import * as pulumi from "@pulumi/pulumi"; /** * Provides a Single Sign-On (SSO) Account Assignment resource * * ## Example Usage * * ### Basic Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as aws from "@pulumi/aws"; * * const example = aws.ssoadmin.getInstances({}); * const exampleGetPermissionSet = example.then(example => aws.ssoadmin.getPermissionSet({ * instanceArn: example.arns?.[0], * name: "AWSReadOnlyAccess", * })); * const exampleGetGroup = example.then(example => aws.identitystore.getGroup({ * alternateIdentifier: { * uniqueAttribute: { * attributePath: "DisplayName", * attributeValue: "ExampleGroup", * }, * }, * identityStoreId: example.identityStoreIds?.[0], * })); * const exampleAccountAssignment = new aws.ssoadmin.AccountAssignment("example", { * instanceArn: example.then(example => example.arns?.[0]), * permissionSetArn: exampleGetPermissionSet.then(exampleGetPermissionSet => exampleGetPermissionSet.arn), * principalId: exampleGetGroup.then(exampleGetGroup => exampleGetGroup.groupId), * principalType: "GROUP", * targetId: "123456789012", * targetType: "AWS_ACCOUNT", * }); * ``` * * ### With Managed Policy Attachment * * > Because destruction of a managed policy attachment resource also re-provisions the associated permission set to all accounts, explicitly indicating the dependency with the account assignment resource via the `dependsOn` meta argument is necessary to ensure proper deletion order when these resources are used together. * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as aws from "@pulumi/aws"; * * const example = aws.ssoadmin.getInstances({}); * const examplePermissionSet = new aws.ssoadmin.PermissionSet("example", { * name: "Example", * instanceArn: example.then(example => example.arns?.[0]), * }); * const exampleGroup = new aws.identitystore.Group("example", { * identityStoreId: example.then(example => example.identityStoreIds?.[0]), * displayName: "Admin", * description: "Admin Group", * }); * const exampleAccountAssignment = new aws.ssoadmin.AccountAssignment("example", { * instanceArn: example.then(example => example.arns?.[0]), * permissionSetArn: examplePermissionSet.arn, * principalId: exampleGroup.groupId, * principalType: "GROUP", * targetId: "123456789012", * targetType: "AWS_ACCOUNT", * }); * const exampleManagedPolicyAttachment = new aws.ssoadmin.ManagedPolicyAttachment("example", { * instanceArn: example.then(example => example.arns?.[0]), * managedPolicyArn: "arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup", * permissionSetArn: examplePermissionSet.arn, * }, { * dependsOn: [exampleAccountAssignment], * }); * ``` * * ## Import * * ### Identity Schema * * #### Required * * * `instanceArn` (String) ARN of the SSO Instance. * * `permissionSetArn` (String) ARN of the Permission Set. * * `principalId` (String) Identifier of the principal in IAM Identity Center. * * `principalType` (String) Type of principal. Valid values are `USER` and `GROUP`. * * `targetId` (String) AWS account identifier. * * `targetType` (String) Target type. Valid value is `AWS_ACCOUNT`. * * #### Optional * * * `accountId` (String) AWS Account where this resource is managed. * * `region` (String) Region where this resource is managed. * * Using `pulumi import`, import SSO Account Assignments using the `principalId`, `principalType`, `targetId`, `targetType`, `permissionSetArn`, `instanceArn` separated by commas (`,`). For example: * * ```sh * $ pulumi import aws:ssoadmin/accountAssignment:AccountAssignment example f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef * ``` */ export declare class AccountAssignment extends pulumi.CustomResource { /** * Get an existing AccountAssignment resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: AccountAssignmentState, opts?: pulumi.CustomResourceOptions): AccountAssignment; /** * Returns true if the given object is an instance of AccountAssignment. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is AccountAssignment; /** * ARN of the SSO Instance. */ readonly instanceArn: pulumi.Output; /** * ARN of the Permission Set that the admin wants to grant the principal access to. */ readonly permissionSetArn: pulumi.Output; /** * An identifier for an object in SSO, such as a user or group. PrincipalIds are GUIDs (For example, `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`). */ readonly principalId: pulumi.Output; /** * The entity type for which the assignment will be created. Valid values: `USER`, `GROUP`. */ readonly principalType: pulumi.Output; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ readonly region: pulumi.Output; /** * An AWS account identifier, typically a 10-12 digit string. */ readonly targetId: pulumi.Output; /** * The entity type for which the assignment will be created. Valid values: `AWS_ACCOUNT`. */ readonly targetType: pulumi.Output; /** * Create a AccountAssignment resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: AccountAssignmentArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering AccountAssignment resources. */ export interface AccountAssignmentState { /** * ARN of the SSO Instance. */ instanceArn?: pulumi.Input; /** * ARN of the Permission Set that the admin wants to grant the principal access to. */ permissionSetArn?: pulumi.Input; /** * An identifier for an object in SSO, such as a user or group. PrincipalIds are GUIDs (For example, `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`). */ principalId?: pulumi.Input; /** * The entity type for which the assignment will be created. Valid values: `USER`, `GROUP`. */ principalType?: pulumi.Input; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ region?: pulumi.Input; /** * An AWS account identifier, typically a 10-12 digit string. */ targetId?: pulumi.Input; /** * The entity type for which the assignment will be created. Valid values: `AWS_ACCOUNT`. */ targetType?: pulumi.Input; } /** * The set of arguments for constructing a AccountAssignment resource. */ export interface AccountAssignmentArgs { /** * ARN of the SSO Instance. */ instanceArn: pulumi.Input; /** * ARN of the Permission Set that the admin wants to grant the principal access to. */ permissionSetArn: pulumi.Input; /** * An identifier for an object in SSO, such as a user or group. PrincipalIds are GUIDs (For example, `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`). */ principalId: pulumi.Input; /** * The entity type for which the assignment will be created. Valid values: `USER`, `GROUP`. */ principalType: pulumi.Input; /** * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration. */ region?: pulumi.Input; /** * An AWS account identifier, typically a 10-12 digit string. */ targetId: pulumi.Input; /** * The entity type for which the assignment will be created. Valid values: `AWS_ACCOUNT`. */ targetType: pulumi.Input; } //# sourceMappingURL=accountAssignment.d.ts.map