Google Cloud v8.26.0, Apr 10 25

Google Cloud v8.26.0 published on Thursday, Apr 10, 2025 by Pulumi

gcp.iam.getWorkloadIdentityPoolProvider

Explore with Pulumi AI

Google Cloud v8.26.0 published on Thursday, Apr 10, 2025 by Pulumi

Example Usage

TypeScript
Python
Go
C#
Java
YAML

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const foo = gcp.iam.getWorkloadIdentityPoolProvider({
    workloadIdentityPoolId: "foo-pool",
    workloadIdentityPoolProviderId: "bar-provider",
});

import pulumi
import pulumi_gcp as gcp

foo = gcp.iam.get_workload_identity_pool_provider(workload_identity_pool_id="foo-pool",
    workload_identity_pool_provider_id="bar-provider")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.LookupWorkloadIdentityPoolProvider(ctx, &iam.LookupWorkloadIdentityPoolProviderArgs{
			WorkloadIdentityPoolId:         "foo-pool",
			WorkloadIdentityPoolProviderId: "bar-provider",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var foo = Gcp.Iam.GetWorkloadIdentityPoolProvider.Invoke(new()
    {
        WorkloadIdentityPoolId = "foo-pool",
        WorkloadIdentityPoolProviderId = "bar-provider",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.IamFunctions;
import com.pulumi.gcp.iam.inputs.GetWorkloadIdentityPoolProviderArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var foo = IamFunctions.getWorkloadIdentityPoolProvider(GetWorkloadIdentityPoolProviderArgs.builder()
            .workloadIdentityPoolId("foo-pool")
            .workloadIdentityPoolProviderId("bar-provider")
            .build());

    }
}

variables:
  foo:
    fn::invoke:
      function: gcp:iam:getWorkloadIdentityPoolProvider
      arguments:
        workloadIdentityPoolId: foo-pool
        workloadIdentityPoolProviderId: bar-provider

Using getWorkloadIdentityPoolProvider

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

TypeScript
Python
Go
C#
Java
YAML

function getWorkloadIdentityPoolProvider(args: GetWorkloadIdentityPoolProviderArgs, opts?: InvokeOptions): Promise<GetWorkloadIdentityPoolProviderResult>
function getWorkloadIdentityPoolProviderOutput(args: GetWorkloadIdentityPoolProviderOutputArgs, opts?: InvokeOptions): Output<GetWorkloadIdentityPoolProviderResult>

def get_workload_identity_pool_provider(project: Optional[str] = None,
                                        workload_identity_pool_id: Optional[str] = None,
                                        workload_identity_pool_provider_id: Optional[str] = None,
                                        opts: Optional[InvokeOptions] = None) -> GetWorkloadIdentityPoolProviderResult
def get_workload_identity_pool_provider_output(project: Optional[pulumi.Input[str]] = None,
                                        workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
                                        workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
                                        opts: Optional[InvokeOptions] = None) -> Output[GetWorkloadIdentityPoolProviderResult]

func LookupWorkloadIdentityPoolProvider(ctx *Context, args *LookupWorkloadIdentityPoolProviderArgs, opts ...InvokeOption) (*LookupWorkloadIdentityPoolProviderResult, error)
func LookupWorkloadIdentityPoolProviderOutput(ctx *Context, args *LookupWorkloadIdentityPoolProviderOutputArgs, opts ...InvokeOption) LookupWorkloadIdentityPoolProviderResultOutput

> Note: This function is named LookupWorkloadIdentityPoolProvider in the Go SDK.

public static class GetWorkloadIdentityPoolProvider 
{
    public static Task<GetWorkloadIdentityPoolProviderResult> InvokeAsync(GetWorkloadIdentityPoolProviderArgs args, InvokeOptions? opts = null)
    public static Output<GetWorkloadIdentityPoolProviderResult> Invoke(GetWorkloadIdentityPoolProviderInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetWorkloadIdentityPoolProviderResult> getWorkloadIdentityPoolProvider(GetWorkloadIdentityPoolProviderArgs args, InvokeOptions options)
public static Output<GetWorkloadIdentityPoolProviderResult> getWorkloadIdentityPoolProvider(GetWorkloadIdentityPoolProviderArgs args, InvokeOptions options)

fn::invoke:
  function: gcp:iam/getWorkloadIdentityPoolProvider:getWorkloadIdentityPoolProvider
  arguments:
    # arguments dictionary

The following arguments are supported:

WorkloadIdentityPoolId string: The id of the pool which is the final component of the pool resource name.
WorkloadIdentityPoolProviderId string: The id of the provider which is the final component of the resource name.
Project string: The project in which the resource belongs. If it is not provided, the provider project is used.

