---
title: Getting Started with Datadog
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog
---

# gcp_iam_workload_identity_pool_provider{% #gcp_iam_workload_identity_pool_provider %}

## `ancestors`{% #ancestors %}

**Type**: `UNORDERED_LIST_STRING`

## `attribute_condition`{% #attribute_condition %}

**Type**: `STRING`**Provider name**: `attributeCondition`**Description**: Optional. [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: `"'admins' in google.groups"`

## `aws`{% #aws %}

**Type**: `STRUCT`**Provider name**: `aws`**Description**: An Amazon Web Services identity provider.

- `account_id`**Type**: `STRING`**Provider name**: `accountId`**Description**: Required. The AWS account ID.

## `description`{% #description %}

**Type**: `STRING`**Provider name**: `description`**Description**: Optional. A description for the provider. Cannot exceed 256 characters.

## `disabled`{% #disabled %}

**Type**: `BOOLEAN`**Provider name**: `disabled`**Description**: Optional. Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

## `expire_time`{% #expire_time %}

**Type**: `TIMESTAMP`**Provider name**: `expireTime`**Description**: Output only. Time after which the workload identity pool provider will be permanently purged and cannot be recovered.

## `gcp_display_name`{% #gcp_display_name %}

**Type**: `STRING`**Provider name**: `displayName`**Description**: Optional. A display name for the provider. Cannot exceed 32 characters.

## `labels`{% #labels %}

**Type**: `UNORDERED_LIST_STRING`

## `name`{% #name %}

**Type**: `STRING`**Provider name**: `name`**Description**: Output only. The resource name of the provider.

## `oidc`{% #oidc %}

**Type**: `STRUCT`**Provider name**: `oidc`**Description**: An OpenId Connect 1.0 identity provider.

- `allowed_audiences`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `allowedAudiences`**Description**: Optional. Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: `//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/`
- `issuer_uri`**Type**: `STRING`**Provider name**: `issuerUri`**Description**: Required. The OIDC issuer URL. Must be an HTTPS endpoint. Per OpenID Connect Discovery 1.0 spec, the OIDC issuer URL is used to locate the provider's public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be 'EC' or 'RSA'.
- `jwks_json`**Type**: `STRING`**Provider name**: `jwksJson`**Description**: Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see [https://tools.ietf.org/html/rfc7517](https://tools.ietf.org/html/rfc7517). If not set, the `jwks_uri` from the discovery document(fetched from the .well-known path of the `issuer_uri`) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] }

## `organization_id`{% #organization_id %}

**Type**: `STRING`

## `parent`{% #parent %}

**Type**: `STRING`

## `project_id`{% #project_id %}

**Type**: `STRING`

## `project_number`{% #project_number %}

**Type**: `STRING`

## `region_id`{% #region_id %}

**Type**: `STRING`

## `resource_name`{% #resource_name %}

**Type**: `STRING`

## `saml`{% #saml %}

**Type**: `STRUCT`**Provider name**: `saml`**Description**: An SAML 2.0 identity provider.

- `idp_metadata_xml`**Type**: `STRING`**Provider name**: `idpMetadataXml`**Description**: Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 25 years in the future. * Up to three IdP signing keys are allowed. When updating the provider's metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.

## `state`{% #state %}

**Type**: `STRING`**Provider name**: `state`**Description**: Output only. The state of the provider.**Possible values**:

- `STATE_UNSPECIFIED` - State unspecified.
- `ACTIVE` - The provider is active, and may be used to validate authentication credentials.
- `DELETED` - The provider is soft-deleted. Soft-deleted providers are permanently deleted after approximately 30 days. You can restore a soft-deleted provider using UndeleteWorkloadIdentityPoolProvider. You cannot reuse the ID of a soft-deleted provider until it is permanently deleted.

## `tags`{% #tags %}

**Type**: `UNORDERED_LIST_STRING`

## `x509`{% #x509 %}

**Type**: `STRUCT`**Provider name**: `x509`**Description**: An X.509-type identity provider.

- `trust_store`**Type**: `STRUCT`**Provider name**: `trustStore`**Description**: Required. A TrustStore. Use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the X.509 guidelines to define those PEM encoded certs. Only one trust store is currently supported.
  - `intermediate_cas`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `intermediateCas`**Description**: Optional. Set of intermediate CA certificates used for building the trust chain to the trust anchor. Important: Intermediate CAs are only supported for X.509 federation.
    - `pem_certificate`**Type**: `STRING`**Provider name**: `pemCertificate`**Description**: PEM certificate of the PKI used for validation. Must only contain one ca certificate.
  - `trust_anchors`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `trustAnchors`**Description**: Required. List of trust anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be in the trust chain of one of the trust anchors here.
    - `pem_certificate`**Type**: `STRING`**Provider name**: `pemCertificate`**Description**: PEM certificate of the PKI used for validation. Must only contain one ca certificate (either root or intermediate cert).

## `zone_id`{% #zone_id %}

**Type**: `STRING`