Index
WorkloadIdentityPools
(interface)CreateWorkloadIdentityPoolProviderRequest
(message)CreateWorkloadIdentityPoolRequest
(message)DeleteWorkloadIdentityPoolProviderRequest
(message)DeleteWorkloadIdentityPoolRequest
(message)GetWorkloadIdentityPoolProviderRequest
(message)GetWorkloadIdentityPoolRequest
(message)ListWorkloadIdentityPoolProvidersRequest
(message)ListWorkloadIdentityPoolProvidersResponse
(message)ListWorkloadIdentityPoolsRequest
(message)ListWorkloadIdentityPoolsResponse
(message)UndeleteWorkloadIdentityPoolProviderRequest
(message)UndeleteWorkloadIdentityPoolRequest
(message)UpdateWorkloadIdentityPoolProviderRequest
(message)UpdateWorkloadIdentityPoolRequest
(message)WorkloadIdentityPool
(message)WorkloadIdentityPool.State
(enum)WorkloadIdentityPoolOperationMetadata
(message)WorkloadIdentityPoolProvider
(message)WorkloadIdentityPoolProvider.Aws
(message)WorkloadIdentityPoolProvider.Oidc
(message)WorkloadIdentityPoolProvider.State
(enum)WorkloadIdentityPoolProviderOperationMetadata
(message)
WorkloadIdentityPools
Manages WorkloadIdentityPools.
CreateWorkloadIdentityPool |
---|
Creates a new You cannot reuse the name of a deleted pool until 30 days after deletion.
|
CreateWorkloadIdentityPoolProvider |
---|
Creates a new You cannot reuse the name of a deleted provider until 30 days after deletion.
|
DeleteWorkloadIdentityPool |
---|
Deletes a You cannot use a deleted pool to exchange external credentials for Google Cloud credentials. However, deletion does not revoke credentials that have already been issued. Credentials issued for a deleted pool do not grant access to resources. If the pool is undeleted, and the credentials are not expired, they grant access again. You can undelete a pool for 30 days. After 30 days, deletion is permanent. You cannot update deleted pools. However, you can view and list them.
|
DeleteWorkloadIdentityPoolProvider |
---|
Deletes a
|
GetWorkloadIdentityPool |
---|
Gets an individual
|
GetWorkloadIdentityPoolProvider |
---|
Gets an individual
|
ListWorkloadIdentityPoolProviders |
---|
Lists all non-deleted
|
ListWorkloadIdentityPools |
---|
Lists all non-deleted
|
UndeleteWorkloadIdentityPool |
---|
Undeletes a
|
UndeleteWorkloadIdentityPoolProvider |
---|
Undeletes a
|
UpdateWorkloadIdentityPool |
---|
Updates an existing
|
UpdateWorkloadIdentityPoolProvider |
---|
Updates an existing
|
CreateWorkloadIdentityPoolProviderRequest
Request message for CreateWorkloadIdentityPoolProvider.
Fields | |
---|---|
parent |
Required. The pool to create this provider in. |
workload_identity_pool_provider |
Required. The provider to create. |
workload_identity_pool_provider_id |
Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix |
CreateWorkloadIdentityPoolRequest
Request message for CreateWorkloadIdentityPool.
Fields | |
---|---|
parent |
Required. The parent resource to create the pool in. The only supported location is |
workload_identity_pool |
Required. The pool to create. |
workload_identity_pool_id |
Required. The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix |
DeleteWorkloadIdentityPoolProviderRequest
Request message for DeleteWorkloadIdentityPoolProvider.
Fields | |
---|---|
name |
Required. The name of the provider to delete. |
DeleteWorkloadIdentityPoolRequest
Request message for DeleteWorkloadIdentityPool.
Fields | |
---|---|
name |
Required. The name of the pool to delete. |
GetWorkloadIdentityPoolProviderRequest
Request message for GetWorkloadIdentityPoolProvider.
Fields | |
---|---|
name |
Required. The name of the provider to retrieve. |
GetWorkloadIdentityPoolRequest
Request message for GetWorkloadIdentityPool.
Fields | |
---|---|
name |
Required. The name of the pool to retrieve. |
ListWorkloadIdentityPoolProvidersRequest
Request message for ListWorkloadIdentityPoolProviders.
Fields | |
---|---|
parent |
Required. The pool to list providers for. |
page_size |
The maximum number of providers to return. If unspecified, at most 50 providers are returned. The maximum value is 100; values above 100 are truncated to 100. |
page_token |
A page token, received from a previous |
show_deleted |
Whether to return soft-deleted providers. |
ListWorkloadIdentityPoolProvidersResponse
Response message for ListWorkloadIdentityPoolProviders.
Fields | |
---|---|
workload_identity_pool_providers[] |
A list of providers. |
next_page_token |
A token, which can be sent as |
ListWorkloadIdentityPoolsRequest
Request message for ListWorkloadIdentityPools.
Fields | |
---|---|
parent |
Required. The parent resource to list pools for. |
page_size |
The maximum number of pools to return. If unspecified, at most 50 pools are returned. The maximum value is 1000; values above are 1000 truncated to 1000. |
page_token |
A page token, received from a previous |
show_deleted |
Whether to return soft-deleted pools. |
ListWorkloadIdentityPoolsResponse
Response message for ListWorkloadIdentityPools.
Fields | |
---|---|
workload_identity_pools[] |
A list of pools. |
next_page_token |
A token, which can be sent as |
UndeleteWorkloadIdentityPoolProviderRequest
Request message for UndeleteWorkloadIdentityPoolProvider.
Fields | |
---|---|
name |
Required. The name of the provider to undelete. |
UndeleteWorkloadIdentityPoolRequest
Request message for UndeleteWorkloadIdentityPool.
Fields | |
---|---|
name |
Required. The name of the pool to undelete. |
UpdateWorkloadIdentityPoolProviderRequest
Request message for UpdateWorkloadIdentityPoolProvider.
Fields | |
---|---|
workload_identity_pool_provider |
Required. The provider to update. |
update_mask |
Required. The list of fields to update. |
UpdateWorkloadIdentityPoolRequest
Request message for UpdateWorkloadIdentityPool.
Fields | |
---|---|
workload_identity_pool |
Required. The pool to update. The |
update_mask |
Required. The list of fields to update. |
WorkloadIdentityPool
Represents a collection of external workload identities. You can define IAM policies to grant these identities access to Google Cloud resources.
Fields | |
---|---|
name |
Output only. The resource name of the pool. |
display_name |
A display name for the pool. Cannot exceed 32 characters. |
description |
A description of the pool. Cannot exceed 256 characters. |
state |
Output only. The state of the pool. |
disabled |
Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. |
expire_time |
Output only. Time after which the workload identity pool will be permanently purged and cannot be recovered. |
State
The current state of the pool.
Enums | |
---|---|
STATE_UNSPECIFIED |
State unspecified. |
ACTIVE |
The pool is active, and may be used in Google Cloud policies. |
DELETED |
The pool is soft-deleted. Soft-deleted pools are permanently deleted after approximately 30 days. You can restore a soft-deleted pool using You cannot reuse the ID of a soft-deleted pool until it is permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or use existing tokens to access resources. If the pool is undeleted, existing tokens grant access again. |
WorkloadIdentityPoolOperationMetadata
This type has no fields.
Metadata for long-running WorkloadIdentityPool operations.
WorkloadIdentityPoolProvider
A configuration for an external identity provider.
Fields | |
---|---|
name |
Output only. The resource name of the provider. |
display_name |
A display name for the provider. Cannot exceed 32 characters. |
description |
A description for the provider. Cannot exceed 256 characters. |
state |
Output only. The state of the provider. |
disabled |
Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access. |
attribute_mapping |
Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported:
You can also provide custom attributes by specifying You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example:
Each value must be a Common Expression Language function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies:
If any custom attribute mappings are defined, they must include a mapping to the For OIDC providers, you must supply a custom mapping, which must include the
|
attribute_condition |
A Common Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions:
The maximum length of the condition expression is 4096 characters. If unspecified, all valid authentication credentials are accepted. The following example shows how to only allow credentials with a mapped
|
expire_time |
Output only. Time after which the workload identity pool provider will be permanently purged and cannot be recovered. |
Union field provider_config . Identity provider configuration types. provider_config can be only one of the following: |
|
aws |
An Amazon Web Services identity provider. |
oidc |
An OpenId Connect 1.0 identity provider. |
Aws
Represents an Amazon Web Services identity provider.
Fields | |
---|---|
account_id |
Required. The AWS account ID. |
Oidc
Represents an OpenId Connect 1.0 identity provider.
Fields | |
---|---|
issuer_uri |
Required. The OIDC issuer URL. Must be an HTTPS endpoint. |
allowed_audiences[] |
Acceptable values for the If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example:
|
jwks_json |
Optional. OIDC JWKs in JSON String format. For details on definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, then we use the |
State
The current state of the provider.
Enums | |
---|---|
STATE_UNSPECIFIED |
State unspecified. |
ACTIVE |
The provider is active, and may be used to validate authentication credentials. |
DELETED |
The provider is soft-deleted. Soft-deleted providers are permanently deleted after approximately 30 days. You can restore a soft-deleted provider using You cannot reuse the ID of a soft-deleted provider until it is permanently deleted. |
WorkloadIdentityPoolProviderOperationMetadata
This type has no fields.
Metadata for long-running WorkloadIdentityPoolProvider operations.