gcp_iam_workload_identity_pool_provider

ancestors

Type: UNORDERED_LIST_STRING

attribute_condition

Type: STRING
Provider name: attributeCondition
Description: Optional. A Common Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * assertion: JSON representing the authentication credential issued by the provider. * google: The Google attributes mapped from the assertion in the attribute_mappings. * attribute: The custom attributes mapped from the assertion in the attribute_mappings. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped google.groups value of admins: "'admins' in google.groups"

aws

Type: STRUCT
Provider name: aws
Description: An Amazon Web Services identity provider.

  • account_id
    Type: STRING
    Provider name: accountId
    Description: Required. The AWS account ID.

description

Type: STRING
Provider name: description
Description: Optional. A description for the provider. Cannot exceed 256 characters.

disabled

Type: BOOLEAN
Provider name: disabled
Description: Optional. Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

expire_time

Type: TIMESTAMP
Provider name: expireTime
Description: Output only. Time after which the workload identity pool provider will be permanently purged and cannot be recovered.

gcp_display_name

Type: STRING
Provider name: displayName
Description: Optional. A display name for the provider. Cannot exceed 32 characters.

labels

Type: UNORDERED_LIST_STRING

name

Type: STRING
Provider name: name
Description: Output only. The resource name of the provider.

oidc

Type: STRUCT
Provider name: oidc
Description: An OpenId Connect 1.0 identity provider.

  • allowed_audiences
    Type: UNORDERED_LIST_STRING
    Provider name: allowedAudiences
    Description: Optional. Acceptable values for the aud field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/
  • issuer_uri
    Type: STRING
    Provider name: issuerUri
    Description: Required. The OIDC issuer URL. Must be an HTTPS endpoint. Per OpenID Connect Discovery 1.0 spec, the OIDC issuer URL is used to locate the provider’s public keys (via jwks_uri) for verifying tokens like the OIDC ID token. These public key types must be ‘EC’ or ‘RSA’.
  • jwks_json
    Type: STRING
    Provider name: jwksJson
    Description: Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, the jwks_uri from the discovery document(fetched from the .well-known path of the issuer_uri) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { “keys”: [ { “kty”: “RSA/EC”, “alg”: “”, “use”: “sig”, “kid”: “”, “n”: “”, “e”: “”, “x”: “”, “y”: “”, “crv”: "" } ] }

organization_id

Type: STRING

parent

Type: STRING

project_id

Type: STRING

project_number

Type: STRING

region_id

Type: STRING

resource_name

Type: STRING

saml

Type: STRUCT
Provider name: saml
Description: An SAML 2.0 identity provider.

  • idp_metadata_xml
    Type: STRING
    Provider name: idpMetadataXml
    Description: Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the SAML 2.0 specification. The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 25 years in the future. * Up to three IdP signing keys are allowed. When updating the provider’s metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.

state

Type: STRING
Provider name: state
Description: Output only. The state of the provider.
Possible values:

  • STATE_UNSPECIFIED - State unspecified.
  • ACTIVE - The provider is active, and may be used to validate authentication credentials.
  • DELETED - The provider is soft-deleted. Soft-deleted providers are permanently deleted after approximately 30 days. You can restore a soft-deleted provider using UndeleteWorkloadIdentityPoolProvider. You cannot reuse the ID of a soft-deleted provider until it is permanently deleted.

tags

Type: UNORDERED_LIST_STRING

x509

Type: STRUCT
Provider name: x509
Description: An X.509-type identity provider.

  • trust_store
    Type: STRUCT
    Provider name: trustStore
    Description: Required. A TrustStore. Use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the X.509 guidelines to define those PEM encoded certs. Only one trust store is currently supported.
    • intermediate_cas
      Type: UNORDERED_LIST_STRUCT
      Provider name: intermediateCas
      Description: Optional. Set of intermediate CA certificates used for building the trust chain to the trust anchor. Important: Intermediate CAs are only supported for X.509 federation.
      • pem_certificate
        Type: STRING
        Provider name: pemCertificate
        Description: PEM certificate of the PKI used for validation. Must only contain one ca certificate.
    • trust_anchors
      Type: UNORDERED_LIST_STRUCT
      Provider name: trustAnchors
      Description: Required. List of trust anchors to be used while performing validation against a given TrustStore. The incoming end entity’s certificate must be in the trust chain of one of the trust anchors here.
      • pem_certificate
        Type: STRING
        Provider name: pemCertificate
        Description: PEM certificate of the PKI used for validation. Must only contain one ca certificate (either root or intermediate cert).

zone_id

Type: STRING