WorkloadIdentityPoolId string: The id of the pool which is the final component of the pool resource name.
WorkloadIdentityPoolProviderId string: The id of the provider which is the final component of the resource name.
Project string: The project in which the resource belongs. If it is not provided, the provider project is used.

workloadIdentityPoolId String: The id of the pool which is the final component of the pool resource name.
workloadIdentityPoolProviderId String: The id of the provider which is the final component of the resource name.
project String: The project in which the resource belongs. If it is not provided, the provider project is used.

workloadIdentityPoolId string: The id of the pool which is the final component of the pool resource name.
workloadIdentityPoolProviderId string: The id of the provider which is the final component of the resource name.
project string: The project in which the resource belongs. If it is not provided, the provider project is used.

workload_identity_pool_id str: The id of the pool which is the final component of the pool resource name.
workload_identity_pool_provider_id str: The id of the provider which is the final component of the resource name.
project str: The project in which the resource belongs. If it is not provided, the provider project is used.

workloadIdentityPoolId String: The id of the pool which is the final component of the pool resource name.
workloadIdentityPoolProviderId String: The id of the provider which is the final component of the resource name.
project String: The project in which the resource belongs. If it is not provided, the provider project is used.

getWorkloadIdentityPoolProvider Result

The following output properties are available:

AttributeCondition string
AttributeMapping Dictionary<string, string>
Aws List<GetWorkloadIdentityPoolProviderAw>
Description string
Disabled bool
DisplayName string
Id string: The provider-assigned unique ID for this managed resource.
Name string
Oidcs List<GetWorkloadIdentityPoolProviderOidc>
Samls List<GetWorkloadIdentityPoolProviderSaml>
State string
WorkloadIdentityPoolId string
WorkloadIdentityPoolProviderId string
X509s List<GetWorkloadIdentityPoolProviderX509>
Project string

AttributeCondition string
AttributeMapping map[string]string
Aws []GetWorkloadIdentityPoolProviderAw
Description string
Disabled bool
DisplayName string
Id string: The provider-assigned unique ID for this managed resource.
Name string
Oidcs []GetWorkloadIdentityPoolProviderOidc
Samls []GetWorkloadIdentityPoolProviderSaml
State string
WorkloadIdentityPoolId string
WorkloadIdentityPoolProviderId string
X509s []GetWorkloadIdentityPoolProviderX509
Project string

attributeCondition String
attributeMapping Map<String,String>
aws List<GetWorkloadIdentityPoolProviderAw>
description String
disabled Boolean
displayName String
id String: The provider-assigned unique ID for this managed resource.
name String
oidcs List<GetWorkloadIdentityPoolProviderOidc>
samls List<GetWorkloadIdentityPoolProviderSaml>
state String
workloadIdentityPoolId String
workloadIdentityPoolProviderId String
x509s List<GetWorkloadIdentityPoolProviderX509>
project String

attributeCondition string
attributeMapping {[key: string]: string}
aws GetWorkloadIdentityPoolProviderAw[]
description string
disabled boolean
displayName string
id string: The provider-assigned unique ID for this managed resource.
name string
oidcs GetWorkloadIdentityPoolProviderOidc[]
samls GetWorkloadIdentityPoolProviderSaml[]
state string
workloadIdentityPoolId string
workloadIdentityPoolProviderId string
x509s GetWorkloadIdentityPoolProviderX509[]
project string

attribute_condition str
attribute_mapping Mapping[str, str]
aws Sequence[GetWorkloadIdentityPoolProviderAw]
description str
disabled bool
display_name str
id str: The provider-assigned unique ID for this managed resource.
name str
oidcs Sequence[GetWorkloadIdentityPoolProviderOidc]
samls Sequence[GetWorkloadIdentityPoolProviderSaml]
state str
workload_identity_pool_id str
workload_identity_pool_provider_id str
x509s Sequence[GetWorkloadIdentityPoolProviderX509]
project str

attributeCondition String
attributeMapping Map<String>
aws List<Property Map>
description String
disabled Boolean
displayName String
id String: The provider-assigned unique ID for this managed resource.
name String
oidcs List<Property Map>
samls List<Property Map>
state String
workloadIdentityPoolId String
workloadIdentityPoolProviderId String
x509s List<Property Map>
project String

Supporting Types

GetWorkloadIdentityPoolProviderAw

AccountId string: The AWS account ID.

AccountId string: The AWS account ID.

accountId String: The AWS account ID.

accountId string: The AWS account ID.

account_id str: The AWS account ID.

accountId String: The AWS account ID.

GetWorkloadIdentityPoolProviderOidc

AllowedAudiences List<string>

Acceptable values for the 'aud' field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured.

If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ''' //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ '''

IssuerUri string

The OIDC issuer URL.

JwksJson string

OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the 'jwks_uri' from the discovery document fetched from the .well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: ''' { "keys": [ { "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": "", "crv": "" } ] } '''

AllowedAudiences []string

IssuerUri string

The OIDC issuer URL.

JwksJson string

allowedAudiences List<String>

issuerUri String

The OIDC issuer URL.

jwksJson String

allowedAudiences string[]

issuerUri string

The OIDC issuer URL.

jwksJson string

allowed_audiences Sequence[str]

issuer_uri str

The OIDC issuer URL.

jwks_json str

allowedAudiences List<String>

issuerUri String

The OIDC issuer URL.

jwksJson String

GetWorkloadIdentityPoolProviderSaml

IdpMetadataXml string: SAML Identity provider configuration metadata xml doc.

IdpMetadataXml string: SAML Identity provider configuration metadata xml doc.

idpMetadataXml String: SAML Identity provider configuration metadata xml doc.

idpMetadataXml string: SAML Identity provider configuration metadata xml doc.

idp_metadata_xml str: SAML Identity provider configuration metadata xml doc.

idpMetadataXml String: SAML Identity provider configuration metadata xml doc.

GetWorkloadIdentityPoolProviderX509

TrustStores List<GetWorkloadIdentityPoolProviderX509TrustStore>: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

TrustStores []GetWorkloadIdentityPoolProviderX509TrustStore: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

trustStores List<GetWorkloadIdentityPoolProviderX509TrustStore>: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

trustStores GetWorkloadIdentityPoolProviderX509TrustStore[]: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

trust_stores Sequence[GetWorkloadIdentityPoolProviderX509TrustStore]: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

trustStores List<Property Map>: A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.

GetWorkloadIdentityPoolProviderX509TrustStore

IntermediateCas List<GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa>: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
TrustAnchors List<GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor>: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

IntermediateCas []GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
TrustAnchors []GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

intermediateCas List<GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa>: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
trustAnchors List<GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor>: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

intermediateCas GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa[]: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
trustAnchors GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor[]: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

intermediate_cas Sequence[GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa]: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
trust_anchors Sequence[GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor]: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

intermediateCas List<Property Map>: Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: Intermediate CAs are only supported when configuring x509 federation.
trustAnchors List<Property Map>: List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity's certificate must be chained up to one of the trust anchors here.

GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa

PemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

PemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate String: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pem_certificate str: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate String: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor

PemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

PemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate String: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate string: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pem_certificate str: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

pemCertificate String: PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).

Package Details

Repository: Google Cloud (GCP) Classic pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

Google Cloud v8.26.0 published on Thursday, Apr 10, 2025 by Pulumi

pulumi/pulumi-gcp

gcp.iam.getWorkloadIdentityPoolProvider

On this page

On this page

Example Usage

Using getWorkloadIdentityPoolProvider

getWorkloadIdentityPoolProvider Result

Supporting Types

GetWorkloadIdentityPoolProviderAw

GetWorkloadIdentityPoolProviderOidc

GetWorkloadIdentityPoolProviderSaml

GetWorkloadIdentityPoolProviderX509

GetWorkloadIdentityPoolProviderX509TrustStore

GetWorkloadIdentityPoolProviderX509TrustStoreIntermediateCa

GetWorkloadIdentityPoolProviderX509TrustStoreTrustAnchor

Package Details

On this page

On this page