackitcloud/pulumi-stackit

    Manages a federated identity provider for a STACKIT service account to enable workload identity federation.

    Example Usage

    Create a federated identity provider

    resource "stackit_service_account" "sa" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  name       = "my-service-account"
}

resource "stackit_service_account_federated_identity_provider" "provider" {
  project_id            = stackit_service_account.sa.project_id
  service_account_email = stackit_service_account.sa.email
  name                  = "my-provider"
  issuer                = "https://auth.example.com"

  assertions = [
    {
      item     = "aud" # Including the audience check is mandatory for security reasons, the value is free to choose
      operator = "equals"
      value    = "sts.accounts.stackit.cloud"
    },
    {
      item     = "email"
      operator = "equals"
      value    = "terraform@example.com"
    }
  ]
}

    Additional Examples

    resource "stackit_service_account" "sa" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  name       = "my-service-account"
}

resource "stackit_service_account_federated_identity_provider" "provider" {
  project_id            = stackit_service_account.sa.project_id
  service_account_email = stackit_service_account.sa.email
  name                  = "gh-actions"
  issuer                = "https://token.actions.githubusercontent.com"

  assertions = [
    {
      item     = "aud"
      operator = "equals"
      value    = "sts.accounts.stackit.cloud"
    },
    {
      item     = "sub"
      operator = "equals"
      value    = "repo:stackitcloud/terraform-provider-stackit:ref:refs/heads/main"
    }
  ]
}

    Create ServiceAccountFederatedIdentityProvider Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ServiceAccountFederatedIdentityProvider(name: string, args: ServiceAccountFederatedIdentityProviderArgs, opts?: CustomResourceOptions);
    @overload
def ServiceAccountFederatedIdentityProvider(resource_name: str,
                                            args: ServiceAccountFederatedIdentityProviderArgs,
                                            opts: Optional[ResourceOptions] = None)

@overload
def ServiceAccountFederatedIdentityProvider(resource_name: str,
                                            opts: Optional[ResourceOptions] = None,
                                            assertions: Optional[Sequence[ServiceAccountFederatedIdentityProviderAssertionArgs]] = None,
                                            issuer: Optional[str] = None,
                                            project_id: Optional[str] = None,
                                            service_account_email: Optional[str] = None,
                                            name: Optional[str] = None)
    func NewServiceAccountFederatedIdentityProvider(ctx *Context, name string, args ServiceAccountFederatedIdentityProviderArgs, opts ...ResourceOption) (*ServiceAccountFederatedIdentityProvider, error)
    public ServiceAccountFederatedIdentityProvider(string name, ServiceAccountFederatedIdentityProviderArgs args, CustomResourceOptions? opts = null)
    public ServiceAccountFederatedIdentityProvider(String name, ServiceAccountFederatedIdentityProviderArgs args)
public ServiceAccountFederatedIdentityProvider(String name, ServiceAccountFederatedIdentityProviderArgs args, CustomResourceOptions options)

    type: stackit:ServiceAccountFederatedIdentityProvider
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "stackit_service_account_federated_identity_provider" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ServiceAccountFederatedIdentityProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ServiceAccountFederatedIdentityProviderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ServiceAccountFederatedIdentityProviderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ServiceAccountFederatedIdentityProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ServiceAccountFederatedIdentityProviderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var serviceAccountFederatedIdentityProviderResource = new Stackit.ServiceAccountFederatedIdentityProvider("serviceAccountFederatedIdentityProviderResource", new()
{
    Assertions = new[]
    {
        new Stackit.Inputs.ServiceAccountFederatedIdentityProviderAssertionArgs
        {
            Item = "string",
            Operator = "string",
            Value = "string",
        },
    },
    Issuer = "string",
    ProjectId = "string",
    ServiceAccountEmail = "string",
    Name = "string",
});

    example, err := stackit.NewServiceAccountFederatedIdentityProvider(ctx, "serviceAccountFederatedIdentityProviderResource", &stackit.ServiceAccountFederatedIdentityProviderArgs{
	Assertions: stackit.ServiceAccountFederatedIdentityProviderAssertionArray{
		&stackit.ServiceAccountFederatedIdentityProviderAssertionArgs{
			Item:     pulumi.String("string"),
			Operator: pulumi.String("string"),
			Value:    pulumi.String("string"),
		},
	},
	Issuer:              pulumi.String("string"),
	ProjectId:           pulumi.String("string"),
	ServiceAccountEmail: pulumi.String("string"),
	Name:                pulumi.String("string"),
})

    resource "stackit_service_account_federated_identity_provider" "serviceAccountFederatedIdentityProviderResource" {
  lifecycle {
    create_before_destroy = true
  }
  assertions {
    item     = "string"
    operator = "string"
    value    = "string"
  }
  issuer                = "string"
  project_id            = "string"
  service_account_email = "string"
  name                  = "string"
}

    var serviceAccountFederatedIdentityProviderResource = new ServiceAccountFederatedIdentityProvider("serviceAccountFederatedIdentityProviderResource", ServiceAccountFederatedIdentityProviderArgs.builder()
    .assertions(ServiceAccountFederatedIdentityProviderAssertionArgs.builder()
        .item("string")
        .operator("string")
        .value("string")
        .build())
    .issuer("string")
    .projectId("string")
    .serviceAccountEmail("string")
    .name("string")
    .build());

    service_account_federated_identity_provider_resource = stackit.ServiceAccountFederatedIdentityProvider("serviceAccountFederatedIdentityProviderResource",
    assertions=[{
        "item": "string",
        "operator": "string",
        "value": "string",
    }],
    issuer="string",
    project_id="string",
    service_account_email="string",
    name="string")

    const serviceAccountFederatedIdentityProviderResource = new stackit.ServiceAccountFederatedIdentityProvider("serviceAccountFederatedIdentityProviderResource", {
    assertions: [{
        item: "string",
        operator: "string",
        value: "string",
    }],
    issuer: "string",
    projectId: "string",
    serviceAccountEmail: "string",
    name: "string",
});

    type: stackit:ServiceAccountFederatedIdentityProvider
properties:
    assertions:
        - item: string
          operator: string
          value: string
    issuer: string
    name: string
    projectId: string
    serviceAccountEmail: string

    ServiceAccountFederatedIdentityProvider Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ServiceAccountFederatedIdentityProvider resource accepts the following input properties:

    Assertions List<ServiceAccountFederatedIdentityProviderAssertion>
    The assertions for the federated identity provider.
    Issuer string
    The issuer URL.
    ProjectId string
    The STACKIT project ID associated with the service account.
    ServiceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    Name string
    The name of the federated identity provider.
    Assertions []ServiceAccountFederatedIdentityProviderAssertionArgs
    The assertions for the federated identity provider.
    Issuer string
    The issuer URL.
    ProjectId string
    The STACKIT project ID associated with the service account.
    ServiceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    Name string
    The name of the federated identity provider.
    assertions list(object)
    The assertions for the federated identity provider.
    issuer string
    The issuer URL.
    project_id string
    The STACKIT project ID associated with the service account.
    service_account_email string
    The email address associated with the service account, used for account identification and communication.
    name string
    The name of the federated identity provider.
    assertions List<ServiceAccountFederatedIdentityProviderAssertion>
    The assertions for the federated identity provider.
    issuer String
    The issuer URL.
    projectId String
    The STACKIT project ID associated with the service account.
    serviceAccountEmail String
    The email address associated with the service account, used for account identification and communication.
    name String
    The name of the federated identity provider.
    assertions ServiceAccountFederatedIdentityProviderAssertion[]
    The assertions for the federated identity provider.
    issuer string
    The issuer URL.
    projectId string
    The STACKIT project ID associated with the service account.
    serviceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    name string
    The name of the federated identity provider.
    assertions Sequence[ServiceAccountFederatedIdentityProviderAssertionArgs]
    The assertions for the federated identity provider.
    issuer str
    The issuer URL.
    project_id str
    The STACKIT project ID associated with the service account.
    service_account_email str
    The email address associated with the service account, used for account identification and communication.
    name str
    The name of the federated identity provider.
    assertions List<Property Map>
    The assertions for the federated identity provider.
    issuer String
    The issuer URL.
    projectId String
    The STACKIT project ID associated with the service account.
    serviceAccountEmail String
    The email address associated with the service account, used for account identification and communication.
    name String
    The name of the federated identity provider.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ServiceAccountFederatedIdentityProvider resource produces the following output properties:

    FederationId string
    The unique identifier for the federated identity provider associated with the service account.
    Id string
    The provider-assigned unique ID for this managed resource.
    FederationId string
    The unique identifier for the federated identity provider associated with the service account.
    Id string
    The provider-assigned unique ID for this managed resource.
    federation_id string
    The unique identifier for the federated identity provider associated with the service account.
    id string
    The provider-assigned unique ID for this managed resource.
    federationId String
    The unique identifier for the federated identity provider associated with the service account.
    id String
    The provider-assigned unique ID for this managed resource.
    federationId string
    The unique identifier for the federated identity provider associated with the service account.
    id string
    The provider-assigned unique ID for this managed resource.
    federation_id str
    The unique identifier for the federated identity provider associated with the service account.
    id str
    The provider-assigned unique ID for this managed resource.
    federationId String
    The unique identifier for the federated identity provider associated with the service account.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ServiceAccountFederatedIdentityProvider Resource

    Get an existing ServiceAccountFederatedIdentityProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ServiceAccountFederatedIdentityProviderState, opts?: CustomResourceOptions): ServiceAccountFederatedIdentityProvider
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        assertions: Optional[Sequence[ServiceAccountFederatedIdentityProviderAssertionArgs]] = None,
        federation_id: Optional[str] = None,
        issuer: Optional[str] = None,
        name: Optional[str] = None,
        project_id: Optional[str] = None,
        service_account_email: Optional[str] = None) -> ServiceAccountFederatedIdentityProvider
    func GetServiceAccountFederatedIdentityProvider(ctx *Context, name string, id IDInput, state *ServiceAccountFederatedIdentityProviderState, opts ...ResourceOption) (*ServiceAccountFederatedIdentityProvider, error)
    public static ServiceAccountFederatedIdentityProvider Get(string name, Input<string> id, ServiceAccountFederatedIdentityProviderState? state, CustomResourceOptions? opts = null)
    public static ServiceAccountFederatedIdentityProvider get(String name, Output<String> id, ServiceAccountFederatedIdentityProviderState state, CustomResourceOptions options)
    resources:  _:    type: stackit:ServiceAccountFederatedIdentityProvider    get:      id: ${id}
    import {
  to = stackit_service_account_federated_identity_provider.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Assertions List<ServiceAccountFederatedIdentityProviderAssertion>
    The assertions for the federated identity provider.
    FederationId string
    The unique identifier for the federated identity provider associated with the service account.
    Issuer string
    The issuer URL.
    Name string
    The name of the federated identity provider.
    ProjectId string
    The STACKIT project ID associated with the service account.
    ServiceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    Assertions []ServiceAccountFederatedIdentityProviderAssertionArgs
    The assertions for the federated identity provider.
    FederationId string
    The unique identifier for the federated identity provider associated with the service account.
    Issuer string
    The issuer URL.
    Name string
    The name of the federated identity provider.
    ProjectId string
    The STACKIT project ID associated with the service account.
    ServiceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    assertions list(object)
    The assertions for the federated identity provider.
    federation_id string
    The unique identifier for the federated identity provider associated with the service account.
    issuer string
    The issuer URL.
    name string
    The name of the federated identity provider.
    project_id string
    The STACKIT project ID associated with the service account.
    service_account_email string
    The email address associated with the service account, used for account identification and communication.
    assertions List<ServiceAccountFederatedIdentityProviderAssertion>
    The assertions for the federated identity provider.
    federationId String
    The unique identifier for the federated identity provider associated with the service account.
    issuer String
    The issuer URL.
    name String
    The name of the federated identity provider.
    projectId String
    The STACKIT project ID associated with the service account.
    serviceAccountEmail String
    The email address associated with the service account, used for account identification and communication.
    assertions ServiceAccountFederatedIdentityProviderAssertion[]
    The assertions for the federated identity provider.
    federationId string
    The unique identifier for the federated identity provider associated with the service account.
    issuer string
    The issuer URL.
    name string
    The name of the federated identity provider.
    projectId string
    The STACKIT project ID associated with the service account.
    serviceAccountEmail string
    The email address associated with the service account, used for account identification and communication.
    assertions Sequence[ServiceAccountFederatedIdentityProviderAssertionArgs]
    The assertions for the federated identity provider.
    federation_id str
    The unique identifier for the federated identity provider associated with the service account.
    issuer str
    The issuer URL.
    name str
    The name of the federated identity provider.
    project_id str
    The STACKIT project ID associated with the service account.
    service_account_email str
    The email address associated with the service account, used for account identification and communication.
    assertions List<Property Map>
    The assertions for the federated identity provider.
    federationId String
    The unique identifier for the federated identity provider associated with the service account.
    issuer String
    The issuer URL.
    name String
    The name of the federated identity provider.
    projectId String
    The STACKIT project ID associated with the service account.
    serviceAccountEmail String
    The email address associated with the service account, used for account identification and communication.

    Supporting Types

    ServiceAccountFederatedIdentityProviderAssertion, ServiceAccountFederatedIdentityProviderAssertionArgs

    Item string
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    Operator string
    The assertion operator. Currently, the only supported operator is "equals".
    Value string
    The assertion value.
    Item string
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    Operator string
    The assertion operator. Currently, the only supported operator is "equals".
    Value string
    The assertion value.
    item string
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    operator string
    The assertion operator. Currently, the only supported operator is "equals".
    value string
    The assertion value.
    item String
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    operator String
    The assertion operator. Currently, the only supported operator is "equals".
    value String
    The assertion value.
    item string
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    operator string
    The assertion operator. Currently, the only supported operator is "equals".
    value string
    The assertion value.
    item str
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    operator str
    The assertion operator. Currently, the only supported operator is "equals".
    value str
    The assertion value.
    item String
    The assertion claim. At least one assertion with the claim "aud" is required for security reasons.
    operator String
    The assertion operator. Currently, the only supported operator is "equals".
    value String
    The assertion value.

    Import

    In Terraform v1.5.0 and later, the + "" + import + “" + block can be used with the + "” + id + “" + attribute, for example:

    # Only use the import statement, if you want to import an existing federated identity provider
import {
  to = stackit_service_account_federated_identity_provider.import-example
  id = "${var.project_id},${var.service_account_email},${var.federation_id}"
}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    stackit stackitcloud/pulumi-stackit
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the stackit Terraform Provider.
    stackit logo
    Viewing docs for stackit v0.0.7
    published on Monday, Aug 17, 2026 by stackitcloud
    Schema (JSON)
    stackitcloud/pulumi-stackit

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial