Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Vercel Provider
  4. API Docs
  5. OidcFederationPolicy
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

vercel.OidcFederationPolicy

vercel logo vercel logo
Viewing docs for Vercel v5.21.1
published on Thursday, Oct 15, 2026 by Pulumiverse
Schema (JSON)
pulumiverse/pulumi-vercel

    Provides an OIDC Federation Policy resource.

    OIDC federation policies allow trusted external workloads to exchange an OIDC token for a short-lived Vercel access token. The client selects the Vercel CLI receiving access, while claims constrain the external workload identity.

    This API currently supports first-party CLI clients enabled for the team, including the Vercel CLI and Turborepo CLI. The API token used by the provider must have permission to manage OIDC federation policies for the team.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vercel from "@pulumiverse/vercel";

const turborepoGithubActions = new vercel.OidcFederationPolicy("turborepo_github_actions", {
    name: "Turborepo for acme/widgets GitHub Workflows",
    client: "turborepo",
    issuerUrl: "https://token.actions.githubusercontent.com",
    claims: [
        {
            name: "aud",
            values: [{
                value: "https://vercel.com/api/login/oauth/token",
            }],
        },
        {
            name: "repository",
            values: [{
                value: "acme/widgets",
            }],
        },
    ],
    permissions: ["read-write:remote-cache"],
    resources: {
        projectIds: ["*"],
    },
});

    import pulumi
import pulumiverse_vercel as vercel

turborepo_github_actions = vercel.OidcFederationPolicy("turborepo_github_actions",
    name="Turborepo for acme/widgets GitHub Workflows",
    client="turborepo",
    issuer_url="https://token.actions.githubusercontent.com",
    claims=[
        {
            "name": "aud",
            "values": [{
                "value": "https://vercel.com/api/login/oauth/token",
            }],
        },
        {
            "name": "repository",
            "values": [{
                "value": "acme/widgets",
            }],
        },
    ],
    permissions=["read-write:remote-cache"],
    resources={
        "project_ids": ["*"],
    })

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-vercel/sdk/v5/go/vercel"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vercel.NewOidcFederationPolicy(ctx, "turborepo_github_actions", &vercel.OidcFederationPolicyArgs{
			Name:      pulumi.String("Turborepo for acme/widgets GitHub Workflows"),
			Client:    pulumi.String("turborepo"),
			IssuerUrl: pulumi.String("https://token.actions.githubusercontent.com"),
			Claims: vercel.OidcFederationPolicyClaimArray{
				&vercel.OidcFederationPolicyClaimArgs{
					Name: pulumi.String("aud"),
					Values: vercel.OidcFederationPolicyClaimValueArray{
						&vercel.OidcFederationPolicyClaimValueArgs{
							Value: pulumi.String("https://vercel.com/api/login/oauth/token"),
						},
					},
				},
				&vercel.OidcFederationPolicyClaimArgs{
					Name: pulumi.String("repository"),
					Values: vercel.OidcFederationPolicyClaimValueArray{
						&vercel.OidcFederationPolicyClaimValueArgs{
							Value: pulumi.String("acme/widgets"),
						},
					},
				},
			},
			Permissions: pulumi.StringArray{
				pulumi.String("read-write:remote-cache"),
			},
			Resources: &vercel.OidcFederationPolicyResourcesArgs{
				ProjectIds: pulumi.StringArray{
					pulumi.String("*"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vercel = Pulumiverse.Vercel;

return await Deployment.RunAsync(() => 
{
    var turborepoGithubActions = new Vercel.OidcFederationPolicy("turborepo_github_actions", new()
    {
        Name = "Turborepo for acme/widgets GitHub Workflows",
        Client = "turborepo",
        IssuerUrl = "https://token.actions.githubusercontent.com",
        Claims = new[]
        {
            new Vercel.Inputs.OidcFederationPolicyClaimArgs
            {
                Name = "aud",
                Values = new[]
                {
                    new Vercel.Inputs.OidcFederationPolicyClaimValueArgs
                    {
                        Value = "https://vercel.com/api/login/oauth/token",
                    },
                },
            },
            new Vercel.Inputs.OidcFederationPolicyClaimArgs
            {
                Name = "repository",
                Values = new[]
                {
                    new Vercel.Inputs.OidcFederationPolicyClaimValueArgs
                    {
                        Value = "acme/widgets",
                    },
                },
            },
        },
        Permissions = new[]
        {
            "read-write:remote-cache",
        },
        Resources = new Vercel.Inputs.OidcFederationPolicyResourcesArgs
        {
            ProjectIds = new[]
            {
                "*",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumiverse.vercel.OidcFederationPolicy;
import com.pulumiverse.vercel.OidcFederationPolicyArgs;
import com.pulumi.vercel.inputs.OidcFederationPolicyClaimArgs;
import com.pulumi.vercel.inputs.OidcFederationPolicyResourcesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var turborepoGithubActions = new OidcFederationPolicy("turborepoGithubActions", OidcFederationPolicyArgs.builder()
            .name("Turborepo for acme/widgets GitHub Workflows")
            .client("turborepo")
            .issuerUrl("https://token.actions.githubusercontent.com")
            .claims(            
                OidcFederationPolicyClaimArgs.builder()
                    .name("aud")
                    .values(OidcFederationPolicyClaimValueArgs.builder()
                        .value("https://vercel.com/api/login/oauth/token")
                        .build())
                    .build(),
                OidcFederationPolicyClaimArgs.builder()
                    .name("repository")
                    .values(OidcFederationPolicyClaimValueArgs.builder()
                        .value("acme/widgets")
                        .build())
                    .build())
            .permissions("read-write:remote-cache")
            .resources(OidcFederationPolicyResourcesArgs.builder()
                .projectIds("*")
                .build())
            .build());

    }
}

    resources:
  turborepoGithubActions:
    type: vercel:OidcFederationPolicy
    name: turborepo_github_actions
    properties:
      name: Turborepo for acme/widgets GitHub Workflows
      client: turborepo
      issuerUrl: https://token.actions.githubusercontent.com
      claims:
        - name: aud
          values:
            - value: https://vercel.com/api/login/oauth/token
        - name: repository
          values:
            - value: acme/widgets
      permissions:
        - read-write:remote-cache
      resources:
        projectIds:
          - '*'

    Example coming soon!

    Create OidcFederationPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new OidcFederationPolicy(name: string, args: OidcFederationPolicyArgs, opts?: CustomResourceOptions);
    @overload
def OidcFederationPolicy(resource_name: str,
                         args: OidcFederationPolicyArgs,
                         opts: Optional[ResourceOptions] = None)

@overload
def OidcFederationPolicy(resource_name: str,
                         opts: Optional[ResourceOptions] = None,
                         claims: Optional[Sequence[OidcFederationPolicyClaimArgs]] = None,
                         client: Optional[str] = None,
                         issuer_url: Optional[str] = None,
                         commands: Optional[Sequence[str]] = None,
                         name: Optional[str] = None,
                         permissions: Optional[Sequence[str]] = None,
                         resources: Optional[OidcFederationPolicyResourcesArgs] = None,
                         team_id: Optional[str] = None)
    func NewOidcFederationPolicy(ctx *Context, name string, args OidcFederationPolicyArgs, opts ...ResourceOption) (*OidcFederationPolicy, error)
    public OidcFederationPolicy(string name, OidcFederationPolicyArgs args, CustomResourceOptions? opts = null)
    public OidcFederationPolicy(String name, OidcFederationPolicyArgs args)
public OidcFederationPolicy(String name, OidcFederationPolicyArgs args, CustomResourceOptions options)

    type: vercel:OidcFederationPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vercel_oidc_federation_policy" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args OidcFederationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args OidcFederationPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args OidcFederationPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args OidcFederationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args OidcFederationPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var oidcFederationPolicyResource = new Vercel.OidcFederationPolicy("oidcFederationPolicyResource", new()
{
    Claims = new[]
    {
        new Vercel.Inputs.OidcFederationPolicyClaimArgs
        {
            Name = "string",
            Values = new[]
            {
                new Vercel.Inputs.OidcFederationPolicyClaimValueArgs
                {
                    Value = "string",
                    Wildcards = false,
                },
            },
        },
    },
    Client = "string",
    IssuerUrl = "string",
    Commands = new[]
    {
        "string",
    },
    Name = "string",
    Permissions = new[]
    {
        "string",
    },
    Resources = new Vercel.Inputs.OidcFederationPolicyResourcesArgs
    {
        ProjectIds = new[]
        {
            "string",
        },
    },
    TeamId = "string",
});

    example, err := vercel.NewOidcFederationPolicy(ctx, "oidcFederationPolicyResource", &vercel.OidcFederationPolicyArgs{
	Claims: vercel.OidcFederationPolicyClaimArray{
		&vercel.OidcFederationPolicyClaimArgs{
			Name: pulumi.String("string"),
			Values: vercel.OidcFederationPolicyClaimValueArray{
				&vercel.OidcFederationPolicyClaimValueArgs{
					Value:     pulumi.String("string"),
					Wildcards: pulumi.Bool(false),
				},
			},
		},
	},
	Client:    pulumi.String("string"),
	IssuerUrl: pulumi.String("string"),
	Commands: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	Permissions: pulumi.StringArray{
		pulumi.String("string"),
	},
	Resources: &vercel.OidcFederationPolicyResourcesArgs{
		ProjectIds: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	TeamId: pulumi.String("string"),
})

    resource "vercel_oidc_federation_policy" "oidcFederationPolicyResource" {
  lifecycle {
    create_before_destroy = true
  }
  claims {
    name = "string"
    values {
      value     = "string"
      wildcards = false
    }
  }
  client      = "string"
  issuer_url  = "string"
  commands    = ["string"]
  name        = "string"
  permissions = ["string"]
  resources = {
    project_ids = ["string"]
  }
  team_id = "string"
}

    var oidcFederationPolicyResource = new OidcFederationPolicy("oidcFederationPolicyResource", OidcFederationPolicyArgs.builder()
    .claims(OidcFederationPolicyClaimArgs.builder()
        .name("string")
        .values(OidcFederationPolicyClaimValueArgs.builder()
            .value("string")
            .wildcards(false)
            .build())
        .build())
    .client("string")
    .issuerUrl("string")
    .commands("string")
    .name("string")
    .permissions("string")
    .resources(OidcFederationPolicyResourcesArgs.builder()
        .projectIds("string")
        .build())
    .teamId("string")
    .build());

    oidc_federation_policy_resource = vercel.OidcFederationPolicy("oidcFederationPolicyResource",
    claims=[{
        "name": "string",
        "values": [{
            "value": "string",
            "wildcards": False,
        }],
    }],
    client="string",
    issuer_url="string",
    commands=["string"],
    name="string",
    permissions=["string"],
    resources={
        "project_ids": ["string"],
    },
    team_id="string")

    const oidcFederationPolicyResource = new vercel.OidcFederationPolicy("oidcFederationPolicyResource", {
    claims: [{
        name: "string",
        values: [{
            value: "string",
            wildcards: false,
        }],
    }],
    client: "string",
    issuerUrl: "string",
    commands: ["string"],
    name: "string",
    permissions: ["string"],
    resources: {
        projectIds: ["string"],
    },
    teamId: "string",
});

    type: vercel:OidcFederationPolicy
properties:
    claims:
        - name: string
          values:
            - value: string
              wildcards: false
    client: string
    commands:
        - string
    issuerUrl: string
    name: string
    permissions:
        - string
    resources:
        projectIds:
            - string
    teamId: string

    OidcFederationPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The OidcFederationPolicy resource accepts the following input properties:

    Claims List<Pulumiverse.Vercel.Inputs.OidcFederationPolicyClaim>
    OIDC claims that must all match for a token to be exchanged.
    Client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    IssuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    Commands List<string>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    Name string
    A human-readable name describing the policy.
    Permissions List<string>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    Resources Pulumiverse.Vercel.Inputs.OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    TeamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    Claims []OidcFederationPolicyClaimArgs
    OIDC claims that must all match for a token to be exchanged.
    Client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    IssuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    Commands []string
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    Name string
    A human-readable name describing the policy.
    Permissions []string
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    Resources OidcFederationPolicyResourcesArgs
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    TeamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims list(object)
    OIDC claims that must all match for a token to be exchanged.
    client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    issuer_url string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    commands list(string)
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    name string
    A human-readable name describing the policy.
    permissions list(string)
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources object
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    team_id string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims List<OidcFederationPolicyClaim>
    OIDC claims that must all match for a token to be exchanged.
    client String
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    issuerUrl String
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    commands List<String>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    name String
    A human-readable name describing the policy.
    permissions List<String>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId String
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims OidcFederationPolicyClaim[]
    OIDC claims that must all match for a token to be exchanged.
    client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    issuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    commands string[]
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    name string
    A human-readable name describing the policy.
    permissions string[]
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims Sequence[OidcFederationPolicyClaimArgs]
    OIDC claims that must all match for a token to be exchanged.
    client str
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    issuer_url str
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    commands Sequence[str]
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    name str
    A human-readable name describing the policy.
    permissions Sequence[str]
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResourcesArgs
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    team_id str
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims List<Property Map>
    OIDC claims that must all match for a token to be exchanged.
    client String
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    issuerUrl String
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    commands List<String>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    name String
    A human-readable name describing the policy.
    permissions List<String>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources Property Map
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId String
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the OidcFederationPolicy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing OidcFederationPolicy Resource

    Get an existing OidcFederationPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: OidcFederationPolicyState, opts?: CustomResourceOptions): OidcFederationPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        claims: Optional[Sequence[OidcFederationPolicyClaimArgs]] = None,
        client: Optional[str] = None,
        commands: Optional[Sequence[str]] = None,
        issuer_url: Optional[str] = None,
        name: Optional[str] = None,
        permissions: Optional[Sequence[str]] = None,
        resources: Optional[OidcFederationPolicyResourcesArgs] = None,
        team_id: Optional[str] = None) -> OidcFederationPolicy
    func GetOidcFederationPolicy(ctx *Context, name string, id IDInput, state *OidcFederationPolicyState, opts ...ResourceOption) (*OidcFederationPolicy, error)
    public static OidcFederationPolicy Get(string name, Input<string> id, OidcFederationPolicyState? state, CustomResourceOptions? opts = null)
    public static OidcFederationPolicy get(String name, Output<String> id, OidcFederationPolicyState state, CustomResourceOptions options)
    resources:  _:    type: vercel:OidcFederationPolicy    get:      id: ${id}
    import {
  to = vercel_oidc_federation_policy.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Claims List<Pulumiverse.Vercel.Inputs.OidcFederationPolicyClaim>
    OIDC claims that must all match for a token to be exchanged.
    Client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    Commands List<string>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    IssuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    Name string
    A human-readable name describing the policy.
    Permissions List<string>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    Resources Pulumiverse.Vercel.Inputs.OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    TeamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    Claims []OidcFederationPolicyClaimArgs
    OIDC claims that must all match for a token to be exchanged.
    Client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    Commands []string
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    IssuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    Name string
    A human-readable name describing the policy.
    Permissions []string
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    Resources OidcFederationPolicyResourcesArgs
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    TeamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims list(object)
    OIDC claims that must all match for a token to be exchanged.
    client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    commands list(string)
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    issuer_url string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    name string
    A human-readable name describing the policy.
    permissions list(string)
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources object
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    team_id string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims List<OidcFederationPolicyClaim>
    OIDC claims that must all match for a token to be exchanged.
    client String
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    commands List<String>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    issuerUrl String
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    name String
    A human-readable name describing the policy.
    permissions List<String>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId String
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims OidcFederationPolicyClaim[]
    OIDC claims that must all match for a token to be exchanged.
    client string
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    commands string[]
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    issuerUrl string
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    name string
    A human-readable name describing the policy.
    permissions string[]
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResources
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId string
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims Sequence[OidcFederationPolicyClaimArgs]
    OIDC claims that must all match for a token to be exchanged.
    client str
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    commands Sequence[str]
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    issuer_url str
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    name str
    A human-readable name describing the policy.
    permissions Sequence[str]
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources OidcFederationPolicyResourcesArgs
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    team_id str
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.
    claims List<Property Map>
    OIDC claims that must all match for a token to be exchanged.
    client String
    The CLI whose access tokens this policy permits the workload to obtain. Valid values are turborepo and vercel.
    commands List<String>
    Vercel CLI command IDs allowed for exchanged tokens. Only supported for the Vercel CLI client. Exactly one of commands or permissions must be configured.
    issuerUrl String
    The HTTPS issuer URL in OIDC tokens recognized by this policy.
    name String
    A human-readable name describing the policy.
    permissions List<String>
    Permissions granted to exchanged tokens. For Turborepo remote caching, use read:remote-cache for read-only access or read-write:remote-cache for read and write access. Use ["*"] only when the policy should inherit every permission authorized for the selected client. Exactly one of permissions or commands must be configured.
    resources Property Map
    Optional project boundary for exchanged tokens. Omitting this block leaves access unbounded within the permissions authorized for the client.
    teamId String
    The ID of the team the policy should exist under. Required when a default team has not been set in the provider.

    Supporting Types

    OidcFederationPolicyClaim, OidcFederationPolicyClaimArgs

    Name string
    The OIDC claim name.
    Values List<Pulumiverse.Vercel.Inputs.OidcFederationPolicyClaimValue>
    Values accepted for this claim. A claim matches when any configured value matches.
    Name string
    The OIDC claim name.
    Values []OidcFederationPolicyClaimValue
    Values accepted for this claim. A claim matches when any configured value matches.
    name string
    The OIDC claim name.
    values list(object)
    Values accepted for this claim. A claim matches when any configured value matches.
    name String
    The OIDC claim name.
    values List<OidcFederationPolicyClaimValue>
    Values accepted for this claim. A claim matches when any configured value matches.
    name string
    The OIDC claim name.
    values OidcFederationPolicyClaimValue[]
    Values accepted for this claim. A claim matches when any configured value matches.
    name str
    The OIDC claim name.
    values Sequence[OidcFederationPolicyClaimValue]
    Values accepted for this claim. A claim matches when any configured value matches.
    name String
    The OIDC claim name.
    values List<Property Map>
    Values accepted for this claim. A claim matches when any configured value matches.

    OidcFederationPolicyClaimValue, OidcFederationPolicyClaimValueArgs

    Value string
    The accepted claim value or wildcard pattern.
    Wildcards bool
    Whether * characters in the value should be interpreted as wildcards.
    Value string
    The accepted claim value or wildcard pattern.
    Wildcards bool
    Whether * characters in the value should be interpreted as wildcards.
    value string
    The accepted claim value or wildcard pattern.
    wildcards bool
    Whether * characters in the value should be interpreted as wildcards.
    value String
    The accepted claim value or wildcard pattern.
    wildcards Boolean
    Whether * characters in the value should be interpreted as wildcards.
    value string
    The accepted claim value or wildcard pattern.
    wildcards boolean
    Whether * characters in the value should be interpreted as wildcards.
    value str
    The accepted claim value or wildcard pattern.
    wildcards bool
    Whether * characters in the value should be interpreted as wildcards.
    value String
    The accepted claim value or wildcard pattern.
    wildcards Boolean
    Whether * characters in the value should be interpreted as wildcards.

    OidcFederationPolicyResources, OidcFederationPolicyResourcesArgs

    ProjectIds List<string>
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    ProjectIds []string
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    project_ids list(string)
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    projectIds List<String>
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    projectIds string[]
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    project_ids Sequence[str]
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.
    projectIds List<String>
    Project IDs in the resource boundary. Use ["*"] for all current and future team projects, or an empty set for no projects.

    Import

    The pulumi import command can be used, for example:

    If importing with a team configured on the provider, use the policy ID.

    $ pulumi import vercel:index/oidcFederationPolicy:OidcFederationPolicy example pol_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Otherwise, use the team ID and policy ID.

    $ pulumi import vercel:index/oidcFederationPolicy:OidcFederationPolicy example team_xxxxxxxxxxxxxxxxxxxxxxxx/pol_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    vercel pulumiverse/pulumi-vercel
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vercel Terraform Provider.
    vercel logo vercel logo
    Viewing docs for Vercel v5.21.1
    published on Thursday, Oct 15, 2026 by Pulumiverse
    Schema (JSON)
    pulumiverse/pulumi-vercel

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial