import * as pulumi from "@pulumi/pulumi";
import { input as inputs } from "../types";
export declare namespace accesscontextmanager {
    namespace v1 {
        /**
         * Identification for an API Operation.
         */
        interface ApiOperation {
            /**
             * API methods or permissions to allow. Method or permission must belong to the service specified by `service_name` field. A single MethodSelector entry with `*` specified for the `method` field will allow all methods AND permissions for the service specified in `service_name`.
             */
            methodSelectors?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.MethodSelector>[]>;
            /**
             * The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with `service_name` field set to `*` will allow all methods AND permissions for all services.
             */
            serviceName?: pulumi.Input<string>;
        }
        /**
         * `BasicLevel` is an `AccessLevel` using a set of recommended features.
         */
        interface BasicLevel {
            /**
             * How the `conditions` list should be combined to determine if a request is granted this `AccessLevel`. If AND is used, each `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. If OR is used, at least one `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. Default behavior is AND.
             */
            combiningFunction?: pulumi.Input<string>;
            /**
             * Required. A list of requirements for the `AccessLevel` to be granted.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.Condition>[]>;
        }
        /**
         * A condition necessary for an `AccessLevel` to be granted. The Condition is an AND over its fields. So a Condition is true if: 1) the request IP is from one of the listed subnetworks AND 2) the originating device complies with the listed device policy AND 3) all listed access levels are granted AND 4) the request was sent at a time allowed by the DateTimeRestriction.
         */
        interface Condition {
            /**
             * Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed.
             */
            devicePolicy?: pulumi.Input<inputs.accesscontextmanager.v1.DevicePolicy>;
            /**
             * CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
             */
            ipSubnetworks?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: `user:{emailid}` `serviceAccount:{emailid}` If not specified, a request may come from any user.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
             */
            negate?: pulumi.Input<boolean>;
            /**
             * The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
             */
            regions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of other access levels defined in the same `Policy`, referenced by resource name. Referencing an `AccessLevel` which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
             */
            requiredAccessLevels?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec
         */
        interface CustomLevel {
            /**
             * Required. A Cloud CEL expression evaluating to a boolean.
             */
            expr?: pulumi.Input<inputs.accesscontextmanager.v1.Expr>;
        }
        /**
         * `DevicePolicy` specifies device specific restrictions necessary to acquire a given access level. A `DevicePolicy` specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. `DevicePolicy` acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.
         */
        interface DevicePolicy {
            /**
             * Allowed device management levels, an empty list allows all management levels.
             */
            allowedDeviceManagementLevels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Allowed encryptions statuses, an empty list allows all statuses.
             */
            allowedEncryptionStatuses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Allowed OS versions, an empty list allows all types and all versions.
             */
            osConstraints?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.OsConstraint>[]>;
            /**
             * Whether the device needs to be approved by the customer admin.
             */
            requireAdminApproval?: pulumi.Input<boolean>;
            /**
             * Whether the device needs to be corp owned.
             */
            requireCorpOwned?: pulumi.Input<boolean>;
            /**
             * Whether or not screenlock is required for the DevicePolicy to be true. Defaults to `false`.
             */
            requireScreenlock?: pulumi.Input<boolean>;
        }
        /**
         * Defines the conditions under which an EgressPolicy matches a request. Conditions based on information about the source of the request. Note that if the destination of the request is protected by a ServicePerimeter, then that ServicePerimeter must have an IngressPolicy which allows access in order for this request to succeed.
         */
        interface EgressFrom {
            /**
             * A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
             */
            identities?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of `identities` field will be allowed access.
             */
            identityType?: pulumi.Input<string>;
        }
        /**
         * Policy for egress from perimeter. EgressPolicies match requests based on `egress_from` and `egress_to` stanzas. For an EgressPolicy to match, both `egress_from` and `egress_to` stanzas must be matched. If an EgressPolicy matches a request, the request is allowed to span the ServicePerimeter boundary. For example, an EgressPolicy can be used to allow VMs on networks within the ServicePerimeter to access a defined set of projects outside the perimeter in certain contexts (e.g. to read data from a Cloud Storage bucket or query against a BigQuery dataset). EgressPolicies are concerned with the *resources* that a request relates as well as the API services and API actions being used. They do not related to the direction of data movement. More detailed documentation for this concept can be found in the descriptions of EgressFrom and EgressTo.
         */
        interface EgressPolicy {
            /**
             * Defines conditions on the source of a request causing this EgressPolicy to apply.
             */
            egressFrom?: pulumi.Input<inputs.accesscontextmanager.v1.EgressFrom>;
            /**
             * Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
             */
            egressTo?: pulumi.Input<inputs.accesscontextmanager.v1.EgressTo>;
        }
        /**
         * Defines the conditions under which an EgressPolicy matches a request. Conditions are based on information about the ApiOperation intended to be performed on the `resources` specified. Note that if the destination of the request is protected by a ServicePerimeter, then that ServicePerimeter must have an IngressPolicy which allows access in order for this request to succeed.
         */
        interface EgressTo {
            /**
             * A list of ApiOperations that this egress rule applies to. A request matches if it contains an operation/service in this list.
             */
            operations?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.ApiOperation>[]>;
            /**
             * A list of resources, currently only projects in the form `projects/`, that match this to stanza. A request matches if it contains a resource in this list. If `*` is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
             */
            resources?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Defines the conditions under which an IngressPolicy matches a request. Conditions are based on information about the source of the request.
         */
        interface IngressFrom {
            /**
             * A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
             */
            identities?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of `identities` field will be allowed access.
             */
            identityType?: pulumi.Input<string>;
            /**
             * Sources that this IngressPolicy authorizes access from.
             */
            sources?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.IngressSource>[]>;
        }
        /**
         * Policy for ingress into ServicePerimeter. IngressPolicies match requests based on `ingress_from` and `ingress_to` stanzas. For an ingress policy to match, both the `ingress_from` and `ingress_to` stanzas must be matched. If an IngressPolicy matches a request, the request is allowed through the perimeter boundary from outside the perimeter. For example, access from the internet can be allowed either based on an AccessLevel or, for traffic hosted on Google Cloud, the project of the source network. For access from private networks, using the project of the hosting network is required. Individual ingress policies can be limited by restricting which services and/or actions they match using the `ingress_to` field.
         */
        interface IngressPolicy {
            /**
             * Defines the conditions on the source of a request causing this IngressPolicy to apply.
             */
            ingressFrom?: pulumi.Input<inputs.accesscontextmanager.v1.IngressFrom>;
            /**
             * Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
             */
            ingressTo?: pulumi.Input<inputs.accesscontextmanager.v1.IngressTo>;
        }
        /**
         * The source that IngressPolicy authorizes access from.
         */
        interface IngressSource {
            /**
             * An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `accessPolicies/MY_POLICY/accessLevels/MY_LEVEL`. If `*` is specified, then all IngressSources will be allowed.
             */
            accessLevel?: pulumi.Input<string>;
            /**
             * A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: `projects/{project_number}` The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. `*` is not allowed, the case of allowing all Google Cloud resources only is not supported.
             */
            resource?: pulumi.Input<string>;
        }
        /**
         * Defines the conditions under which an IngressPolicy matches a request. Conditions are based on information about the ApiOperation intended to be performed on the destination of the request.
         */
        interface IngressTo {
            /**
             * A list of ApiOperations the sources specified in corresponding IngressFrom are allowed to perform in this ServicePerimeter.
             */
            operations?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.ApiOperation>[]>;
            /**
             * A list of resources, currently only projects in the form `projects/`, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. A request matches if it contains a resource in this list. If `*` is specified for resources, then this IngressTo rule will authorize access to all resources inside the perimeter, provided that the request also matches the `operations` field.
             */
            resources?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * An allowed method or permission of a service specified in ApiOperation.
         */
        interface MethodSelector {
            /**
             * Value for `method` should be a valid method name for the corresponding `service_name` in ApiOperation. If `*` used as value for `method`, then ALL methods and permissions are allowed.
             */
            method?: pulumi.Input<string>;
            /**
             * Value for `permission` should be a valid Cloud IAM permission for the corresponding `service_name` in ApiOperation.
             */
            permission?: pulumi.Input<string>;
        }
        /**
         * A restriction on the OS type and version of devices making requests.
         */
        interface OsConstraint {
            /**
             * The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: `"major.minor.patch"`. Examples: `"10.5.301"`, `"9.2.1"`.
             */
            minimumVersion?: pulumi.Input<string>;
            /**
             * Required. The allowed OS type.
             */
            osType?: pulumi.Input<string>;
            /**
             * Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request.
             */
            requireVerifiedChromeOs?: pulumi.Input<boolean>;
        }
        /**
         * `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration.
         */
        interface ServicePerimeterConfig {
            /**
             * A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty.
             */
            accessLevels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
             */
            egressPolicies?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.EgressPolicy>[]>;
            /**
             * List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
             */
            ingressPolicies?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1.IngressPolicy>[]>;
            /**
             * A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: `projects/{project_number}`
             */
            resources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Google Cloud services that are subject to the Service Perimeter restrictions. For example, if `storage.googleapis.com` is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
             */
            restrictedServices?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Configuration for APIs allowed within Perimeter.
             */
            vpcAccessibleServices?: pulumi.Input<inputs.accesscontextmanager.v1.VpcAccessibleServices>;
        }
        /**
         * Specifies how APIs are allowed to communicate within the Service Perimeter.
         */
        interface VpcAccessibleServices {
            /**
             * The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
             */
            allowedServices?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
             */
            enableRestriction?: pulumi.Input<boolean>;
        }
    }
    namespace v1beta {
        /**
         * `BasicLevel` is an `AccessLevel` using a set of recommended features.
         */
        interface BasicLevel {
            /**
             * How the `conditions` list should be combined to determine if a request is granted this `AccessLevel`. If AND is used, each `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. If OR is used, at least one `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. Default behavior is AND.
             */
            combiningFunction?: pulumi.Input<string>;
            /**
             * Required. A list of requirements for the `AccessLevel` to be granted.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1beta.Condition>[]>;
        }
        /**
         * A condition necessary for an `AccessLevel` to be granted. The Condition is an AND over its fields. So a Condition is true if: 1) the request IP is from one of the listed subnetworks AND 2) the originating device complies with the listed device policy AND 3) all listed access levels are granted AND 4) the request was sent at a time allowed by the DateTimeRestriction.
         */
        interface Condition {
            /**
             * Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed.
             */
            devicePolicy?: pulumi.Input<inputs.accesscontextmanager.v1beta.DevicePolicy>;
            /**
             * CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
             */
            ipSubnetworks?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: `user:{emailid}` `serviceAccount:{emailid}` If not specified, a request may come from any user.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
             */
            negate?: pulumi.Input<boolean>;
            /**
             * The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
             */
            regions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of other access levels defined in the same `Policy`, referenced by resource name. Referencing an `AccessLevel` which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
             */
            requiredAccessLevels?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec
         */
        interface CustomLevel {
            /**
             * Required. A Cloud CEL expression evaluating to a boolean.
             */
            expr?: pulumi.Input<inputs.accesscontextmanager.v1beta.Expr>;
        }
        /**
         * `DevicePolicy` specifies device specific restrictions necessary to acquire a given access level. A `DevicePolicy` specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. `DevicePolicy` acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.
         */
        interface DevicePolicy {
            /**
             * Allowed device management levels, an empty list allows all management levels.
             */
            allowedDeviceManagementLevels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Allowed encryptions statuses, an empty list allows all statuses.
             */
            allowedEncryptionStatuses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Allowed OS versions, an empty list allows all types and all versions.
             */
            osConstraints?: pulumi.Input<pulumi.Input<inputs.accesscontextmanager.v1beta.OsConstraint>[]>;
            /**
             * Whether the device needs to be approved by the customer admin.
             */
            requireAdminApproval?: pulumi.Input<boolean>;
            /**
             * Whether the device needs to be corp owned.
             */
            requireCorpOwned?: pulumi.Input<boolean>;
            /**
             * Whether or not screenlock is required for the DevicePolicy to be true. Defaults to `false`.
             */
            requireScreenlock?: pulumi.Input<boolean>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A restriction on the OS type and version of devices making requests.
         */
        interface OsConstraint {
            /**
             * The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: `"major.minor.patch"`. Examples: `"10.5.301"`, `"9.2.1"`.
             */
            minimumVersion?: pulumi.Input<string>;
            /**
             * Required. The allowed OS type.
             */
            osType?: pulumi.Input<string>;
            /**
             * Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request.
             */
            requireVerifiedChromeOs?: pulumi.Input<boolean>;
        }
        /**
         * `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration.
         */
        interface ServicePerimeterConfig {
            /**
             * A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty.
             */
            accessLevels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: `projects/{project_number}`
             */
            resources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Google Cloud services that are subject to the Service Perimeter restrictions. Must contain a list of services. For example, if `storage.googleapis.com` is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
             */
            restrictedServices?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Beta. Configuration for APIs allowed within Perimeter.
             */
            vpcAccessibleServices?: pulumi.Input<inputs.accesscontextmanager.v1beta.VpcAccessibleServices>;
        }
        /**
         * Specifies how APIs are allowed to communicate within the Service Perimeter.
         */
        interface VpcAccessibleServices {
            /**
             * The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
             */
            allowedServices?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
             */
            enableRestriction?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace apigateway {
    namespace v1 {
        /**
         * A lightweight description of a file.
         */
        interface ApigatewayApiConfigFile {
            /**
             * The bytes that constitute the file.
             */
            contents?: pulumi.Input<string>;
            /**
             * The file path (full or relative path). This is typically the path of the file when it is uploaded.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * A gRPC service definition.
         */
        interface ApigatewayApiConfigGrpcServiceDefinition {
            /**
             * Input only. File descriptor set, generated by protoc. To generate, use protoc with imports and source info included. For an example test.proto file, the following command would put the value in a new file named out.pb. $ protoc --include_imports --include_source_info test.proto -o out.pb
             */
            fileDescriptorSet?: pulumi.Input<inputs.apigateway.v1.ApigatewayApiConfigFile>;
            /**
             * Optional. Uncompiled proto files associated with the descriptor set, used for display purposes (server-side compilation is not supported). These should match the inputs to 'protoc' command used to generate file_descriptor_set.
             */
            source?: pulumi.Input<pulumi.Input<inputs.apigateway.v1.ApigatewayApiConfigFile>[]>;
        }
        /**
         * An OpenAPI Specification Document describing an API.
         */
        interface ApigatewayApiConfigOpenApiDocument {
            /**
             * The OpenAPI Specification document file.
             */
            document?: pulumi.Input<inputs.apigateway.v1.ApigatewayApiConfigFile>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface ApigatewayAuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.apigateway.v1.ApigatewayAuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface ApigatewayAuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface ApigatewayBinding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.apigateway.v1.ApigatewayExpr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface ApigatewayExpr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta {
        /**
         * A lightweight description of a file.
         */
        interface ApigatewayApiConfigFile {
            /**
             * The bytes that constitute the file.
             */
            contents?: pulumi.Input<string>;
            /**
             * The file path (full or relative path). This is typically the path of the file when it is uploaded.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * A gRPC service definition.
         */
        interface ApigatewayApiConfigGrpcServiceDefinition {
            /**
             * Input only. File descriptor set, generated by protoc. To generate, use protoc with imports and source info included. For an example test.proto file, the following command would put the value in a new file named out.pb. $ protoc --include_imports --include_source_info test.proto -o out.pb
             */
            fileDescriptorSet?: pulumi.Input<inputs.apigateway.v1beta.ApigatewayApiConfigFile>;
            /**
             * Optional. Uncompiled proto files associated with the descriptor set, used for display purposes (server-side compilation is not supported). These should match the inputs to 'protoc' command used to generate file_descriptor_set.
             */
            source?: pulumi.Input<pulumi.Input<inputs.apigateway.v1beta.ApigatewayApiConfigFile>[]>;
        }
        /**
         * An OpenAPI Specification Document describing an API.
         */
        interface ApigatewayApiConfigOpenApiDocument {
            /**
             * The OpenAPI Specification document file.
             */
            document?: pulumi.Input<inputs.apigateway.v1beta.ApigatewayApiConfigFile>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface ApigatewayAuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.apigateway.v1beta.ApigatewayAuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface ApigatewayAuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Configuration for all backends.
         */
        interface ApigatewayBackendConfig {
            /**
             * Google Cloud IAM service account used to sign OIDC tokens for backends that have authentication configured (https://cloud.google.com/service-infrastructure/docs/service-management/reference/rest/v1/services.configs#backend). This may either be the Service Account's email (i.e. "{ACCOUNT_ID}@{PROJECT}.iam.gserviceaccount.com") or its full resource name (i.e. "projects/{PROJECT}/accounts/{UNIQUE_ID}"). This is most often used when the backend is a GCP resource such as a Cloud Run Service or an IAP-secured service. Note that this token is always sent as an authorization header bearer token. The audience of the OIDC token is configured in the associated Service Config in the BackendRule option (https://github.com/googleapis/googleapis/blob/master/google/api/backend.proto#L125).
             */
            googleServiceAccount?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface ApigatewayBinding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.apigateway.v1beta.ApigatewayExpr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface ApigatewayExpr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Configuration settings for Gateways.
         */
        interface ApigatewayGatewayConfig {
            /**
             * Required. Backend settings that are applied to all backends of the Gateway.
             */
            backendConfig?: pulumi.Input<inputs.apigateway.v1beta.ApigatewayBackendConfig>;
        }
    }
}
export declare namespace apigee {
    namespace v1 {
        /**
         * Key-value pair to store extra metadata.
         */
        interface GoogleCloudApigeeV1Attribute {
            /**
             * API key of the attribute.
             */
            name?: pulumi.Input<string>;
            /**
             * Value of the attribute.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Labels that can be used to filter Apigee metrics.
         */
        interface GoogleCloudApigeeV1CanaryEvaluationMetricLabels {
            /**
             * The environment ID associated with the metrics.
             */
            env?: pulumi.Input<string>;
            /**
             * Required. The instance ID associated with the metrics. In Apigee Hybrid, the value is configured during installation.
             */
            instance_id?: pulumi.Input<string>;
            /**
             * Required. The location associated with the metrics.
             */
            location?: pulumi.Input<string>;
        }
        /**
         * This encapsulates a metric property of the form sum(message_count) where name is message_count and function is sum
         */
        interface GoogleCloudApigeeV1CustomReportMetric {
            /**
             * aggregate function
             */
            function?: pulumi.Input<string>;
            /**
             * name of the metric
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Configuration detail for datastore
         */
        interface GoogleCloudApigeeV1DatastoreConfig {
            /**
             * Name of the Cloud Storage bucket. Required for `gcs` target_type.
             */
            bucketName?: pulumi.Input<string>;
            /**
             * BigQuery dataset name Required for `bigquery` target_type.
             */
            datasetName?: pulumi.Input<string>;
            /**
             * Path of Cloud Storage bucket Required for `gcs` target_type.
             */
            path?: pulumi.Input<string>;
            /**
             * Required. GCP project in which the datastore exists
             */
            projectId?: pulumi.Input<string>;
            /**
             * Prefix of BigQuery table Required for `bigquery` target_type.
             */
            tablePrefix?: pulumi.Input<string>;
        }
        /**
         * Date range of the data to export.
         */
        interface GoogleCloudApigeeV1DateRange {
            /**
             * Required. End date (exclusive) of the data to export in the format `yyyy-mm-dd`. The date range ends at 00:00:00 UTC on the end date- which will not be in the output.
             */
            end?: pulumi.Input<string>;
            /**
             * Required. Start date of the data to export in the format `yyyy-mm-dd`. The date range begins at 00:00:00 UTC on the start date.
             */
            start?: pulumi.Input<string>;
        }
        /**
         * GraphQLOperation represents the pairing of graphQL operation types and the graphQL operation name.
         */
        interface GoogleCloudApigeeV1GraphQLOperation {
            /**
             * GraphQL operation name, along with operation type which will be used to associate quotas with. If no name is specified, the quota will be applied to all graphQL operations irrespective of their operation names in the payload.
             */
            operation?: pulumi.Input<string>;
            /**
             * Required. `query`, `mutation` and `subscription` are the three operation types offered by graphQL. Currently we support only `query` and `mutation`.
             */
            operationTypes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * GraphQLOperationConfig binds the resources in a proxy or remote service with the graphQL operation and its associated quota enforcement.
         */
        interface GoogleCloudApigeeV1GraphQLOperationConfig {
            /**
             * Required. API proxy endpoint or remote service name with which the graphQL operation, and quota are associated.
             */
            apiSource?: pulumi.Input<string>;
            /**
             * Custom attributes associated with the operation.
             */
            attributes?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Attribute>[]>;
            /**
             * Required. List of graphQL name/Operation type pairs for the proxy/remote service, upon which quota will applied. If GraphQLOperation operation has only the operation type(s), that would imply that quota will be applied on all graphQL requests irrespective of the graphQL name. **Note**: Currently, we can specify only a single GraphQLOperation. Specifying more than one will result in failure of the operation.
             */
            operations?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1GraphQLOperation>[]>;
            /**
             * Quota parameters to be enforced for the resources, methods, api_source combination. If none are specified, quota enforcement will not be done.
             */
            quota?: pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Quota>;
        }
        /**
         * List of graphQL operation configuration details associated with Apigee API proxies or remote services. Remote services are non-Apigee proxies, such as Istio-Envoy.
         */
        interface GoogleCloudApigeeV1GraphQLOperationGroup {
            /**
             * Flag that specifes whether the configuration is for Apigee API proxy or a remote service. Valid values are `proxy` or `remoteservice`. Defaults to `proxy`. Set to `proxy` when Apigee API proxies are associated with the API product. Set to `remoteservice` when non-Apigee proxies like Istio-Envoy are associated with the API product.
             */
            operationConfigType?: pulumi.Input<string>;
            /**
             * Required. List of operation configurations for either Apigee API proxies or other remote services that are associated with this API product.
             */
            operationConfigs?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1GraphQLOperationConfig>[]>;
        }
        /**
         * Operation represents the pairing of REST resource path and the actions (verbs) allowed on the resource path.
         */
        interface GoogleCloudApigeeV1Operation {
            /**
             * methods refers to the REST verbs as in https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html. When none specified, all verb types are allowed.
             */
            methods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. resource represents REST resource path associated with the proxy/remote service.
             */
            resource?: pulumi.Input<string>;
        }
        /**
         * OperationConfig binds the resources in a proxy or remote service with the allowed REST methods and its associated quota enforcement.
         */
        interface GoogleCloudApigeeV1OperationConfig {
            /**
             * Required. API proxy or remote service name with which the resources, methods, and quota are associated.
             */
            apiSource?: pulumi.Input<string>;
            /**
             * Custom attributes associated with the operation.
             */
            attributes?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Attribute>[]>;
            /**
             * List of resource/method pairs for the proxy/remote service, upon which quota will applied. **Note**: Currently, you can specify only a single resource/method pair. The call will fail if more than one resource/method pair is provided.
             */
            operations?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Operation>[]>;
            /**
             * Quota parameters to be enforced for the resources, methods, api_source combination. If none are specified, quota enforcement will not be done.
             */
            quota?: pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Quota>;
        }
        /**
         * List of operation configuration details associated with Apigee API proxies or remote services. Remote services are non-Apigee proxies, such as Istio-Envoy.
         */
        interface GoogleCloudApigeeV1OperationGroup {
            /**
             * Flag that specifes whether the configuration is for Apigee API proxy or a remote service. Valid values are `proxy` or `remoteservice`. Defaults to `proxy`. Set to `proxy` when Apigee API proxies are associated with the API product. Set to `remoteservice` when non-Apigee proxies like Istio-Envoy are associated with the API product.
             */
            operationConfigType?: pulumi.Input<string>;
            /**
             * Required. List of operation configurations for either Apigee API proxies or other remote services that are associated with this API product.
             */
            operationConfigs?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1OperationConfig>[]>;
        }
        /**
         * Message for compatibility with legacy Edge specification for Java Properties object in JSON.
         */
        interface GoogleCloudApigeeV1Properties {
            /**
             * List of all properties in the object
             */
            property?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Property>[]>;
        }
        /**
         * A single property entry in the Properties message.
         */
        interface GoogleCloudApigeeV1Property {
            /**
             * The property key
             */
            name?: pulumi.Input<string>;
            /**
             * The property value
             */
            value?: pulumi.Input<string>;
        }
        /**
         * More info about Metric: https://docs.apigee.com/api-platform/analytics/analytics-reference#metrics
         */
        interface GoogleCloudApigeeV1QueryMetric {
            /**
             * Alias for the metric. Alias will be used to replace metric name in query results.
             */
            alias?: pulumi.Input<string>;
            /**
             * Aggregation function: avg, min, max, or sum.
             */
            function?: pulumi.Input<string>;
            /**
             * Required. Metric name.
             */
            name?: pulumi.Input<string>;
            /**
             * One of `+`, `-`, `/`, `%`, `*`.
             */
            operator?: pulumi.Input<string>;
            /**
             * Operand value should be provided when operator is set.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Quota contains the essential parameters needed that can be applied on a proxy/remote service, resources and methods combination associated with this API product. While setting of Quota is optional, setting it prevents requests from exceeding the provisioned parameters.
         */
        interface GoogleCloudApigeeV1Quota {
            /**
             * Required. Time interval over which the number of request messages is calculated.
             */
            interval?: pulumi.Input<string>;
            /**
             * Required. Upper limit allowed for the time interval and time unit specified. Requests exceeding this limit will be rejected.
             */
            limit?: pulumi.Input<string>;
            /**
             * Time unit defined for the `interval`. Valid values include `minute`, `hour`, `day`, or `month`. If `limit` and `interval` are valid, the default value is `hour`; otherwise, the default is null.
             */
            timeUnit?: pulumi.Input<string>;
        }
        interface GoogleCloudApigeeV1ReportProperty {
            /**
             * name of the property
             */
            property?: pulumi.Input<string>;
            /**
             * property values
             */
            value?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1Attribute>[]>;
        }
        /**
         * TLS configuration information for VirtualHosts and TargetServers.
         */
        interface GoogleCloudApigeeV1TlsInfo {
            /**
             * The SSL/TLS cipher suites to be used. Must be one of the cipher suite names listed in: http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
             */
            ciphers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Enables two-way TLS.
             */
            clientAuthEnabled?: pulumi.Input<boolean>;
            /**
             * The TLS Common Name of the certificate.
             */
            commonName?: pulumi.Input<inputs.apigee.v1.GoogleCloudApigeeV1TlsInfoCommonName>;
            /**
             * Required. Enables TLS. If false, neither one-way nor two-way TLS will be enabled.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * If true, Edge ignores TLS certificate errors. Valid when configuring TLS for target servers and target endpoints, and when configuring virtual hosts that use 2-way TLS. When used with a target endpoint/target server, if the backend system uses SNI and returns a cert with a subject Distinguished Name (DN) that does not match the hostname, there is no way to ignore the error and the connection fails.
             */
            ignoreValidationErrors?: pulumi.Input<boolean>;
            /**
             * Required if `client_auth_enabled` is true. The resource ID for the alias containing the private key and cert.
             */
            keyAlias?: pulumi.Input<string>;
            /**
             * Required if `client_auth_enabled` is true. The resource ID of the keystore. References not yet supported.
             */
            keyStore?: pulumi.Input<string>;
            /**
             * The TLS versioins to be used.
             */
            protocols?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The resource ID of the truststore. References not yet supported.
             */
            trustStore?: pulumi.Input<string>;
        }
        interface GoogleCloudApigeeV1TlsInfoCommonName {
            /**
             * The TLS Common Name string of the certificate.
             */
            value?: pulumi.Input<string>;
            /**
             * Indicates whether the cert should be matched against as a wildcard cert.
             */
            wildcardMatch?: pulumi.Input<boolean>;
        }
        /**
         * TraceSamplingConfig represents the detail settings of distributed tracing. Only the fields that are defined in the distributed trace configuration can be overridden using the distribute trace configuration override APIs.
         */
        interface GoogleCloudApigeeV1TraceSamplingConfig {
            /**
             * Sampler of distributed tracing. OFF is the default value.
             */
            sampler?: pulumi.Input<string>;
            /**
             * Field sampling rate. This value is only applicable when using the PROBABILITY sampler. The supported values are > 0 and <= 0.5.
             */
            samplingRate?: pulumi.Input<number>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface GoogleIamV1AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.apigee.v1.GoogleIamV1AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface GoogleIamV1AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface GoogleIamV1Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.apigee.v1.GoogleTypeExpr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface GoogleTypeExpr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace appengine {
    namespace v1 {
        /**
         * Google Cloud Endpoints (https://cloud.google.com/appengine/docs/python/endpoints/) configuration for API handlers.
         */
        interface ApiConfigHandler {
            /**
             * Action to take when users access resources that require authentication. Defaults to redirect.
             */
            authFailAction?: pulumi.Input<string>;
            /**
             * Level of login required to access this resource. Defaults to optional.
             */
            login?: pulumi.Input<string>;
            /**
             * Path to the script from the application root directory.
             */
            script?: pulumi.Input<string>;
            /**
             * Security (HTTPS) enforcement for this URL.
             */
            securityLevel?: pulumi.Input<string>;
            /**
             * URL to serve the endpoint at.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Uses Google Cloud Endpoints to handle requests.
         */
        interface ApiEndpointHandler {
            /**
             * Path to the script from the application root directory.
             */
            scriptPath?: pulumi.Input<string>;
        }
        /**
         * Automatic scaling is based on request rate, response latencies, and other application metrics.
         */
        interface AutomaticScaling {
            /**
             * The time period that the Autoscaler (https://cloud.google.com/compute/docs/autoscaler/) should wait before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. Only applicable in the App Engine flexible environment.
             */
            coolDownPeriod?: pulumi.Input<string>;
            /**
             * Target scaling by CPU usage.
             */
            cpuUtilization?: pulumi.Input<inputs.appengine.v1.CpuUtilization>;
            /**
             * Target scaling by disk usage.
             */
            diskUtilization?: pulumi.Input<inputs.appengine.v1.DiskUtilization>;
            /**
             * Number of concurrent requests an automatic scaling instance can accept before the scheduler spawns a new instance.Defaults to a runtime-specific value.
             */
            maxConcurrentRequests?: pulumi.Input<number>;
            /**
             * Maximum number of idle instances that should be maintained for this version.
             */
            maxIdleInstances?: pulumi.Input<number>;
            /**
             * Maximum amount of time that a request should wait in the pending queue before starting a new instance to handle it.
             */
            maxPendingLatency?: pulumi.Input<string>;
            /**
             * Maximum number of instances that should be started to handle requests for this version.
             */
            maxTotalInstances?: pulumi.Input<number>;
            /**
             * Minimum number of idle instances that should be maintained for this version. Only applicable for the default version of a service.
             */
            minIdleInstances?: pulumi.Input<number>;
            /**
             * Minimum amount of time a request should wait in the pending queue before starting a new instance to handle it.
             */
            minPendingLatency?: pulumi.Input<string>;
            /**
             * Minimum number of running instances that should be maintained for this version.
             */
            minTotalInstances?: pulumi.Input<number>;
            /**
             * Target scaling by network usage.
             */
            networkUtilization?: pulumi.Input<inputs.appengine.v1.NetworkUtilization>;
            /**
             * Target scaling by request utilization.
             */
            requestUtilization?: pulumi.Input<inputs.appengine.v1.RequestUtilization>;
            /**
             * Scheduler settings for standard environment.
             */
            standardSchedulerSettings?: pulumi.Input<inputs.appengine.v1.StandardSchedulerSettings>;
        }
        /**
         * A service with basic scaling will create an instance when the application receives a request. The instance will be turned down when the app becomes idle. Basic scaling is ideal for work that is intermittent or driven by user activity.
         */
        interface BasicScaling {
            /**
             * Duration of time after the last request that an instance must wait before the instance is shut down.
             */
            idleTimeout?: pulumi.Input<string>;
            /**
             * Maximum number of instances to create for this version.
             */
            maxInstances?: pulumi.Input<number>;
        }
        /**
         * An SSL certificate obtained from a certificate authority.
         */
        interface CertificateRawData {
            /**
             * Unencrypted PEM encoded RSA private key. This field is set once on certificate creation and then encrypted. The key size must be 2048 bits or fewer. Must include the header and footer. Example: -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- @InputOnly
             */
            privateKey?: pulumi.Input<string>;
            /**
             * PEM encoded x.509 public key certificate. This field is set once on certificate creation. Must include the header and footer. Example: -----BEGIN CERTIFICATE----- -----END CERTIFICATE-----
             */
            publicCertificate?: pulumi.Input<string>;
        }
        /**
         * Options for the build operations performed as a part of the version deployment. Only applicable for App Engine flexible environment when creating a version using source code directly.
         */
        interface CloudBuildOptions {
            /**
             * Path to the yaml file used in deployment, used to determine runtime configuration details.Required for flexible environment builds.See https://cloud.google.com/appengine/docs/standard/python/config/appref for more details.
             */
            appYamlPath?: pulumi.Input<string>;
            /**
             * The Cloud Build timeout used as part of any dependent builds performed by version creation. Defaults to 10 minutes.
             */
            cloudBuildTimeout?: pulumi.Input<string>;
        }
        /**
         * Docker image that is used to create a container and start a VM instance for the version that you deploy. Only applicable for instances running in the App Engine flexible environment.
         */
        interface ContainerInfo {
            /**
             * URI to the hosted container image in Google Container Registry. The URI must be fully qualified and include a tag or digest. Examples: "gcr.io/my-project/image:tag" or "gcr.io/my-project/image@digest"
             */
            image?: pulumi.Input<string>;
        }
        /**
         * Target scaling by CPU usage.
         */
        interface CpuUtilization {
            /**
             * Period of time over which CPU utilization is calculated.
             */
            aggregationWindowLength?: pulumi.Input<string>;
            /**
             * Target CPU utilization ratio to maintain when scaling. Must be between 0 and 1.
             */
            targetUtilization?: pulumi.Input<number>;
        }
        /**
         * Code and application artifacts used to deploy a version to App Engine.
         */
        interface Deployment {
            /**
             * Options for any Google Cloud Build builds created as a part of this deployment.These options will only be used if a new build is created, such as when deploying to the App Engine flexible environment using files or zip.
             */
            cloudBuildOptions?: pulumi.Input<inputs.appengine.v1.CloudBuildOptions>;
            /**
             * The Docker image for the container that runs the version. Only applicable for instances running in the App Engine flexible environment.
             */
            container?: pulumi.Input<inputs.appengine.v1.ContainerInfo>;
            /**
             * Manifest of the files stored in Google Cloud Storage that are included as part of this version. All files must be readable using the credentials supplied with this call.
             */
            files?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The zip file for this deployment, if this is a zip deployment.
             */
            zip?: pulumi.Input<inputs.appengine.v1.ZipInfo>;
        }
        /**
         * Target scaling by disk usage. Only applicable in the App Engine flexible environment.
         */
        interface DiskUtilization {
            /**
             * Target bytes read per second.
             */
            targetReadBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target ops read per seconds.
             */
            targetReadOpsPerSecond?: pulumi.Input<number>;
            /**
             * Target bytes written per second.
             */
            targetWriteBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target ops written per second.
             */
            targetWriteOpsPerSecond?: pulumi.Input<number>;
        }
        /**
         * Cloud Endpoints (https://cloud.google.com/endpoints) configuration. The Endpoints API Service provides tooling for serving Open API and gRPC endpoints via an NGINX proxy. Only valid for App Engine Flexible environment deployments.The fields here refer to the name and configuration ID of a "service" resource in the Service Management API (https://cloud.google.com/service-management/overview).
         */
        interface EndpointsApiService {
            /**
             * Endpoints service configuration ID as specified by the Service Management API. For example "2016-09-19r1".By default, the rollout strategy for Endpoints is RolloutStrategy.FIXED. This means that Endpoints starts up with a particular configuration ID. When a new configuration is rolled out, Endpoints must be given the new configuration ID. The config_id field is used to give the configuration ID and is required in this case.Endpoints also has a rollout strategy called RolloutStrategy.MANAGED. When using this, Endpoints fetches the latest configuration and does not need the configuration ID. In this case, config_id must be omitted.
             */
            configId?: pulumi.Input<string>;
            /**
             * Enable or disable trace sampling. By default, this is set to false for enabled.
             */
            disableTraceSampling?: pulumi.Input<boolean>;
            /**
             * Endpoints service name which is the name of the "service" resource in the Service Management API. For example "myapi.endpoints.myproject.cloud.goog"
             */
            name?: pulumi.Input<string>;
            /**
             * Endpoints rollout strategy. If FIXED, config_id must be specified. If MANAGED, config_id must be omitted.
             */
            rolloutStrategy?: pulumi.Input<string>;
        }
        /**
         * The entrypoint for the application.
         */
        interface Entrypoint {
            /**
             * The format should be a shell command that can be fed to bash -c.
             */
            shell?: pulumi.Input<string>;
        }
        /**
         * Custom static error page to be served when an error occurs.
         */
        interface ErrorHandler {
            /**
             * Error condition this handler applies to.
             */
            errorCode?: pulumi.Input<string>;
            /**
             * MIME type of file. Defaults to text/html.
             */
            mimeType?: pulumi.Input<string>;
            /**
             * Static file content to be served for this error.
             */
            staticFile?: pulumi.Input<string>;
        }
        /**
         * The feature specific settings to be used in the application. These define behaviors that are user configurable.
         */
        interface FeatureSettings {
            /**
             * Boolean value indicating if split health checks should be used instead of the legacy health checks. At an app.yaml level, this means defaulting to 'readiness_check' and 'liveness_check' values instead of 'health_check' ones. Once the legacy 'health_check' behavior is deprecated, and this value is always true, this setting can be removed.
             */
            splitHealthChecks?: pulumi.Input<boolean>;
            /**
             * If true, use Container-Optimized OS (https://cloud.google.com/container-optimized-os/) base image for VMs, rather than a base Debian image.
             */
            useContainerOptimizedOs?: pulumi.Input<boolean>;
        }
        /**
         * Health checking configuration for VM instances. Unhealthy instances are killed and replaced with new instances. Only applicable for instances in App Engine flexible environment.
         */
        interface HealthCheck {
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Whether to explicitly disable health checks for this instance.
             */
            disableHealthCheck?: pulumi.Input<boolean>;
            /**
             * Number of consecutive successful health checks required before receiving traffic.
             */
            healthyThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing an HTTP health check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * Number of consecutive failed health checks required before an instance is restarted.
             */
            restartThreshold?: pulumi.Input<number>;
            /**
             * Time before the health check is considered failed.
             */
            timeout?: pulumi.Input<string>;
            /**
             * Number of consecutive failed health checks required before removing traffic.
             */
            unhealthyThreshold?: pulumi.Input<number>;
        }
        /**
         * Identity-Aware Proxy
         */
        interface IdentityAwareProxy {
            /**
             * Whether the serving infrastructure will authenticate and authorize all incoming requests.If true, the oauth2_client_id and oauth2_client_secret fields must be non-empty.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * OAuth2 client ID to use for the authentication flow.
             */
            oauth2ClientId?: pulumi.Input<string>;
            /**
             * OAuth2 client secret to use for the authentication flow.For security reasons, this value cannot be retrieved via the API. Instead, the SHA-256 hash of the value is returned in the oauth2_client_secret_sha256 field.@InputOnly
             */
            oauth2ClientSecret?: pulumi.Input<string>;
            /**
             * Hex-encoded SHA-256 hash of the client secret.@OutputOnly
             */
            oauth2ClientSecretSha256?: pulumi.Input<string>;
        }
        /**
         * Third-party Python runtime library that is required by the application.
         */
        interface Library {
            /**
             * Name of the library. Example: "django".
             */
            name?: pulumi.Input<string>;
            /**
             * Version of the library to select, or "latest".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Health checking configuration for VM instances. Unhealthy instances are killed and replaced with new instances.
         */
        interface LivenessCheck {
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Number of consecutive failed checks required before considering the VM unhealthy.
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing a HTTP Liveness check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * The initial delay before starting to execute the checks.
             */
            initialDelay?: pulumi.Input<string>;
            /**
             * The request path.
             */
            path?: pulumi.Input<string>;
            /**
             * Number of consecutive successful checks required before considering the VM healthy.
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * Time before the check is considered failed.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * A certificate managed by App Engine.
         */
        interface ManagedCertificate {
            /**
             * Time at which the certificate was last renewed. The renewal process is fully managed. Certificate renewal will automatically occur before the certificate expires. Renewal errors can be tracked via ManagementStatus.@OutputOnly
             */
            lastRenewalTime?: pulumi.Input<string>;
            /**
             * Status of certificate management. Refers to the most recent certificate acquisition or renewal attempt.@OutputOnly
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time.
         */
        interface ManualScaling {
            /**
             * Number of instances to assign to the service at the start. This number can later be altered by using the Modules API (https://cloud.google.com/appengine/docs/python/modules/functions) set_num_instances() function.
             */
            instances?: pulumi.Input<number>;
        }
        /**
         * Extra network settings. Only applicable in the App Engine flexible environment.
         */
        interface Network {
            /**
             * List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
             */
            forwardedPorts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
             */
            instanceTag?: pulumi.Input<string>;
            /**
             * Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
             */
            name?: pulumi.Input<string>;
            /**
             * Enable session affinity. Only applicable in the App Engine flexible environment.
             */
            sessionAffinity?: pulumi.Input<boolean>;
            /**
             * Google Cloud Platform sub-network where the virtual machines are created. Specify the short name, not the resource path.If a subnetwork name is specified, a network name will also be required unless it is for the default network. If the network that the instance is being created in is a Legacy network, then the IP address is allocated from the IPv4Range. If the network that the instance is being created in is an auto Subnet Mode Network, then only network name should be specified (not the subnetwork_name) and the IP address is created from the IPCidrRange of the subnetwork that exists in that zone for that network. If the network that the instance is being created in is a custom Subnet Mode Network, then the subnetwork_name must be specified and the IP address is created from the IPCidrRange of the subnetwork.If specified, the subnetwork must exist in the same region as the App Engine flexible environment application.
             */
            subnetworkName?: pulumi.Input<string>;
        }
        /**
         * Target scaling by network usage. Only applicable in the App Engine flexible environment.
         */
        interface NetworkUtilization {
            /**
             * Target bytes received per second.
             */
            targetReceivedBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target packets received per second.
             */
            targetReceivedPacketsPerSecond?: pulumi.Input<number>;
            /**
             * Target bytes sent per second.
             */
            targetSentBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target packets sent per second.
             */
            targetSentPacketsPerSecond?: pulumi.Input<number>;
        }
        /**
         * Readiness checking configuration for VM instances. Unhealthy instances are removed from traffic rotation.
         */
        interface ReadinessCheck {
            /**
             * A maximum time limit on application initialization, measured from moment the application successfully replies to a healthcheck until it is ready to serve traffic.
             */
            appStartTimeout?: pulumi.Input<string>;
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Number of consecutive failed checks required before removing traffic.
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing a HTTP Readiness check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * The request path.
             */
            path?: pulumi.Input<string>;
            /**
             * Number of consecutive successful checks required before receiving traffic.
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * Time before the check is considered failed.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * Target scaling by request utilization. Only applicable in the App Engine flexible environment.
         */
        interface RequestUtilization {
            /**
             * Target number of concurrent requests.
             */
            targetConcurrentRequests?: pulumi.Input<number>;
            /**
             * Target requests per second.
             */
            targetRequestCountPerSecond?: pulumi.Input<number>;
        }
        /**
         * A DNS resource record.
         */
        interface ResourceRecord {
            /**
             * Relative name of the object affected by this record. Only applicable for CNAME records. Example: 'www'.
             */
            name?: pulumi.Input<string>;
            /**
             * Data for this record. Values vary by record type, as defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1).
             */
            rrdata?: pulumi.Input<string>;
            /**
             * Resource record type. Example: AAAA.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Machine resources for a version.
         */
        interface Resources {
            /**
             * Number of CPU cores needed.
             */
            cpu?: pulumi.Input<number>;
            /**
             * Disk size (GB) needed.
             */
            diskGb?: pulumi.Input<number>;
            /**
             * The name of the encryption key that is stored in Google Cloud KMS. Only should be used by Cloud Composer to encrypt the vm disk
             */
            kmsKeyReference?: pulumi.Input<string>;
            /**
             * Memory (GB) needed.
             */
            memoryGb?: pulumi.Input<number>;
            /**
             * User specified volumes.
             */
            volumes?: pulumi.Input<pulumi.Input<inputs.appengine.v1.Volume>[]>;
        }
        /**
         * Executes a script to handle the request that matches the URL pattern.
         */
        interface ScriptHandler {
            /**
             * Path to the script from the application root directory.
             */
            scriptPath?: pulumi.Input<string>;
        }
        /**
         * SSL configuration for a DomainMapping resource.
         */
        interface SslSettings {
            /**
             * ID of the AuthorizedCertificate resource configuring SSL for the application. Clearing this field will remove SSL support.By default, a managed certificate is automatically created for every domain mapping. To omit SSL support or to configure SSL manually, specify SslManagementType.MANUAL on a CREATE or UPDATE request. You must be authorized to administer the AuthorizedCertificate resource to manually map it to a DomainMapping resource. Example: 12345.
             */
            certificateId?: pulumi.Input<string>;
            /**
             * ID of the managed AuthorizedCertificate resource currently being provisioned, if applicable. Until the new managed certificate has been successfully provisioned, the previous SSL state will be preserved. Once the provisioning process completes, the certificate_id field will reflect the new managed certificate and this field will be left empty. To remove SSL support while there is still a pending managed certificate, clear the certificate_id field with an UpdateDomainMappingRequest.@OutputOnly
             */
            pendingManagedCertificateId?: pulumi.Input<string>;
            /**
             * SSL management type for this domain. If AUTOMATIC, a managed certificate is automatically provisioned. If MANUAL, certificate_id must be manually specified in order to configure SSL for this domain.
             */
            sslManagementType?: pulumi.Input<string>;
        }
        /**
         * Scheduler settings for standard environment.
         */
        interface StandardSchedulerSettings {
            /**
             * Maximum number of instances to run for this version. Set to zero to disable max_instances configuration.
             */
            maxInstances?: pulumi.Input<number>;
            /**
             * Minimum number of instances to run for this version. Set to zero to disable min_instances configuration.
             */
            minInstances?: pulumi.Input<number>;
            /**
             * Target CPU utilization ratio to maintain when scaling.
             */
            targetCpuUtilization?: pulumi.Input<number>;
            /**
             * Target throughput utilization ratio to maintain when scaling
             */
            targetThroughputUtilization?: pulumi.Input<number>;
        }
        /**
         * Files served directly to the user for a given URL, such as images, CSS stylesheets, or JavaScript source files. Static file handlers describe which files in the application directory are static files, and which URLs serve them.
         */
        interface StaticFilesHandler {
            /**
             * Whether files should also be uploaded as code data. By default, files declared in static file handlers are uploaded as static data and are only served to end users; they cannot be read by the application. If enabled, uploads are charged against both your code and static data storage resource quotas.
             */
            applicationReadable?: pulumi.Input<boolean>;
            /**
             * Time a static file served by this handler should be cached by web proxies and browsers.
             */
            expiration?: pulumi.Input<string>;
            /**
             * HTTP headers to use for all responses from these URLs.
             */
            httpHeaders?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * MIME type used to serve all files served by this handler.Defaults to file-specific MIME types, which are derived from each file's filename extension.
             */
            mimeType?: pulumi.Input<string>;
            /**
             * Path to the static files matched by the URL pattern, from the application root directory. The path can refer to text matched in groupings in the URL pattern.
             */
            path?: pulumi.Input<string>;
            /**
             * Whether this handler should match the request if the file referenced by the handler does not exist.
             */
            requireMatchingFile?: pulumi.Input<boolean>;
            /**
             * Regular expression that matches the file paths for all files that should be referenced by this handler.
             */
            uploadPathRegex?: pulumi.Input<string>;
        }
        /**
         * Rules to match an HTTP request and dispatch that request to a service.
         */
        interface UrlDispatchRule {
            /**
             * Domain name to match against. The wildcard "*" is supported if specified before a period: "*.".Defaults to matching all domains: "*".
             */
            domain?: pulumi.Input<string>;
            /**
             * Pathname within the host. Must start with a "/". A single "*" can be included at the end of the path.The sum of the lengths of the domain and path may not exceed 100 characters.
             */
            path?: pulumi.Input<string>;
            /**
             * Resource ID of a service in this application that should serve the matched request. The service must already exist. Example: default.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * URL pattern and description of how the URL should be handled. App Engine can handle URLs by executing application code or by serving static files uploaded with the version, such as images, CSS, or JavaScript.
         */
        interface UrlMap {
            /**
             * Uses API Endpoints to handle requests.
             */
            apiEndpoint?: pulumi.Input<inputs.appengine.v1.ApiEndpointHandler>;
            /**
             * Action to take when users access resources that require authentication. Defaults to redirect.
             */
            authFailAction?: pulumi.Input<string>;
            /**
             * Level of login required to access this resource. Not supported for Node.js in the App Engine standard environment.
             */
            login?: pulumi.Input<string>;
            /**
             * 30x code to use when performing redirects for the secure field. Defaults to 302.
             */
            redirectHttpResponseCode?: pulumi.Input<string>;
            /**
             * Executes a script to handle the requests that match this URL pattern. Only the auto value is supported for Node.js in the App Engine standard environment, for example "script": "auto".
             */
            script?: pulumi.Input<inputs.appengine.v1.ScriptHandler>;
            /**
             * Security (HTTPS) enforcement for this URL.
             */
            securityLevel?: pulumi.Input<string>;
            /**
             * Returns the contents of a file, such as an image, as the response.
             */
            staticFiles?: pulumi.Input<inputs.appengine.v1.StaticFilesHandler>;
            /**
             * URL prefix. Uses regular expression syntax, which means regexp special characters must be escaped, but should not contain groupings. All URLs that begin with this prefix are handled by this handler, using the portion of the URL after the prefix as part of the file path.
             */
            urlRegex?: pulumi.Input<string>;
        }
        /**
         * Volumes mounted within the app container. Only applicable in the App Engine flexible environment.
         */
        interface Volume {
            /**
             * Unique name for the volume.
             */
            name?: pulumi.Input<string>;
            /**
             * Volume size in gigabytes.
             */
            sizeGb?: pulumi.Input<number>;
            /**
             * Underlying volume type, e.g. 'tmpfs'.
             */
            volumeType?: pulumi.Input<string>;
        }
        /**
         * VPC access connector specification.
         */
        interface VpcAccessConnector {
            /**
             * Full Serverless VPC Access Connector name e.g. /projects/my-project/locations/us-central1/connectors/c1.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The zip file information for a zip deployment.
         */
        interface ZipInfo {
            /**
             * An estimate of the number of files in a zip for a zip deployment. If set, must be greater than or equal to the actual number of files. Used for optimizing performance; if not provided, deployment may be slow.
             */
            filesCount?: pulumi.Input<number>;
            /**
             * URL of the zip file to deploy from. Must be a URL to a resource in Google Cloud Storage in the form 'http(s)://storage.googleapis.com//'.
             */
            sourceUrl?: pulumi.Input<string>;
        }
    }
    namespace v1alpha {
        /**
         * An SSL certificate obtained from a certificate authority.
         */
        interface CertificateRawData {
            /**
             * Unencrypted PEM encoded RSA private key. This field is set once on certificate creation and then encrypted. The key size must be 2048 bits or fewer. Must include the header and footer. Example: -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- @InputOnly
             */
            privateKey?: pulumi.Input<string>;
            /**
             * PEM encoded x.509 public key certificate. This field is set once on certificate creation. Must include the header and footer. Example: -----BEGIN CERTIFICATE----- -----END CERTIFICATE-----
             */
            publicCertificate?: pulumi.Input<string>;
        }
        /**
         * A certificate managed by App Engine.
         */
        interface ManagedCertificate {
            /**
             * Time at which the certificate was last renewed. The renewal process is fully managed. Certificate renewal will automatically occur before the certificate expires. Renewal errors can be tracked via ManagementStatus.@OutputOnly
             */
            lastRenewalTime?: pulumi.Input<string>;
            /**
             * Status of certificate management. Refers to the most recent certificate acquisition or renewal attempt.@OutputOnly
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A DNS resource record.
         */
        interface ResourceRecord {
            /**
             * Relative name of the object affected by this record. Only applicable for CNAME records. Example: 'www'.
             */
            name?: pulumi.Input<string>;
            /**
             * Data for this record. Values vary by record type, as defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1).
             */
            rrdata?: pulumi.Input<string>;
            /**
             * Resource record type. Example: AAAA.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * SSL configuration for a DomainMapping resource.
         */
        interface SslSettings {
            /**
             * ID of the AuthorizedCertificate resource configuring SSL for the application. Clearing this field will remove SSL support.By default, a managed certificate is automatically created for every domain mapping. To omit SSL support or to configure SSL manually, specify no_managed_certificate on a CREATE or UPDATE request. You must be authorized to administer the AuthorizedCertificate resource to manually map it to a DomainMapping resource. Example: 12345.
             */
            certificateId?: pulumi.Input<string>;
            /**
             * Whether the mapped certificate is an App Engine managed certificate. Managed certificates are created by default with a domain mapping. To opt out, specify no_managed_certificate on a CREATE or UPDATE request.@OutputOnly
             */
            isManagedCertificate?: pulumi.Input<boolean>;
        }
    }
    namespace v1beta {
        /**
         * Google Cloud Endpoints (https://cloud.google.com/appengine/docs/python/endpoints/) configuration for API handlers.
         */
        interface ApiConfigHandler {
            /**
             * Action to take when users access resources that require authentication. Defaults to redirect.
             */
            authFailAction?: pulumi.Input<string>;
            /**
             * Level of login required to access this resource. Defaults to optional.
             */
            login?: pulumi.Input<string>;
            /**
             * Path to the script from the application root directory.
             */
            script?: pulumi.Input<string>;
            /**
             * Security (HTTPS) enforcement for this URL.
             */
            securityLevel?: pulumi.Input<string>;
            /**
             * URL to serve the endpoint at.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Uses Google Cloud Endpoints to handle requests.
         */
        interface ApiEndpointHandler {
            /**
             * Path to the script from the application root directory.
             */
            scriptPath?: pulumi.Input<string>;
        }
        /**
         * Automatic scaling is based on request rate, response latencies, and other application metrics.
         */
        interface AutomaticScaling {
            /**
             * The time period that the Autoscaler (https://cloud.google.com/compute/docs/autoscaler/) should wait before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. Only applicable in the App Engine flexible environment.
             */
            coolDownPeriod?: pulumi.Input<string>;
            /**
             * Target scaling by CPU usage.
             */
            cpuUtilization?: pulumi.Input<inputs.appengine.v1beta.CpuUtilization>;
            /**
             * Target scaling by user-provided metrics. Only applicable in the App Engine flexible environment.
             */
            customMetrics?: pulumi.Input<pulumi.Input<inputs.appengine.v1beta.CustomMetric>[]>;
            /**
             * Target scaling by disk usage.
             */
            diskUtilization?: pulumi.Input<inputs.appengine.v1beta.DiskUtilization>;
            /**
             * Number of concurrent requests an automatic scaling instance can accept before the scheduler spawns a new instance.Defaults to a runtime-specific value.
             */
            maxConcurrentRequests?: pulumi.Input<number>;
            /**
             * Maximum number of idle instances that should be maintained for this version.
             */
            maxIdleInstances?: pulumi.Input<number>;
            /**
             * Maximum amount of time that a request should wait in the pending queue before starting a new instance to handle it.
             */
            maxPendingLatency?: pulumi.Input<string>;
            /**
             * Maximum number of instances that should be started to handle requests for this version.
             */
            maxTotalInstances?: pulumi.Input<number>;
            /**
             * Minimum number of idle instances that should be maintained for this version. Only applicable for the default version of a service.
             */
            minIdleInstances?: pulumi.Input<number>;
            /**
             * Minimum amount of time a request should wait in the pending queue before starting a new instance to handle it.
             */
            minPendingLatency?: pulumi.Input<string>;
            /**
             * Minimum number of running instances that should be maintained for this version.
             */
            minTotalInstances?: pulumi.Input<number>;
            /**
             * Target scaling by network usage.
             */
            networkUtilization?: pulumi.Input<inputs.appengine.v1beta.NetworkUtilization>;
            /**
             * Target scaling by request utilization.
             */
            requestUtilization?: pulumi.Input<inputs.appengine.v1beta.RequestUtilization>;
            /**
             * Scheduler settings for standard environment.
             */
            standardSchedulerSettings?: pulumi.Input<inputs.appengine.v1beta.StandardSchedulerSettings>;
        }
        /**
         * A service with basic scaling will create an instance when the application receives a request. The instance will be turned down when the app becomes idle. Basic scaling is ideal for work that is intermittent or driven by user activity.
         */
        interface BasicScaling {
            /**
             * Duration of time after the last request that an instance must wait before the instance is shut down.
             */
            idleTimeout?: pulumi.Input<string>;
            /**
             * Maximum number of instances to create for this version.
             */
            maxInstances?: pulumi.Input<number>;
        }
        /**
         * Google Cloud Build information.
         */
        interface BuildInfo {
            /**
             * The Google Cloud Build id. Example: "f966068f-08b2-42c8-bdfe-74137dff2bf9"
             */
            cloudBuildId?: pulumi.Input<string>;
        }
        /**
         * An SSL certificate obtained from a certificate authority.
         */
        interface CertificateRawData {
            /**
             * Unencrypted PEM encoded RSA private key. This field is set once on certificate creation and then encrypted. The key size must be 2048 bits or fewer. Must include the header and footer. Example: -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- @InputOnly
             */
            privateKey?: pulumi.Input<string>;
            /**
             * PEM encoded x.509 public key certificate. This field is set once on certificate creation. Must include the header and footer. Example: -----BEGIN CERTIFICATE----- -----END CERTIFICATE-----
             */
            publicCertificate?: pulumi.Input<string>;
        }
        /**
         * Options for the build operations performed as a part of the version deployment. Only applicable for App Engine flexible environment when creating a version using source code directly.
         */
        interface CloudBuildOptions {
            /**
             * Path to the yaml file used in deployment, used to determine runtime configuration details.Required for flexible environment builds.See https://cloud.google.com/appengine/docs/standard/python/config/appref for more details.
             */
            appYamlPath?: pulumi.Input<string>;
            /**
             * The Cloud Build timeout used as part of any dependent builds performed by version creation. Defaults to 10 minutes.
             */
            cloudBuildTimeout?: pulumi.Input<string>;
        }
        /**
         * Docker image that is used to create a container and start a VM instance for the version that you deploy. Only applicable for instances running in the App Engine flexible environment.
         */
        interface ContainerInfo {
            /**
             * URI to the hosted container image in Google Container Registry. The URI must be fully qualified and include a tag or digest. Examples: "gcr.io/my-project/image:tag" or "gcr.io/my-project/image@digest"
             */
            image?: pulumi.Input<string>;
        }
        /**
         * Target scaling by CPU usage.
         */
        interface CpuUtilization {
            /**
             * Period of time over which CPU utilization is calculated.
             */
            aggregationWindowLength?: pulumi.Input<string>;
            /**
             * Target CPU utilization ratio to maintain when scaling. Must be between 0 and 1.
             */
            targetUtilization?: pulumi.Input<number>;
        }
        /**
         * Allows autoscaling based on Stackdriver metrics.
         */
        interface CustomMetric {
            /**
             * Allows filtering on the metric's fields.
             */
            filter?: pulumi.Input<string>;
            /**
             * The name of the metric.
             */
            metricName?: pulumi.Input<string>;
            /**
             * May be used instead of target_utilization when an instance can handle a specific amount of work/resources and the metric value is equal to the current amount of work remaining. The autoscaler will try to keep the number of instances equal to the metric value divided by single_instance_assignment.
             */
            singleInstanceAssignment?: pulumi.Input<number>;
            /**
             * The type of the metric. Must be a string representing a Stackdriver metric type e.g. GAGUE, DELTA_PER_SECOND, etc.
             */
            targetType?: pulumi.Input<string>;
            /**
             * The target value for the metric.
             */
            targetUtilization?: pulumi.Input<number>;
        }
        /**
         * Code and application artifacts used to deploy a version to App Engine.
         */
        interface Deployment {
            /**
             * Google Cloud Build build information. Only applicable for instances running in the App Engine flexible environment.
             */
            build?: pulumi.Input<inputs.appengine.v1beta.BuildInfo>;
            /**
             * Options for any Google Cloud Build builds created as a part of this deployment.These options will only be used if a new build is created, such as when deploying to the App Engine flexible environment using files or zip.
             */
            cloudBuildOptions?: pulumi.Input<inputs.appengine.v1beta.CloudBuildOptions>;
            /**
             * The Docker image for the container that runs the version. Only applicable for instances running in the App Engine flexible environment.
             */
            container?: pulumi.Input<inputs.appengine.v1beta.ContainerInfo>;
            /**
             * Manifest of the files stored in Google Cloud Storage that are included as part of this version. All files must be readable using the credentials supplied with this call.
             */
            files?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The zip file for this deployment, if this is a zip deployment.
             */
            zip?: pulumi.Input<inputs.appengine.v1beta.ZipInfo>;
        }
        /**
         * Target scaling by disk usage. Only applicable in the App Engine flexible environment.
         */
        interface DiskUtilization {
            /**
             * Target bytes read per second.
             */
            targetReadBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target ops read per seconds.
             */
            targetReadOpsPerSecond?: pulumi.Input<number>;
            /**
             * Target bytes written per second.
             */
            targetWriteBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target ops written per second.
             */
            targetWriteOpsPerSecond?: pulumi.Input<number>;
        }
        /**
         * Cloud Endpoints (https://cloud.google.com/endpoints) configuration. The Endpoints API Service provides tooling for serving Open API and gRPC endpoints via an NGINX proxy. Only valid for App Engine Flexible environment deployments.The fields here refer to the name and configuration ID of a "service" resource in the Service Management API (https://cloud.google.com/service-management/overview).
         */
        interface EndpointsApiService {
            /**
             * Endpoints service configuration ID as specified by the Service Management API. For example "2016-09-19r1".By default, the rollout strategy for Endpoints is RolloutStrategy.FIXED. This means that Endpoints starts up with a particular configuration ID. When a new configuration is rolled out, Endpoints must be given the new configuration ID. The config_id field is used to give the configuration ID and is required in this case.Endpoints also has a rollout strategy called RolloutStrategy.MANAGED. When using this, Endpoints fetches the latest configuration and does not need the configuration ID. In this case, config_id must be omitted.
             */
            configId?: pulumi.Input<string>;
            /**
             * Enable or disable trace sampling. By default, this is set to false for enabled.
             */
            disableTraceSampling?: pulumi.Input<boolean>;
            /**
             * Endpoints service name which is the name of the "service" resource in the Service Management API. For example "myapi.endpoints.myproject.cloud.goog"
             */
            name?: pulumi.Input<string>;
            /**
             * Endpoints rollout strategy. If FIXED, config_id must be specified. If MANAGED, config_id must be omitted.
             */
            rolloutStrategy?: pulumi.Input<string>;
        }
        /**
         * The entrypoint for the application.
         */
        interface Entrypoint {
            /**
             * The format should be a shell command that can be fed to bash -c.
             */
            shell?: pulumi.Input<string>;
        }
        /**
         * Custom static error page to be served when an error occurs.
         */
        interface ErrorHandler {
            /**
             * Error condition this handler applies to.
             */
            errorCode?: pulumi.Input<string>;
            /**
             * MIME type of file. Defaults to text/html.
             */
            mimeType?: pulumi.Input<string>;
            /**
             * Static file content to be served for this error.
             */
            staticFile?: pulumi.Input<string>;
        }
        /**
         * The feature specific settings to be used in the application. These define behaviors that are user configurable.
         */
        interface FeatureSettings {
            /**
             * Boolean value indicating if split health checks should be used instead of the legacy health checks. At an app.yaml level, this means defaulting to 'readiness_check' and 'liveness_check' values instead of 'health_check' ones. Once the legacy 'health_check' behavior is deprecated, and this value is always true, this setting can be removed.
             */
            splitHealthChecks?: pulumi.Input<boolean>;
            /**
             * If true, use Container-Optimized OS (https://cloud.google.com/container-optimized-os/) base image for VMs, rather than a base Debian image.
             */
            useContainerOptimizedOs?: pulumi.Input<boolean>;
        }
        /**
         * Health checking configuration for VM instances. Unhealthy instances are killed and replaced with new instances. Only applicable for instances in App Engine flexible environment.
         */
        interface HealthCheck {
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Whether to explicitly disable health checks for this instance.
             */
            disableHealthCheck?: pulumi.Input<boolean>;
            /**
             * Number of consecutive successful health checks required before receiving traffic.
             */
            healthyThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing an HTTP health check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * Number of consecutive failed health checks required before an instance is restarted.
             */
            restartThreshold?: pulumi.Input<number>;
            /**
             * Time before the health check is considered failed.
             */
            timeout?: pulumi.Input<string>;
            /**
             * Number of consecutive failed health checks required before removing traffic.
             */
            unhealthyThreshold?: pulumi.Input<number>;
        }
        /**
         * Identity-Aware Proxy
         */
        interface IdentityAwareProxy {
            /**
             * Whether the serving infrastructure will authenticate and authorize all incoming requests.If true, the oauth2_client_id and oauth2_client_secret fields must be non-empty.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * OAuth2 client ID to use for the authentication flow.
             */
            oauth2ClientId?: pulumi.Input<string>;
            /**
             * OAuth2 client secret to use for the authentication flow.For security reasons, this value cannot be retrieved via the API. Instead, the SHA-256 hash of the value is returned in the oauth2_client_secret_sha256 field.@InputOnly
             */
            oauth2ClientSecret?: pulumi.Input<string>;
            /**
             * Hex-encoded SHA-256 hash of the client secret.@OutputOnly
             */
            oauth2ClientSecretSha256?: pulumi.Input<string>;
        }
        /**
         * Third-party Python runtime library that is required by the application.
         */
        interface Library {
            /**
             * Name of the library. Example: "django".
             */
            name?: pulumi.Input<string>;
            /**
             * Version of the library to select, or "latest".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Health checking configuration for VM instances. Unhealthy instances are killed and replaced with new instances.
         */
        interface LivenessCheck {
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Number of consecutive failed checks required before considering the VM unhealthy.
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing a HTTP Liveness check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * The initial delay before starting to execute the checks.
             */
            initialDelay?: pulumi.Input<string>;
            /**
             * The request path.
             */
            path?: pulumi.Input<string>;
            /**
             * Number of consecutive successful checks required before considering the VM healthy.
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * Time before the check is considered failed.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * A certificate managed by App Engine.
         */
        interface ManagedCertificate {
            /**
             * Time at which the certificate was last renewed. The renewal process is fully managed. Certificate renewal will automatically occur before the certificate expires. Renewal errors can be tracked via ManagementStatus.@OutputOnly
             */
            lastRenewalTime?: pulumi.Input<string>;
            /**
             * Status of certificate management. Refers to the most recent certificate acquisition or renewal attempt.@OutputOnly
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time.
         */
        interface ManualScaling {
            /**
             * Number of instances to assign to the service at the start. This number can later be altered by using the Modules API (https://cloud.google.com/appengine/docs/python/modules/functions) set_num_instances() function.
             */
            instances?: pulumi.Input<number>;
        }
        /**
         * Extra network settings. Only applicable in the App Engine flexible environment.
         */
        interface Network {
            /**
             * List of ports, or port pairs, to forward from the virtual machine to the application container. Only applicable in the App Engine flexible environment.
             */
            forwardedPorts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Tag to apply to the instance during creation. Only applicable in the App Engine flexible environment.
             */
            instanceTag?: pulumi.Input<string>;
            /**
             * Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.Defaults to default.
             */
            name?: pulumi.Input<string>;
            /**
             * Enable session affinity. Only applicable in the App Engine flexible environment.
             */
            sessionAffinity?: pulumi.Input<boolean>;
            /**
             * Google Cloud Platform sub-network where the virtual machines are created. Specify the short name, not the resource path.If a subnetwork name is specified, a network name will also be required unless it is for the default network. If the network that the instance is being created in is a Legacy network, then the IP address is allocated from the IPv4Range. If the network that the instance is being created in is an auto Subnet Mode Network, then only network name should be specified (not the subnetwork_name) and the IP address is created from the IPCidrRange of the subnetwork that exists in that zone for that network. If the network that the instance is being created in is a custom Subnet Mode Network, then the subnetwork_name must be specified and the IP address is created from the IPCidrRange of the subnetwork.If specified, the subnetwork must exist in the same region as the App Engine flexible environment application.
             */
            subnetworkName?: pulumi.Input<string>;
        }
        /**
         * Target scaling by network usage. Only applicable in the App Engine flexible environment.
         */
        interface NetworkUtilization {
            /**
             * Target bytes received per second.
             */
            targetReceivedBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target packets received per second.
             */
            targetReceivedPacketsPerSecond?: pulumi.Input<number>;
            /**
             * Target bytes sent per second.
             */
            targetSentBytesPerSecond?: pulumi.Input<number>;
            /**
             * Target packets sent per second.
             */
            targetSentPacketsPerSecond?: pulumi.Input<number>;
        }
        /**
         * Readiness checking configuration for VM instances. Unhealthy instances are removed from traffic rotation.
         */
        interface ReadinessCheck {
            /**
             * A maximum time limit on application initialization, measured from moment the application successfully replies to a healthcheck until it is ready to serve traffic.
             */
            appStartTimeout?: pulumi.Input<string>;
            /**
             * Interval between health checks.
             */
            checkInterval?: pulumi.Input<string>;
            /**
             * Number of consecutive failed checks required before removing traffic.
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * Host header to send when performing a HTTP Readiness check. Example: "myapp.appspot.com"
             */
            host?: pulumi.Input<string>;
            /**
             * The request path.
             */
            path?: pulumi.Input<string>;
            /**
             * Number of consecutive successful checks required before receiving traffic.
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * Time before the check is considered failed.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * Target scaling by request utilization. Only applicable in the App Engine flexible environment.
         */
        interface RequestUtilization {
            /**
             * Target number of concurrent requests.
             */
            targetConcurrentRequests?: pulumi.Input<number>;
            /**
             * Target requests per second.
             */
            targetRequestCountPerSecond?: pulumi.Input<number>;
        }
        /**
         * A DNS resource record.
         */
        interface ResourceRecord {
            /**
             * Relative name of the object affected by this record. Only applicable for CNAME records. Example: 'www'.
             */
            name?: pulumi.Input<string>;
            /**
             * Data for this record. Values vary by record type, as defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1).
             */
            rrdata?: pulumi.Input<string>;
            /**
             * Resource record type. Example: AAAA.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Machine resources for a version.
         */
        interface Resources {
            /**
             * Number of CPU cores needed.
             */
            cpu?: pulumi.Input<number>;
            /**
             * Disk size (GB) needed.
             */
            diskGb?: pulumi.Input<number>;
            /**
             * The name of the encryption key that is stored in Google Cloud KMS. Only should be used by Cloud Composer to encrypt the vm disk
             */
            kmsKeyReference?: pulumi.Input<string>;
            /**
             * Memory (GB) needed.
             */
            memoryGb?: pulumi.Input<number>;
            /**
             * User specified volumes.
             */
            volumes?: pulumi.Input<pulumi.Input<inputs.appengine.v1beta.Volume>[]>;
        }
        /**
         * Executes a script to handle the request that matches the URL pattern.
         */
        interface ScriptHandler {
            /**
             * Path to the script from the application root directory.
             */
            scriptPath?: pulumi.Input<string>;
        }
        /**
         * SSL configuration for a DomainMapping resource.
         */
        interface SslSettings {
            /**
             * ID of the AuthorizedCertificate resource configuring SSL for the application. Clearing this field will remove SSL support.By default, a managed certificate is automatically created for every domain mapping. To omit SSL support or to configure SSL manually, specify SslManagementType.MANUAL on a CREATE or UPDATE request. You must be authorized to administer the AuthorizedCertificate resource to manually map it to a DomainMapping resource. Example: 12345.
             */
            certificateId?: pulumi.Input<string>;
            /**
             * ID of the managed AuthorizedCertificate resource currently being provisioned, if applicable. Until the new managed certificate has been successfully provisioned, the previous SSL state will be preserved. Once the provisioning process completes, the certificate_id field will reflect the new managed certificate and this field will be left empty. To remove SSL support while there is still a pending managed certificate, clear the certificate_id field with an UpdateDomainMappingRequest.@OutputOnly
             */
            pendingManagedCertificateId?: pulumi.Input<string>;
            /**
             * SSL management type for this domain. If AUTOMATIC, a managed certificate is automatically provisioned. If MANUAL, certificate_id must be manually specified in order to configure SSL for this domain.
             */
            sslManagementType?: pulumi.Input<string>;
        }
        /**
         * Scheduler settings for standard environment.
         */
        interface StandardSchedulerSettings {
            /**
             * Maximum number of instances to run for this version. Set to zero to disable max_instances configuration.
             */
            maxInstances?: pulumi.Input<number>;
            /**
             * Minimum number of instances to run for this version. Set to zero to disable min_instances configuration.
             */
            minInstances?: pulumi.Input<number>;
            /**
             * Target CPU utilization ratio to maintain when scaling.
             */
            targetCpuUtilization?: pulumi.Input<number>;
            /**
             * Target throughput utilization ratio to maintain when scaling
             */
            targetThroughputUtilization?: pulumi.Input<number>;
        }
        /**
         * Files served directly to the user for a given URL, such as images, CSS stylesheets, or JavaScript source files. Static file handlers describe which files in the application directory are static files, and which URLs serve them.
         */
        interface StaticFilesHandler {
            /**
             * Whether files should also be uploaded as code data. By default, files declared in static file handlers are uploaded as static data and are only served to end users; they cannot be read by the application. If enabled, uploads are charged against both your code and static data storage resource quotas.
             */
            applicationReadable?: pulumi.Input<boolean>;
            /**
             * Time a static file served by this handler should be cached by web proxies and browsers.
             */
            expiration?: pulumi.Input<string>;
            /**
             * HTTP headers to use for all responses from these URLs.
             */
            httpHeaders?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * MIME type used to serve all files served by this handler.Defaults to file-specific MIME types, which are derived from each file's filename extension.
             */
            mimeType?: pulumi.Input<string>;
            /**
             * Path to the static files matched by the URL pattern, from the application root directory. The path can refer to text matched in groupings in the URL pattern.
             */
            path?: pulumi.Input<string>;
            /**
             * Whether this handler should match the request if the file referenced by the handler does not exist.
             */
            requireMatchingFile?: pulumi.Input<boolean>;
            /**
             * Regular expression that matches the file paths for all files that should be referenced by this handler.
             */
            uploadPathRegex?: pulumi.Input<string>;
        }
        /**
         * Rules to match an HTTP request and dispatch that request to a service.
         */
        interface UrlDispatchRule {
            /**
             * Domain name to match against. The wildcard "*" is supported if specified before a period: "*.".Defaults to matching all domains: "*".
             */
            domain?: pulumi.Input<string>;
            /**
             * Pathname within the host. Must start with a "/". A single "*" can be included at the end of the path.The sum of the lengths of the domain and path may not exceed 100 characters.
             */
            path?: pulumi.Input<string>;
            /**
             * Resource ID of a service in this application that should serve the matched request. The service must already exist. Example: default.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * URL pattern and description of how the URL should be handled. App Engine can handle URLs by executing application code or by serving static files uploaded with the version, such as images, CSS, or JavaScript.
         */
        interface UrlMap {
            /**
             * Uses API Endpoints to handle requests.
             */
            apiEndpoint?: pulumi.Input<inputs.appengine.v1beta.ApiEndpointHandler>;
            /**
             * Action to take when users access resources that require authentication. Defaults to redirect.
             */
            authFailAction?: pulumi.Input<string>;
            /**
             * Level of login required to access this resource. Not supported for Node.js in the App Engine standard environment.
             */
            login?: pulumi.Input<string>;
            /**
             * 30x code to use when performing redirects for the secure field. Defaults to 302.
             */
            redirectHttpResponseCode?: pulumi.Input<string>;
            /**
             * Executes a script to handle the requests that match this URL pattern. Only the auto value is supported for Node.js in the App Engine standard environment, for example "script": "auto".
             */
            script?: pulumi.Input<inputs.appengine.v1beta.ScriptHandler>;
            /**
             * Security (HTTPS) enforcement for this URL.
             */
            securityLevel?: pulumi.Input<string>;
            /**
             * Returns the contents of a file, such as an image, as the response.
             */
            staticFiles?: pulumi.Input<inputs.appengine.v1beta.StaticFilesHandler>;
            /**
             * URL prefix. Uses regular expression syntax, which means regexp special characters must be escaped, but should not contain groupings. All URLs that begin with this prefix are handled by this handler, using the portion of the URL after the prefix as part of the file path.
             */
            urlRegex?: pulumi.Input<string>;
        }
        /**
         * Volumes mounted within the app container. Only applicable in the App Engine flexible environment.
         */
        interface Volume {
            /**
             * Unique name for the volume.
             */
            name?: pulumi.Input<string>;
            /**
             * Volume size in gigabytes.
             */
            sizeGb?: pulumi.Input<number>;
            /**
             * Underlying volume type, e.g. 'tmpfs'.
             */
            volumeType?: pulumi.Input<string>;
        }
        /**
         * VPC access connector specification.
         */
        interface VpcAccessConnector {
            /**
             * Full Serverless VPC Access Connector name e.g. /projects/my-project/locations/us-central1/connectors/c1.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The zip file information for a zip deployment.
         */
        interface ZipInfo {
            /**
             * An estimate of the number of files in a zip for a zip deployment. If set, must be greater than or equal to the actual number of files. Used for optimizing performance; if not provided, deployment may be slow.
             */
            filesCount?: pulumi.Input<number>;
            /**
             * URL of the zip file to deploy from. Must be a URL to a resource in Google Cloud Storage in the form 'http(s)://storage.googleapis.com//'.
             */
            sourceUrl?: pulumi.Input<string>;
        }
    }
}
export declare namespace artifactregistry {
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.artifactregistry.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta2 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.artifactregistry.v1beta2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace assuredworkloads {
    namespace v1 {
        /**
         * Settings specific to the Key Management Service.
         */
        interface GoogleCloudAssuredworkloadsV1WorkloadKMSSettings {
            /**
             * Required. Input only. Immutable. The time at which the Key Management Service will automatically create a new version of the crypto key and mark it as the primary.
             */
            nextRotationTime?: pulumi.Input<string>;
            /**
             * Required. Input only. Immutable. [next_rotation_time] will be advanced by this period when the Key Management Service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours.
             */
            rotationPeriod?: pulumi.Input<string>;
        }
    }
}
export declare namespace bigquery {
    namespace v2 {
        /**
         * Input/output argument of a function or a stored procedure.
         */
        interface Argument {
            /**
             * Optional. Defaults to FIXED_TYPE.
             */
            argumentKind?: pulumi.Input<string>;
            /**
             * Required unless argument_kind = ANY_TYPE.
             */
            dataType?: pulumi.Input<inputs.bigquery.v2.StandardSqlDataType>;
            /**
             * Optional. Specifies whether the argument is input or output. Can be set for procedures only.
             */
            mode?: pulumi.Input<string>;
            /**
             * Optional. The name of this argument. Can be absent for function return argument.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        interface BigQueryModelTraining {
            /**
             * [Output-only, Beta] Index of current ML training iteration. Updated during create model query job to show job progress.
             */
            currentIteration?: pulumi.Input<number>;
            /**
             * [Output-only, Beta] Expected number of iterations for the create model query job specified as num_iterations in the input query. The actual total number of iterations may be less than this number due to early stop.
             */
            expectedTotalIterations?: pulumi.Input<string>;
        }
        interface BigtableColumn {
            /**
             * [Optional] The encoding of the values when the type is not STRING. Acceptable encoding values are: TEXT - indicates values are alphanumeric text strings. BINARY - indicates values are encoded using HBase Bytes.toBytes family of functions. 'encoding' can also be set at the column family level. However, the setting at this level takes precedence if 'encoding' is set at both levels.
             */
            encoding?: pulumi.Input<string>;
            /**
             * [Optional] If the qualifier is not a valid BigQuery field identifier i.e. does not match [a-zA-Z][a-zA-Z0-9_]*, a valid identifier must be provided as the column field name and is used as field name in queries.
             */
            fieldName?: pulumi.Input<string>;
            /**
             * [Optional] If this is set, only the latest version of value in this column are exposed. 'onlyReadLatest' can also be set at the column family level. However, the setting at this level takes precedence if 'onlyReadLatest' is set at both levels.
             */
            onlyReadLatest?: pulumi.Input<boolean>;
            /**
             * [Required] Qualifier of the column. Columns in the parent column family that has this exact qualifier are exposed as . field. If the qualifier is valid UTF-8 string, it can be specified in the qualifier_string field. Otherwise, a base-64 encoded value must be set to qualifier_encoded. The column field name is the same as the column qualifier. However, if the qualifier is not a valid BigQuery field identifier i.e. does not match [a-zA-Z][a-zA-Z0-9_]*, a valid identifier must be provided as field_name.
             */
            qualifierEncoded?: pulumi.Input<string>;
            qualifierString?: pulumi.Input<string>;
            /**
             * [Optional] The type to convert the value in cells of this column. The values are expected to be encoded using HBase Bytes.toBytes function when using the BINARY encoding value. Following BigQuery types are allowed (case-sensitive) - BYTES STRING INTEGER FLOAT BOOLEAN Default type is BYTES. 'type' can also be set at the column family level. However, the setting at this level takes precedence if 'type' is set at both levels.
             */
            type?: pulumi.Input<string>;
        }
        interface BigtableColumnFamily {
            /**
             * [Optional] Lists of columns that should be exposed as individual fields as opposed to a list of (column name, value) pairs. All columns whose qualifier matches a qualifier in this list can be accessed as .. Other columns can be accessed as a list through .Column field.
             */
            columns?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.BigtableColumn>[]>;
            /**
             * [Optional] The encoding of the values when the type is not STRING. Acceptable encoding values are: TEXT - indicates values are alphanumeric text strings. BINARY - indicates values are encoded using HBase Bytes.toBytes family of functions. This can be overridden for a specific column by listing that column in 'columns' and specifying an encoding for it.
             */
            encoding?: pulumi.Input<string>;
            /**
             * Identifier of the column family.
             */
            familyId?: pulumi.Input<string>;
            /**
             * [Optional] If this is set only the latest version of value are exposed for all columns in this column family. This can be overridden for a specific column by listing that column in 'columns' and specifying a different setting for that column.
             */
            onlyReadLatest?: pulumi.Input<boolean>;
            /**
             * [Optional] The type to convert the value in cells of this column family. The values are expected to be encoded using HBase Bytes.toBytes function when using the BINARY encoding value. Following BigQuery types are allowed (case-sensitive) - BYTES STRING INTEGER FLOAT BOOLEAN Default type is BYTES. This can be overridden for a specific column by listing that column in 'columns' and specifying a type for it.
             */
            type?: pulumi.Input<string>;
        }
        interface BigtableOptions {
            /**
             * [Optional] List of column families to expose in the table schema along with their types. This list restricts the column families that can be referenced in queries and specifies their value types. You can use this list to do type conversions - see the 'type' field for more details. If you leave this list empty, all column families are present in the table schema and their values are read as BYTES. During a query only the column families referenced in that query are read from Bigtable.
             */
            columnFamilies?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.BigtableColumnFamily>[]>;
            /**
             * [Optional] If field is true, then the column families that are not specified in columnFamilies list are not exposed in the table schema. Otherwise, they are read with BYTES type values. The default value is false.
             */
            ignoreUnspecifiedColumnFamilies?: pulumi.Input<boolean>;
            /**
             * [Optional] If field is true, then the rowkey column families will be read and converted to string. Otherwise they are read with BYTES type values and users need to manually cast them with CAST if necessary. The default value is false.
             */
            readRowkeyAsString?: pulumi.Input<boolean>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.bigquery.v2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        interface BqmlIterationResult {
            /**
             * [Output-only, Beta] Time taken to run the training iteration in milliseconds.
             */
            durationMs?: pulumi.Input<string>;
            /**
             * [Output-only, Beta] Eval loss computed on the eval data at the end of the iteration. The eval loss is used for early stopping to avoid overfitting. No eval loss if eval_split_method option is specified as no_split or auto_split with input data size less than 500 rows.
             */
            evalLoss?: pulumi.Input<number>;
            /**
             * [Output-only, Beta] Index of the ML training iteration, starting from zero for each training run.
             */
            index?: pulumi.Input<number>;
            /**
             * [Output-only, Beta] Learning rate used for this iteration, it varies for different training iterations if learn_rate_strategy option is not constant.
             */
            learnRate?: pulumi.Input<number>;
            /**
             * [Output-only, Beta] Training loss computed on the training data at the end of the iteration. The training loss function is defined by model type.
             */
            trainingLoss?: pulumi.Input<number>;
        }
        interface BqmlTrainingRun {
            /**
             * [Output-only, Beta] List of each iteration results.
             */
            iterationResults?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.BqmlIterationResult>[]>;
            /**
             * [Output-only, Beta] Training run start time in milliseconds since the epoch.
             */
            startTime?: pulumi.Input<string>;
            /**
             * [Output-only, Beta] Different state applicable for a training run. IN PROGRESS: Training run is in progress. FAILED: Training run ended due to a non-retryable failure. SUCCEEDED: Training run successfully completed. CANCELLED: Training run cancelled by the user.
             */
            state?: pulumi.Input<string>;
            /**
             * [Output-only, Beta] Training options used by this training run. These options are mutable for subsequent training runs. Default values are explicitly stored for options not specified in the input query of the first training run. For subsequent training runs, any option not explicitly specified in the input query will be copied from the previous training run.
             */
            trainingOptions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        interface Clustering {
            /**
             * [Repeated] One or more fields on which data should be clustered. Only top-level, non-repeated, simple-type fields are supported. When you cluster a table using multiple columns, the order of columns you specify is important. The order of the specified columns determines the sort order of the data.
             */
            fields?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface ConnectionProperty {
            /**
             * [Required] Name of the connection property to set.
             */
            key?: pulumi.Input<string>;
            /**
             * [Required] Value of the connection property.
             */
            value?: pulumi.Input<string>;
        }
        interface CsvOptions {
            /**
             * [Optional] Indicates if BigQuery should accept rows that are missing trailing optional columns. If true, BigQuery treats missing trailing columns as null values. If false, records with missing trailing columns are treated as bad records, and if there are too many bad records, an invalid error is returned in the job result. The default value is false.
             */
            allowJaggedRows?: pulumi.Input<boolean>;
            /**
             * [Optional] Indicates if BigQuery should allow quoted data sections that contain newline characters in a CSV file. The default value is false.
             */
            allowQuotedNewlines?: pulumi.Input<boolean>;
            /**
             * [Optional] The character encoding of the data. The supported values are UTF-8 or ISO-8859-1. The default value is UTF-8. BigQuery decodes the data after the raw, binary data has been split using the values of the quote and fieldDelimiter properties.
             */
            encoding?: pulumi.Input<string>;
            /**
             * [Optional] The separator for fields in a CSV file. BigQuery converts the string to ISO-8859-1 encoding, and then uses the first byte of the encoded string to split the data in its raw, binary state. BigQuery also supports the escape sequence "\t" to specify a tab separator. The default value is a comma (',').
             */
            fieldDelimiter?: pulumi.Input<string>;
            /**
             * [Optional] The value that is used to quote data sections in a CSV file. BigQuery converts the string to ISO-8859-1 encoding, and then uses the first byte of the encoded string to split the data in its raw, binary state. The default value is a double-quote ('"'). If your data does not contain quoted sections, set the property value to an empty string. If your data contains quoted newline characters, you must also set the allowQuotedNewlines property to true.
             */
            quote?: pulumi.Input<string>;
            /**
             * [Optional] The number of rows at the top of a CSV file that BigQuery will skip when reading the data. The default value is 0. This property is useful if you have header rows in the file that should be skipped. When autodetect is on, the behavior is the following: * skipLeadingRows unspecified - Autodetect tries to detect headers in the first row. If they are not detected, the row is read as data. Otherwise data is read starting from the second row. * skipLeadingRows is 0 - Instructs autodetect that there are no headers and data should be read starting from the first row. * skipLeadingRows = N > 0 - Autodetect skips N-1 rows and tries to detect headers in row N. If headers are not detected, row N is just skipped. Otherwise row N is used to extract column names for the detected schema.
             */
            skipLeadingRows?: pulumi.Input<string>;
        }
        interface DatasetReference {
            /**
             * [Required] A unique ID for this dataset, without the project name. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * [Optional] The ID of the project containing this dataset.
             */
            projectId?: pulumi.Input<string>;
        }
        interface DestinationTableProperties {
            /**
             * [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
             */
            description?: pulumi.Input<string>;
            /**
             * [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
             */
            friendlyName?: pulumi.Input<string>;
            /**
             * [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        interface EncryptionConfiguration {
            /**
             * [Optional] Describes the Cloud KMS encryption key that will be used to protect destination BigQuery table. The BigQuery Service Account associated with your project requires access to this encryption key.
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        interface ErrorProto {
            /**
             * Debugging information. This property is internal to Google and should not be used.
             */
            debugInfo?: pulumi.Input<string>;
            /**
             * Specifies where the error occurred, if present.
             */
            location?: pulumi.Input<string>;
            /**
             * A human-readable description of the error.
             */
            message?: pulumi.Input<string>;
            /**
             * A short error code that summarizes the error.
             */
            reason?: pulumi.Input<string>;
        }
        interface ExplainQueryStage {
            /**
             * Number of parallel input segments completed.
             */
            completedParallelInputs?: pulumi.Input<string>;
            /**
             * Milliseconds the average shard spent on CPU-bound tasks.
             */
            computeMsAvg?: pulumi.Input<string>;
            /**
             * Milliseconds the slowest shard spent on CPU-bound tasks.
             */
            computeMsMax?: pulumi.Input<string>;
            /**
             * Relative amount of time the average shard spent on CPU-bound tasks.
             */
            computeRatioAvg?: pulumi.Input<number>;
            /**
             * Relative amount of time the slowest shard spent on CPU-bound tasks.
             */
            computeRatioMax?: pulumi.Input<number>;
            /**
             * Stage end time represented as milliseconds since epoch.
             */
            endMs?: pulumi.Input<string>;
            /**
             * Unique ID for stage within plan.
             */
            id?: pulumi.Input<string>;
            /**
             * IDs for stages that are inputs to this stage.
             */
            inputStages?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Human-readable name for stage.
             */
            name?: pulumi.Input<string>;
            /**
             * Number of parallel input segments to be processed.
             */
            parallelInputs?: pulumi.Input<string>;
            /**
             * Milliseconds the average shard spent reading input.
             */
            readMsAvg?: pulumi.Input<string>;
            /**
             * Milliseconds the slowest shard spent reading input.
             */
            readMsMax?: pulumi.Input<string>;
            /**
             * Relative amount of time the average shard spent reading input.
             */
            readRatioAvg?: pulumi.Input<number>;
            /**
             * Relative amount of time the slowest shard spent reading input.
             */
            readRatioMax?: pulumi.Input<number>;
            /**
             * Number of records read into the stage.
             */
            recordsRead?: pulumi.Input<string>;
            /**
             * Number of records written by the stage.
             */
            recordsWritten?: pulumi.Input<string>;
            /**
             * Total number of bytes written to shuffle.
             */
            shuffleOutputBytes?: pulumi.Input<string>;
            /**
             * Total number of bytes written to shuffle and spilled to disk.
             */
            shuffleOutputBytesSpilled?: pulumi.Input<string>;
            /**
             * Slot-milliseconds used by the stage.
             */
            slotMs?: pulumi.Input<string>;
            /**
             * Stage start time represented as milliseconds since epoch.
             */
            startMs?: pulumi.Input<string>;
            /**
             * Current status for the stage.
             */
            status?: pulumi.Input<string>;
            /**
             * List of operations within the stage in dependency order (approximately chronological).
             */
            steps?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.ExplainQueryStep>[]>;
            /**
             * Milliseconds the average shard spent waiting to be scheduled.
             */
            waitMsAvg?: pulumi.Input<string>;
            /**
             * Milliseconds the slowest shard spent waiting to be scheduled.
             */
            waitMsMax?: pulumi.Input<string>;
            /**
             * Relative amount of time the average shard spent waiting to be scheduled.
             */
            waitRatioAvg?: pulumi.Input<number>;
            /**
             * Relative amount of time the slowest shard spent waiting to be scheduled.
             */
            waitRatioMax?: pulumi.Input<number>;
            /**
             * Milliseconds the average shard spent on writing output.
             */
            writeMsAvg?: pulumi.Input<string>;
            /**
             * Milliseconds the slowest shard spent on writing output.
             */
            writeMsMax?: pulumi.Input<string>;
            /**
             * Relative amount of time the average shard spent on writing output.
             */
            writeRatioAvg?: pulumi.Input<number>;
            /**
             * Relative amount of time the slowest shard spent on writing output.
             */
            writeRatioMax?: pulumi.Input<number>;
        }
        interface ExplainQueryStep {
            /**
             * Machine-readable operation type.
             */
            kind?: pulumi.Input<string>;
            /**
             * Human-readable stage descriptions.
             */
            substeps?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        interface ExternalDataConfiguration {
            /**
             * Try to detect schema and format options automatically. Any option specified explicitly will be honored.
             */
            autodetect?: pulumi.Input<boolean>;
            /**
             * [Optional] Additional options if sourceFormat is set to BIGTABLE.
             */
            bigtableOptions?: pulumi.Input<inputs.bigquery.v2.BigtableOptions>;
            /**
             * [Optional] The compression type of the data source. Possible values include GZIP and NONE. The default value is NONE. This setting is ignored for Google Cloud Bigtable, Google Cloud Datastore backups and Avro formats.
             */
            compression?: pulumi.Input<string>;
            /**
             * [Optional, Trusted Tester] Connection for external data source.
             */
            connectionId?: pulumi.Input<string>;
            /**
             * Additional properties to set if sourceFormat is set to CSV.
             */
            csvOptions?: pulumi.Input<inputs.bigquery.v2.CsvOptions>;
            /**
             * [Optional] Additional options if sourceFormat is set to GOOGLE_SHEETS.
             */
            googleSheetsOptions?: pulumi.Input<inputs.bigquery.v2.GoogleSheetsOptions>;
            /**
             * [Optional] Options to configure hive partitioning support.
             */
            hivePartitioningOptions?: pulumi.Input<inputs.bigquery.v2.HivePartitioningOptions>;
            /**
             * [Optional] Indicates if BigQuery should allow extra values that are not represented in the table schema. If true, the extra values are ignored. If false, records with extra columns are treated as bad records, and if there are too many bad records, an invalid error is returned in the job result. The default value is false. The sourceFormat property determines what BigQuery treats as an extra value: CSV: Trailing columns JSON: Named values that don't match any column names Google Cloud Bigtable: This setting is ignored. Google Cloud Datastore backups: This setting is ignored. Avro: This setting is ignored.
             */
            ignoreUnknownValues?: pulumi.Input<boolean>;
            /**
             * [Optional] The maximum number of bad records that BigQuery can ignore when reading data. If the number of bad records exceeds this value, an invalid error is returned in the job result. This is only valid for CSV, JSON, and Google Sheets. The default value is 0, which requires that all records are valid. This setting is ignored for Google Cloud Bigtable, Google Cloud Datastore backups and Avro formats.
             */
            maxBadRecords?: pulumi.Input<number>;
            /**
             * Additional properties to set if sourceFormat is set to Parquet.
             */
            parquetOptions?: pulumi.Input<inputs.bigquery.v2.ParquetOptions>;
            /**
             * [Optional] The schema for the data. Schema is required for CSV and JSON formats. Schema is disallowed for Google Cloud Bigtable, Cloud Datastore backups, and Avro formats.
             */
            schema?: pulumi.Input<inputs.bigquery.v2.TableSchema>;
            /**
             * [Required] The data format. For CSV files, specify "CSV". For Google sheets, specify "GOOGLE_SHEETS". For newline-delimited JSON, specify "NEWLINE_DELIMITED_JSON". For Avro files, specify "AVRO". For Google Cloud Datastore backups, specify "DATASTORE_BACKUP". [Beta] For Google Cloud Bigtable, specify "BIGTABLE".
             */
            sourceFormat?: pulumi.Input<string>;
            /**
             * [Required] The fully-qualified URIs that point to your data in Google Cloud. For Google Cloud Storage URIs: Each URI can contain one '*' wildcard character and it must come after the 'bucket' name. Size limits related to load jobs apply to external data sources. For Google Cloud Bigtable URIs: Exactly one URI can be specified and it has be a fully specified and valid HTTPS URL for a Google Cloud Bigtable table. For Google Cloud Datastore backups, exactly one URI can be specified. Also, the '*' wildcard character is not allowed.
             */
            sourceUris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface GoogleSheetsOptions {
            /**
             * [Optional] Range of a sheet to query from. Only used when non-empty. Typical format: sheet_name!top_left_cell_id:bottom_right_cell_id For example: sheet1!A1:B20
             */
            range?: pulumi.Input<string>;
            /**
             * [Optional] The number of rows at the top of a sheet that BigQuery will skip when reading the data. The default value is 0. This property is useful if you have header rows that should be skipped. When autodetect is on, behavior is the following: * skipLeadingRows unspecified - Autodetect tries to detect headers in the first row. If they are not detected, the row is read as data. Otherwise data is read starting from the second row. * skipLeadingRows is 0 - Instructs autodetect that there are no headers and data should be read starting from the first row. * skipLeadingRows = N > 0 - Autodetect skips N-1 rows and tries to detect headers in row N. If headers are not detected, row N is just skipped. Otherwise row N is used to extract column names for the detected schema.
             */
            skipLeadingRows?: pulumi.Input<string>;
        }
        interface HivePartitioningOptions {
            /**
             * [Optional] When set, what mode of hive partitioning to use when reading data. The following modes are supported. (1) AUTO: automatically infer partition key name(s) and type(s). (2) STRINGS: automatically infer partition key name(s). All types are interpreted as strings. (3) CUSTOM: partition key schema is encoded in the source URI prefix. Not all storage formats support hive partitioning. Requesting hive partitioning on an unsupported format will lead to an error. Currently supported types include: AVRO, CSV, JSON, ORC and Parquet.
             */
            mode?: pulumi.Input<string>;
            /**
             * [Optional] If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. Note that this field should only be true when creating a permanent external table or querying a temporary external table. Hive-partitioned loads with requirePartitionFilter explicitly set to true will fail.
             */
            requirePartitionFilter?: pulumi.Input<boolean>;
            /**
             * [Optional] When hive partition detection is requested, a common prefix for all source uris should be supplied. The prefix must end immediately before the partition key encoding begins. For example, consider files following this data layout. gs://bucket/path_to_table/dt=2019-01-01/country=BR/id=7/file.avro gs://bucket/path_to_table/dt=2018-12-31/country=CA/id=3/file.avro When hive partitioning is requested with either AUTO or STRINGS detection, the common prefix can be either of gs://bucket/path_to_table or gs://bucket/path_to_table/ (trailing slash does not matter).
             */
            sourceUriPrefix?: pulumi.Input<string>;
        }
        interface JobConfiguration {
            /**
             * [Pick one] Copies a table.
             */
            copy?: pulumi.Input<inputs.bigquery.v2.JobConfigurationTableCopy>;
            /**
             * [Optional] If set, don't actually run this job. A valid query will return a mostly empty response with some processing statistics, while an invalid query will return the same error it would if it wasn't a dry run. Behavior of non-query jobs is undefined.
             */
            dryRun?: pulumi.Input<boolean>;
            /**
             * [Pick one] Configures an extract job.
             */
            extract?: pulumi.Input<inputs.bigquery.v2.JobConfigurationExtract>;
            /**
             * [Optional] Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job.
             */
            jobTimeoutMs?: pulumi.Input<string>;
            /**
             * [Output-only] The type of the job. Can be QUERY, LOAD, EXTRACT, COPY or UNKNOWN.
             */
            jobType?: pulumi.Input<string>;
            /**
             * The labels associated with this job. You can use these to organize and group your jobs. Label keys and values can be no longer than 63 characters, can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. Label values are optional. Label keys must start with a letter and each label in the list must have a different key.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Pick one] Configures a load job.
             */
            load?: pulumi.Input<inputs.bigquery.v2.JobConfigurationLoad>;
            /**
             * [Pick one] Configures a query job.
             */
            query?: pulumi.Input<inputs.bigquery.v2.JobConfigurationQuery>;
        }
        interface JobConfigurationExtract {
            /**
             * [Optional] The compression type to use for exported files. Possible values include GZIP, DEFLATE, SNAPPY, and NONE. The default value is NONE. DEFLATE and SNAPPY are only supported for Avro. Not applicable when extracting models.
             */
            compression?: pulumi.Input<string>;
            /**
             * [Optional] The exported file format. Possible values include CSV, NEWLINE_DELIMITED_JSON, PARQUET or AVRO for tables and ML_TF_SAVED_MODEL or ML_XGBOOST_BOOSTER for models. The default value for tables is CSV. Tables with nested or repeated fields cannot be exported as CSV. The default value for models is ML_TF_SAVED_MODEL.
             */
            destinationFormat?: pulumi.Input<string>;
            /**
             * [Pick one] DEPRECATED: Use destinationUris instead, passing only one URI as necessary. The fully-qualified Google Cloud Storage URI where the extracted table should be written.
             */
            destinationUri?: pulumi.Input<string>;
            /**
             * [Pick one] A list of fully-qualified Google Cloud Storage URIs where the extracted table should be written.
             */
            destinationUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Optional] Delimiter to use between fields in the exported data. Default is ','. Not applicable when extracting models.
             */
            fieldDelimiter?: pulumi.Input<string>;
            /**
             * [Optional] Whether to print out a header row in the results. Default is true. Not applicable when extracting models.
             */
            printHeader?: pulumi.Input<boolean>;
            /**
             * A reference to the model being exported.
             */
            sourceModel?: pulumi.Input<inputs.bigquery.v2.ModelReference>;
            /**
             * A reference to the table being exported.
             */
            sourceTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Optional] If destinationFormat is set to "AVRO", this flag indicates whether to enable extracting applicable column types (such as TIMESTAMP) to their corresponding AVRO logical types (timestamp-micros), instead of only using their raw types (avro-long). Not applicable when extracting models.
             */
            useAvroLogicalTypes?: pulumi.Input<boolean>;
        }
        interface JobConfigurationLoad {
            /**
             * [Optional] Accept rows that are missing trailing optional columns. The missing values are treated as nulls. If false, records with missing trailing columns are treated as bad records, and if there are too many bad records, an invalid error is returned in the job result. The default value is false. Only applicable to CSV, ignored for other formats.
             */
            allowJaggedRows?: pulumi.Input<boolean>;
            /**
             * Indicates if BigQuery should allow quoted data sections that contain newline characters in a CSV file. The default value is false.
             */
            allowQuotedNewlines?: pulumi.Input<boolean>;
            /**
             * [Optional] Indicates if we should automatically infer the options and schema for CSV and JSON sources.
             */
            autodetect?: pulumi.Input<boolean>;
            /**
             * [Beta] Clustering specification for the destination table. Must be specified with time-based partitioning, data in the table will be first partitioned and subsequently clustered.
             */
            clustering?: pulumi.Input<inputs.bigquery.v2.Clustering>;
            /**
             * [Optional] Specifies whether the job is allowed to create new tables. The following values are supported: CREATE_IF_NEEDED: If the table does not exist, BigQuery creates the table. CREATE_NEVER: The table must already exist. If it does not, a 'notFound' error is returned in the job result. The default value is CREATE_IF_NEEDED. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            createDisposition?: pulumi.Input<string>;
            /**
             * Defines the list of possible SQL data types to which the source decimal values are converted. This list and the precision and the scale parameters of the decimal field determine the target type. In the order of NUMERIC, BIGNUMERIC ([Preview](/products/#product-launch-stages)), and STRING, a type is picked if it is in the specified list and if it supports the precision and the scale. STRING supports all precision and scale values. If none of the listed types supports the precision and the scale, the type supporting the widest range in the specified list is picked, and if a value exceeds the supported range when reading the data, an error will be thrown. Example: Suppose the value of this field is ["NUMERIC", "BIGNUMERIC"]. If (precision,scale) is: * (38,9) -> NUMERIC; * (39,9) -> BIGNUMERIC (NUMERIC cannot hold 30 integer digits); * (38,10) -> BIGNUMERIC (NUMERIC cannot hold 10 fractional digits); * (76,38) -> BIGNUMERIC; * (77,38) -> BIGNUMERIC (error if value exeeds supported range). This field cannot contain duplicate types. The order of the types in this field is ignored. For example, ["BIGNUMERIC", "NUMERIC"] is the same as ["NUMERIC", "BIGNUMERIC"] and NUMERIC always takes precedence over BIGNUMERIC. Defaults to ["NUMERIC", "STRING"] for ORC and ["NUMERIC"] for the other file formats.
             */
            decimalTargetTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Custom encryption configuration (e.g., Cloud KMS keys).
             */
            destinationEncryptionConfiguration?: pulumi.Input<inputs.bigquery.v2.EncryptionConfiguration>;
            /**
             * [Required] The destination table to load the data into.
             */
            destinationTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Beta] [Optional] Properties with which to create the destination table if it is new.
             */
            destinationTableProperties?: pulumi.Input<inputs.bigquery.v2.DestinationTableProperties>;
            /**
             * [Optional] The character encoding of the data. The supported values are UTF-8 or ISO-8859-1. The default value is UTF-8. BigQuery decodes the data after the raw, binary data has been split using the values of the quote and fieldDelimiter properties.
             */
            encoding?: pulumi.Input<string>;
            /**
             * [Optional] The separator for fields in a CSV file. The separator can be any ISO-8859-1 single-byte character. To use a character in the range 128-255, you must encode the character as UTF8. BigQuery converts the string to ISO-8859-1 encoding, and then uses the first byte of the encoded string to split the data in its raw, binary state. BigQuery also supports the escape sequence "\t" to specify a tab separator. The default value is a comma (',').
             */
            fieldDelimiter?: pulumi.Input<string>;
            /**
             * [Optional] Options to configure hive partitioning support.
             */
            hivePartitioningOptions?: pulumi.Input<inputs.bigquery.v2.HivePartitioningOptions>;
            /**
             * [Optional] Indicates if BigQuery should allow extra values that are not represented in the table schema. If true, the extra values are ignored. If false, records with extra columns are treated as bad records, and if there are too many bad records, an invalid error is returned in the job result. The default value is false. The sourceFormat property determines what BigQuery treats as an extra value: CSV: Trailing columns JSON: Named values that don't match any column names
             */
            ignoreUnknownValues?: pulumi.Input<boolean>;
            /**
             * [Optional] If sourceFormat is set to newline-delimited JSON, indicates whether it should be processed as a JSON variant such as GeoJSON. For a sourceFormat other than JSON, omit this field. If the sourceFormat is newline-delimited JSON: - for newline-delimited GeoJSON: set to GEOJSON.
             */
            jsonExtension?: pulumi.Input<string>;
            /**
             * [Optional] The maximum number of bad records that BigQuery can ignore when running the job. If the number of bad records exceeds this value, an invalid error is returned in the job result. This is only valid for CSV and JSON. The default value is 0, which requires that all records are valid.
             */
            maxBadRecords?: pulumi.Input<number>;
            /**
             * [Optional] Specifies a string that represents a null value in a CSV file. For example, if you specify "\N", BigQuery interprets "\N" as a null value when loading a CSV file. The default value is the empty string. If you set this property to a custom value, BigQuery throws an error if an empty string is present for all data types except for STRING and BYTE. For STRING and BYTE columns, BigQuery interprets the empty string as an empty value.
             */
            nullMarker?: pulumi.Input<string>;
            /**
             * [Optional] Options to configure parquet support.
             */
            parquetOptions?: pulumi.Input<inputs.bigquery.v2.ParquetOptions>;
            /**
             * If sourceFormat is set to "DATASTORE_BACKUP", indicates which entity properties to load into BigQuery from a Cloud Datastore backup. Property names are case sensitive and must be top-level properties. If no properties are specified, BigQuery loads all properties. If any named property isn't found in the Cloud Datastore backup, an invalid error is returned in the job result.
             */
            projectionFields?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Optional] The value that is used to quote data sections in a CSV file. BigQuery converts the string to ISO-8859-1 encoding, and then uses the first byte of the encoded string to split the data in its raw, binary state. The default value is a double-quote ('"'). If your data does not contain quoted sections, set the property value to an empty string. If your data contains quoted newline characters, you must also set the allowQuotedNewlines property to true.
             */
            quote?: pulumi.Input<string>;
            /**
             * [TrustedTester] Range partitioning specification for this table. Only one of timePartitioning and rangePartitioning should be specified.
             */
            rangePartitioning?: pulumi.Input<inputs.bigquery.v2.RangePartitioning>;
            /**
             * [Optional] The schema for the destination table. The schema can be omitted if the destination table already exists, or if you're loading data from Google Cloud Datastore.
             */
            schema?: pulumi.Input<inputs.bigquery.v2.TableSchema>;
            /**
             * [Deprecated] The inline schema. For CSV schemas, specify as "Field1:Type1[,Field2:Type2]*". For example, "foo:STRING, bar:INTEGER, baz:FLOAT".
             */
            schemaInline?: pulumi.Input<string>;
            /**
             * [Deprecated] The format of the schemaInline property.
             */
            schemaInlineFormat?: pulumi.Input<string>;
            /**
             * Allows the schema of the destination table to be updated as a side effect of the load job if a schema is autodetected or supplied in the job configuration. Schema update options are supported in two cases: when writeDisposition is WRITE_APPEND; when writeDisposition is WRITE_TRUNCATE and the destination table is a partition of a table, specified by partition decorators. For normal tables, WRITE_TRUNCATE will always overwrite the schema. One or more of the following values are specified: ALLOW_FIELD_ADDITION: allow adding a nullable field to the schema. ALLOW_FIELD_RELAXATION: allow relaxing a required field in the original schema to nullable.
             */
            schemaUpdateOptions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Optional] The number of rows at the top of a CSV file that BigQuery will skip when loading the data. The default value is 0. This property is useful if you have header rows in the file that should be skipped.
             */
            skipLeadingRows?: pulumi.Input<number>;
            /**
             * [Optional] The format of the data files. For CSV files, specify "CSV". For datastore backups, specify "DATASTORE_BACKUP". For newline-delimited JSON, specify "NEWLINE_DELIMITED_JSON". For Avro, specify "AVRO". For parquet, specify "PARQUET". For orc, specify "ORC". The default value is CSV.
             */
            sourceFormat?: pulumi.Input<string>;
            /**
             * [Required] The fully-qualified URIs that point to your data in Google Cloud. For Google Cloud Storage URIs: Each URI can contain one '*' wildcard character and it must come after the 'bucket' name. Size limits related to load jobs apply to external data sources. For Google Cloud Bigtable URIs: Exactly one URI can be specified and it has be a fully specified and valid HTTPS URL for a Google Cloud Bigtable table. For Google Cloud Datastore backups: Exactly one URI can be specified. Also, the '*' wildcard character is not allowed.
             */
            sourceUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Time-based partitioning specification for the destination table. Only one of timePartitioning and rangePartitioning should be specified.
             */
            timePartitioning?: pulumi.Input<inputs.bigquery.v2.TimePartitioning>;
            /**
             * [Optional] If sourceFormat is set to "AVRO", indicates whether to enable interpreting logical types into their corresponding types (ie. TIMESTAMP), instead of only using their raw types (ie. INTEGER).
             */
            useAvroLogicalTypes?: pulumi.Input<boolean>;
            /**
             * [Optional] Specifies the action that occurs if the destination table already exists. The following values are supported: WRITE_TRUNCATE: If the table already exists, BigQuery overwrites the table data. WRITE_APPEND: If the table already exists, BigQuery appends the data to the table. WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_APPEND. Each action is atomic and only occurs if BigQuery is able to complete the job successfully. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        interface JobConfigurationQuery {
            /**
             * [Optional] If true and query uses legacy SQL dialect, allows the query to produce arbitrarily large result tables at a slight cost in performance. Requires destinationTable to be set. For standard SQL queries, this flag is ignored and large results are always allowed. However, you must still set destinationTable when result size exceeds the allowed maximum response size.
             */
            allowLargeResults?: pulumi.Input<boolean>;
            /**
             * [Beta] Clustering specification for the destination table. Must be specified with time-based partitioning, data in the table will be first partitioned and subsequently clustered.
             */
            clustering?: pulumi.Input<inputs.bigquery.v2.Clustering>;
            /**
             * Connection properties.
             */
            connectionProperties?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.ConnectionProperty>[]>;
            /**
             * [Optional] Specifies whether the job is allowed to create new tables. The following values are supported: CREATE_IF_NEEDED: If the table does not exist, BigQuery creates the table. CREATE_NEVER: The table must already exist. If it does not, a 'notFound' error is returned in the job result. The default value is CREATE_IF_NEEDED. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            createDisposition?: pulumi.Input<string>;
            /**
             * If true, creates a new session, where session id will be a server generated random id. If false, runs query with an existing session_id passed in ConnectionProperty, otherwise runs query in non-session mode.
             */
            createSession?: pulumi.Input<boolean>;
            /**
             * [Optional] Specifies the default dataset to use for unqualified table names in the query. Note that this does not alter behavior of unqualified dataset names.
             */
            defaultDataset?: pulumi.Input<inputs.bigquery.v2.DatasetReference>;
            /**
             * Custom encryption configuration (e.g., Cloud KMS keys).
             */
            destinationEncryptionConfiguration?: pulumi.Input<inputs.bigquery.v2.EncryptionConfiguration>;
            /**
             * [Optional] Describes the table where the query results should be stored. If not present, a new table will be created to store the results. This property must be set for large results that exceed the maximum response size.
             */
            destinationTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Optional] If true and query uses legacy SQL dialect, flattens all nested and repeated fields in the query results. allowLargeResults must be true if this is set to false. For standard SQL queries, this flag is ignored and results are never flattened.
             */
            flattenResults?: pulumi.Input<boolean>;
            /**
             * [Optional] Limits the billing tier for this job. Queries that have resource usage beyond this tier will fail (without incurring a charge). If unspecified, this will be set to your project default.
             */
            maximumBillingTier?: pulumi.Input<number>;
            /**
             * [Optional] Limits the bytes billed for this job. Queries that will have bytes billed beyond this limit will fail (without incurring a charge). If unspecified, this will be set to your project default.
             */
            maximumBytesBilled?: pulumi.Input<string>;
            /**
             * Standard SQL only. Set to POSITIONAL to use positional (?) query parameters or to NAMED to use named (@myparam) query parameters in this query.
             */
            parameterMode?: pulumi.Input<string>;
            /**
             * [Deprecated] This property is deprecated.
             */
            preserveNulls?: pulumi.Input<boolean>;
            /**
             * [Optional] Specifies a priority for the query. Possible values include INTERACTIVE and BATCH. The default value is INTERACTIVE.
             */
            priority?: pulumi.Input<string>;
            /**
             * [Required] SQL query text to execute. The useLegacySql field can be used to indicate whether the query uses legacy SQL or standard SQL.
             */
            query?: pulumi.Input<string>;
            /**
             * Query parameters for standard SQL queries.
             */
            queryParameters?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.QueryParameter>[]>;
            /**
             * [TrustedTester] Range partitioning specification for this table. Only one of timePartitioning and rangePartitioning should be specified.
             */
            rangePartitioning?: pulumi.Input<inputs.bigquery.v2.RangePartitioning>;
            /**
             * Allows the schema of the destination table to be updated as a side effect of the query job. Schema update options are supported in two cases: when writeDisposition is WRITE_APPEND; when writeDisposition is WRITE_TRUNCATE and the destination table is a partition of a table, specified by partition decorators. For normal tables, WRITE_TRUNCATE will always overwrite the schema. One or more of the following values are specified: ALLOW_FIELD_ADDITION: allow adding a nullable field to the schema. ALLOW_FIELD_RELAXATION: allow relaxing a required field in the original schema to nullable.
             */
            schemaUpdateOptions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Optional] If querying an external data source outside of BigQuery, describes the data format, location and other properties of the data source. By defining these properties, the data source can then be queried as if it were a standard BigQuery table.
             */
            tableDefinitions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Time-based partitioning specification for the destination table. Only one of timePartitioning and rangePartitioning should be specified.
             */
            timePartitioning?: pulumi.Input<inputs.bigquery.v2.TimePartitioning>;
            /**
             * Specifies whether to use BigQuery's legacy SQL dialect for this query. The default value is true. If set to false, the query will use BigQuery's standard SQL: https://cloud.google.com/bigquery/sql-reference/ When useLegacySql is set to false, the value of flattenResults is ignored; query will be run as if flattenResults is false.
             */
            useLegacySql?: pulumi.Input<boolean>;
            /**
             * [Optional] Whether to look for the result in the query cache. The query cache is a best-effort cache that will be flushed whenever tables in the query are modified. Moreover, the query cache is only available when a query does not have a destination table specified. The default value is true.
             */
            useQueryCache?: pulumi.Input<boolean>;
            /**
             * Describes user-defined function resources used in the query.
             */
            userDefinedFunctionResources?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.UserDefinedFunctionResource>[]>;
            /**
             * [Optional] Specifies the action that occurs if the destination table already exists. The following values are supported: WRITE_TRUNCATE: If the table already exists, BigQuery overwrites the table data and uses the schema from the query result. WRITE_APPEND: If the table already exists, BigQuery appends the data to the table. WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_EMPTY. Each action is atomic and only occurs if BigQuery is able to complete the job successfully. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        interface JobConfigurationTableCopy {
            /**
             * [Optional] Specifies whether the job is allowed to create new tables. The following values are supported: CREATE_IF_NEEDED: If the table does not exist, BigQuery creates the table. CREATE_NEVER: The table must already exist. If it does not, a 'notFound' error is returned in the job result. The default value is CREATE_IF_NEEDED. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            createDisposition?: pulumi.Input<string>;
            /**
             * Custom encryption configuration (e.g., Cloud KMS keys).
             */
            destinationEncryptionConfiguration?: pulumi.Input<inputs.bigquery.v2.EncryptionConfiguration>;
            /**
             * [Optional] The time when the destination table expires. Expired tables will be deleted and their storage reclaimed.
             */
            destinationExpirationTime?: any;
            /**
             * [Required] The destination table
             */
            destinationTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Optional] Supported operation types in table copy job.
             */
            operationType?: pulumi.Input<string>;
            /**
             * [Pick one] Source table to copy.
             */
            sourceTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Pick one] Source tables to copy.
             */
            sourceTables?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.TableReference>[]>;
            /**
             * [Optional] Specifies the action that occurs if the destination table already exists. The following values are supported: WRITE_TRUNCATE: If the table already exists, BigQuery overwrites the table data. WRITE_APPEND: If the table already exists, BigQuery appends the data to the table. WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_EMPTY. Each action is atomic and only occurs if BigQuery is able to complete the job successfully. Creation, truncation and append actions occur as one atomic update upon job completion.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        interface JobReference {
            /**
             * [Required] The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.
             */
            jobId?: pulumi.Input<string>;
            /**
             * The geographic location of the job. See details at https://cloud.google.com/bigquery/docs/locations#specifying_your_location.
             */
            location?: pulumi.Input<string>;
            /**
             * [Required] The ID of the project containing this job.
             */
            projectId?: pulumi.Input<string>;
        }
        interface JobStatistics {
            /**
             * [TrustedTester] [Output-only] Job progress (0.0 -> 1.0) for LOAD and EXTRACT jobs.
             */
            completionRatio?: pulumi.Input<number>;
            /**
             * [Output-only] Creation time of this job, in milliseconds since the epoch. This field will be present on all jobs.
             */
            creationTime?: pulumi.Input<string>;
            /**
             * [Output-only] End time of this job, in milliseconds since the epoch. This field will be present whenever a job is in the DONE state.
             */
            endTime?: pulumi.Input<string>;
            /**
             * [Output-only] Statistics for an extract job.
             */
            extract?: pulumi.Input<inputs.bigquery.v2.JobStatistics4>;
            /**
             * [Output-only] Statistics for a load job.
             */
            load?: pulumi.Input<inputs.bigquery.v2.JobStatistics3>;
            /**
             * [Output-only] Number of child jobs executed.
             */
            numChildJobs?: pulumi.Input<string>;
            /**
             * [Output-only] If this is a child job, the id of the parent.
             */
            parentJobId?: pulumi.Input<string>;
            /**
             * [Output-only] Statistics for a query job.
             */
            query?: pulumi.Input<inputs.bigquery.v2.JobStatistics2>;
            /**
             * [Output-only] Quotas which delayed this job's start time.
             */
            quotaDeferments?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Output-only] Job resource usage breakdown by reservation.
             */
            reservationUsage?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output-only] Name of the primary reservation assigned to this job. Note that this could be different than reservations reported in the reservation usage field if parent reservations were used to execute this job.
             */
            reservation_id?: pulumi.Input<string>;
            /**
             * [Output-only] [Preview] Statistics for row-level security. Present only for query and extract jobs.
             */
            rowLevelSecurityStatistics?: pulumi.Input<inputs.bigquery.v2.RowLevelSecurityStatistics>;
            /**
             * [Output-only] Statistics for a child job of a script.
             */
            scriptStatistics?: pulumi.Input<inputs.bigquery.v2.ScriptStatistics>;
            /**
             * [Output-only] [Preview] Information of the session if this job is part of one.
             */
            sessionInfoTemplate?: pulumi.Input<inputs.bigquery.v2.SessionInfo>;
            /**
             * [Output-only] Start time of this job, in milliseconds since the epoch. This field will be present when the job transitions from the PENDING state to either RUNNING or DONE.
             */
            startTime?: pulumi.Input<string>;
            /**
             * [Output-only] [Deprecated] Use the bytes processed in the query statistics instead.
             */
            totalBytesProcessed?: pulumi.Input<string>;
            /**
             * [Output-only] Slot-milliseconds for the job.
             */
            totalSlotMs?: pulumi.Input<string>;
            /**
             * [Output-only] [Alpha] Information of the multi-statement transaction if this job is part of one.
             */
            transactionInfoTemplate?: pulumi.Input<inputs.bigquery.v2.TransactionInfo>;
        }
        interface JobStatistics2 {
            /**
             * [Output-only] Billing tier for the job.
             */
            billingTier?: pulumi.Input<number>;
            /**
             * [Output-only] Whether the query result was fetched from the query cache.
             */
            cacheHit?: pulumi.Input<boolean>;
            /**
             * [Output-only] [Preview] The number of row access policies affected by a DDL statement. Present only for DROP ALL ROW ACCESS POLICIES queries.
             */
            ddlAffectedRowAccessPolicyCount?: pulumi.Input<string>;
            /**
             * The DDL operation performed, possibly dependent on the pre-existence of the DDL target. Possible values (new values might be added in the future): "CREATE": The query created the DDL target. "SKIP": No-op. Example cases: the query is CREATE TABLE IF NOT EXISTS while the table already exists, or the query is DROP TABLE IF EXISTS while the table does not exist. "REPLACE": The query replaced the DDL target. Example case: the query is CREATE OR REPLACE TABLE, and the table already exists. "DROP": The query deleted the DDL target.
             */
            ddlOperationPerformed?: pulumi.Input<string>;
            /**
             * [Output-only] The DDL target dataset. Present only for CREATE/ALTER/DROP SCHEMA queries.
             */
            ddlTargetDataset?: pulumi.Input<inputs.bigquery.v2.DatasetReference>;
            /**
             * The DDL target routine. Present only for CREATE/DROP FUNCTION/PROCEDURE queries.
             */
            ddlTargetRoutine?: pulumi.Input<inputs.bigquery.v2.RoutineReference>;
            /**
             * [Output-only] [Preview] The DDL target row access policy. Present only for CREATE/DROP ROW ACCESS POLICY queries.
             */
            ddlTargetRowAccessPolicy?: pulumi.Input<inputs.bigquery.v2.RowAccessPolicyReference>;
            /**
             * [Output-only] The DDL target table. Present only for CREATE/DROP TABLE/VIEW and DROP ALL ROW ACCESS POLICIES queries.
             */
            ddlTargetTable?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Output-only] The original estimate of bytes processed for the job.
             */
            estimatedBytesProcessed?: pulumi.Input<string>;
            /**
             * [Output-only, Beta] Information about create model query job progress.
             */
            modelTraining?: pulumi.Input<inputs.bigquery.v2.BigQueryModelTraining>;
            /**
             * [Output-only, Beta] Deprecated; do not use.
             */
            modelTrainingCurrentIteration?: pulumi.Input<number>;
            /**
             * [Output-only, Beta] Deprecated; do not use.
             */
            modelTrainingExpectedTotalIteration?: pulumi.Input<string>;
            /**
             * [Output-only] The number of rows affected by a DML statement. Present only for DML statements INSERT, UPDATE or DELETE.
             */
            numDmlAffectedRows?: pulumi.Input<string>;
            /**
             * [Output-only] Describes execution plan for the query.
             */
            queryPlan?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.ExplainQueryStage>[]>;
            /**
             * [Output-only] Referenced routines (persistent user-defined functions and stored procedures) for the job.
             */
            referencedRoutines?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.RoutineReference>[]>;
            /**
             * [Output-only] Referenced tables for the job. Queries that reference more than 50 tables will not have a complete list.
             */
            referencedTables?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.TableReference>[]>;
            /**
             * [Output-only] Job resource usage breakdown by reservation.
             */
            reservationUsage?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output-only] The schema of the results. Present only for successful dry run of non-legacy SQL queries.
             */
            schema?: pulumi.Input<inputs.bigquery.v2.TableSchema>;
            /**
             * The type of query statement, if valid. Possible values (new values might be added in the future): "SELECT": SELECT query. "INSERT": INSERT query; see https://cloud.google.com/bigquery/docs/reference/standard-sql/data-manipulation-language. "UPDATE": UPDATE query; see https://cloud.google.com/bigquery/docs/reference/standard-sql/data-manipulation-language. "DELETE": DELETE query; see https://cloud.google.com/bigquery/docs/reference/standard-sql/data-manipulation-language. "MERGE": MERGE query; see https://cloud.google.com/bigquery/docs/reference/standard-sql/data-manipulation-language. "ALTER_TABLE": ALTER TABLE query. "ALTER_VIEW": ALTER VIEW query. "ASSERT": ASSERT condition AS 'description'. "CREATE_FUNCTION": CREATE FUNCTION query. "CREATE_MODEL": CREATE [OR REPLACE] MODEL ... AS SELECT ... . "CREATE_PROCEDURE": CREATE PROCEDURE query. "CREATE_TABLE": CREATE [OR REPLACE] TABLE without AS SELECT. "CREATE_TABLE_AS_SELECT": CREATE [OR REPLACE] TABLE ... AS SELECT ... . "CREATE_VIEW": CREATE [OR REPLACE] VIEW ... AS SELECT ... . "DROP_FUNCTION" : DROP FUNCTION query. "DROP_PROCEDURE": DROP PROCEDURE query. "DROP_TABLE": DROP TABLE query. "DROP_VIEW": DROP VIEW query.
             */
            statementType?: pulumi.Input<string>;
            /**
             * [Output-only] [Beta] Describes a timeline of job execution.
             */
            timeline?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.QueryTimelineSample>[]>;
            /**
             * [Output-only] Total bytes billed for the job.
             */
            totalBytesBilled?: pulumi.Input<string>;
            /**
             * [Output-only] Total bytes processed for the job.
             */
            totalBytesProcessed?: pulumi.Input<string>;
            /**
             * [Output-only] For dry-run jobs, totalBytesProcessed is an estimate and this field specifies the accuracy of the estimate. Possible values can be: UNKNOWN: accuracy of the estimate is unknown. PRECISE: estimate is precise. LOWER_BOUND: estimate is lower bound of what the query would cost. UPPER_BOUND: estimate is upper bound of what the query would cost.
             */
            totalBytesProcessedAccuracy?: pulumi.Input<string>;
            /**
             * [Output-only] Total number of partitions processed from all partitioned tables referenced in the job.
             */
            totalPartitionsProcessed?: pulumi.Input<string>;
            /**
             * [Output-only] Slot-milliseconds for the job.
             */
            totalSlotMs?: pulumi.Input<string>;
            /**
             * Standard SQL only: list of undeclared query parameters detected during a dry run validation.
             */
            undeclaredQueryParameters?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.QueryParameter>[]>;
        }
        interface JobStatistics3 {
            /**
             * [Output-only] The number of bad records encountered. Note that if the job has failed because of more bad records encountered than the maximum allowed in the load job configuration, then this number can be less than the total number of bad records present in the input data.
             */
            badRecords?: pulumi.Input<string>;
            /**
             * [Output-only] Number of bytes of source data in a load job.
             */
            inputFileBytes?: pulumi.Input<string>;
            /**
             * [Output-only] Number of source files in a load job.
             */
            inputFiles?: pulumi.Input<string>;
            /**
             * [Output-only] Size of the loaded data in bytes. Note that while a load job is in the running state, this value may change.
             */
            outputBytes?: pulumi.Input<string>;
            /**
             * [Output-only] Number of rows imported in a load job. Note that while an import job is in the running state, this value may change.
             */
            outputRows?: pulumi.Input<string>;
        }
        interface JobStatistics4 {
            /**
             * [Output-only] Number of files per destination URI or URI pattern specified in the extract configuration. These values will be in the same order as the URIs specified in the 'destinationUris' field.
             */
            destinationUriFileCounts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Output-only] Number of user bytes extracted into the result. This is the byte count as computed by BigQuery for billing purposes.
             */
            inputBytes?: pulumi.Input<string>;
        }
        interface JobStatus {
            /**
             * [Output-only] Final error result of the job. If present, indicates that the job has completed and was unsuccessful.
             */
            errorResult?: pulumi.Input<inputs.bigquery.v2.ErrorProto>;
            /**
             * [Output-only] The first errors encountered during the running of the job. The final message includes the number of errors that caused the process to stop. Errors here do not necessarily mean that the job has completed or was unsuccessful.
             */
            errors?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.ErrorProto>[]>;
            /**
             * [Output-only] Running state of the job.
             */
            state?: pulumi.Input<string>;
        }
        interface MaterializedViewDefinition {
            /**
             * [Optional] [TrustedTester] Enable automatic refresh of the materialized view when the base table is updated. The default value is "true".
             */
            enableRefresh?: pulumi.Input<boolean>;
            /**
             * [Output-only] [TrustedTester] The time when this materialized view was last modified, in milliseconds since the epoch.
             */
            lastRefreshTime?: pulumi.Input<string>;
            /**
             * [Required] A query whose result is persisted.
             */
            query?: pulumi.Input<string>;
            /**
             * [Optional] [TrustedTester] The maximum frequency at which this materialized view will be refreshed. The default value is "1800000" (30 minutes).
             */
            refreshIntervalMs?: pulumi.Input<string>;
        }
        interface ModelDefinition {
            /**
             * [Output-only, Beta] Model options used for the first training run. These options are immutable for subsequent training runs. Default values are used for any options not specified in the input query.
             */
            modelOptions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Output-only, Beta] Information about ml training runs, each training run comprises of multiple iterations and there may be multiple training runs for the model if warm start is used or if a user decides to continue a previously cancelled query.
             */
            trainingRuns?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.BqmlTrainingRun>[]>;
        }
        interface ModelReference {
            /**
             * [Required] The ID of the dataset containing this model.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the model. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters.
             */
            modelId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the project containing this model.
             */
            projectId?: pulumi.Input<string>;
        }
        interface ParquetOptions {
            /**
             * [Optional] Indicates whether to use schema inference specifically for Parquet LIST logical type.
             */
            enableListInference?: pulumi.Input<boolean>;
            /**
             * [Optional] Indicates whether to infer Parquet ENUM logical type as STRING instead of BYTES by default.
             */
            enumAsString?: pulumi.Input<boolean>;
        }
        interface QueryParameter {
            /**
             * [Optional] If unset, this is a positional parameter. Otherwise, should be unique within a query.
             */
            name?: pulumi.Input<string>;
            /**
             * [Required] The type of this parameter.
             */
            parameterType?: pulumi.Input<inputs.bigquery.v2.QueryParameterType>;
            /**
             * [Required] The value of this parameter.
             */
            parameterValue?: pulumi.Input<inputs.bigquery.v2.QueryParameterValue>;
        }
        interface QueryParameterType {
            /**
             * [Optional] The type of the array's elements, if this is an array.
             */
            arrayType?: pulumi.Input<inputs.bigquery.v2.QueryParameterType>;
            /**
             * [Optional] The types of the fields of this struct, in order, if this is a struct.
             */
            structTypes?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Required] The top level type of this field.
             */
            type?: pulumi.Input<string>;
        }
        interface QueryParameterValue {
            /**
             * [Optional] The array values, if this is an array type.
             */
            arrayValues?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.QueryParameterValue>[]>;
            /**
             * [Optional] The struct field values, in order of the struct type's declaration.
             */
            structValues?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Optional] The value of this value, if a simple scalar type.
             */
            value?: pulumi.Input<string>;
        }
        interface QueryTimelineSample {
            /**
             * Total number of units currently being processed by workers. This does not correspond directly to slot usage. This is the largest value observed since the last sample.
             */
            activeUnits?: pulumi.Input<string>;
            /**
             * Total parallel units of work completed by this query.
             */
            completedUnits?: pulumi.Input<string>;
            /**
             * Milliseconds elapsed since the start of query execution.
             */
            elapsedMs?: pulumi.Input<string>;
            /**
             * Total parallel units of work remaining for the active stages.
             */
            pendingUnits?: pulumi.Input<string>;
            /**
             * Cumulative slot-ms consumed by the query.
             */
            totalSlotMs?: pulumi.Input<string>;
        }
        interface RangePartitioning {
            /**
             * [TrustedTester] [Required] The table is partitioned by this field. The field must be a top-level NULLABLE/REQUIRED field. The only supported type is INTEGER/INT64.
             */
            field?: pulumi.Input<string>;
            /**
             * [TrustedTester] [Required] Defines the ranges for range partitioning.
             */
            range?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        interface RoutineReference {
            /**
             * [Required] The ID of the dataset containing this routine.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the project containing this routine.
             */
            projectId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
             */
            routineId?: pulumi.Input<string>;
        }
        interface RowAccessPolicyReference {
            /**
             * [Required] The ID of the dataset containing this row access policy.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the row access policy. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
             */
            policyId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the project containing this row access policy.
             */
            projectId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the table containing this row access policy.
             */
            tableId?: pulumi.Input<string>;
        }
        interface RowLevelSecurityStatistics {
            /**
             * [Output-only] [Preview] Whether any accessed data was protected by row access policies.
             */
            rowLevelSecurityApplied?: pulumi.Input<boolean>;
        }
        interface ScriptStackFrame {
            /**
             * [Output-only] One-based end column.
             */
            endColumn?: pulumi.Input<number>;
            /**
             * [Output-only] One-based end line.
             */
            endLine?: pulumi.Input<number>;
            /**
             * [Output-only] Name of the active procedure, empty if in a top-level script.
             */
            procedureId?: pulumi.Input<string>;
            /**
             * [Output-only] One-based start column.
             */
            startColumn?: pulumi.Input<number>;
            /**
             * [Output-only] One-based start line.
             */
            startLine?: pulumi.Input<number>;
            /**
             * [Output-only] Text of the current statement/expression.
             */
            text?: pulumi.Input<string>;
        }
        interface ScriptStatistics {
            /**
             * [Output-only] Whether this child job was a statement or expression.
             */
            evaluationKind?: pulumi.Input<string>;
            /**
             * Stack trace showing the line/column/procedure name of each frame on the stack at the point where the current evaluation happened. The leaf frame is first, the primary script is last. Never empty.
             */
            stackFrames?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.ScriptStackFrame>[]>;
        }
        interface SessionInfo {
            /**
             * [Output-only] // [Preview] Id of the session.
             */
            sessionId?: pulumi.Input<string>;
        }
        interface SnapshotDefinition {
            /**
             * [Required] Reference describing the ID of the table that is snapshotted.
             */
            baseTableReference?: pulumi.Input<inputs.bigquery.v2.TableReference>;
            /**
             * [Required] The time at which the base table was snapshot.
             */
            snapshotTime?: pulumi.Input<string>;
        }
        /**
         * The type of a variable, e.g., a function argument. Examples: INT64: {type_kind="INT64"} ARRAY: {type_kind="ARRAY", array_element_type="STRING"} STRUCT>: {type_kind="STRUCT", struct_type={fields=[ {name="x", type={type_kind="STRING"}}, {name="y", type={type_kind="ARRAY", array_element_type="DATE"}} ]}}
         */
        interface StandardSqlDataType {
            /**
             * The type of the array's elements, if type_kind = "ARRAY".
             */
            arrayElementType?: pulumi.Input<inputs.bigquery.v2.StandardSqlDataType>;
            /**
             * The fields of this struct, in order, if type_kind = "STRUCT".
             */
            structType?: pulumi.Input<inputs.bigquery.v2.StandardSqlStructType>;
            /**
             * Required. The top level type of this field. Can be any standard SQL data type (e.g., "INT64", "DATE", "ARRAY").
             */
            typeKind?: pulumi.Input<string>;
        }
        /**
         * A field or a column.
         */
        interface StandardSqlField {
            /**
             * Optional. The name of this field. Can be absent for struct fields.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. The type of this parameter. Absent if not explicitly specified (e.g., CREATE FUNCTION statement can omit the return type; in this case the output parameter does not have this "type" field).
             */
            type?: pulumi.Input<inputs.bigquery.v2.StandardSqlDataType>;
        }
        interface StandardSqlStructType {
            fields?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.StandardSqlField>[]>;
        }
        /**
         * A table type
         */
        interface StandardSqlTableType {
            /**
             * The columns in this table type
             */
            columns?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.StandardSqlField>[]>;
        }
        interface Streamingbuffer {
            /**
             * [Output-only] A lower-bound estimate of the number of bytes currently in the streaming buffer.
             */
            estimatedBytes?: pulumi.Input<string>;
            /**
             * [Output-only] A lower-bound estimate of the number of rows currently in the streaming buffer.
             */
            estimatedRows?: pulumi.Input<string>;
            /**
             * [Output-only] Contains the timestamp of the oldest entry in the streaming buffer, in milliseconds since the epoch, if the streaming buffer is available.
             */
            oldestEntryTime?: pulumi.Input<string>;
        }
        interface TableFieldSchema {
            /**
             * [Optional] The categories attached to this field, used for field-level access control.
             */
            categories?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Optional] The field description. The maximum length is 1,024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * [Optional] Describes the nested schema fields if the type property is set to RECORD.
             */
            fields?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.TableFieldSchema>[]>;
            /**
             * [Optional] Maximum length of values of this field for STRINGS or BYTES. If max_length is not specified, no maximum length constraint is imposed on this field. If type = "STRING", then max_length represents the maximum UTF-8 length of strings in this field. If type = "BYTES", then max_length represents the maximum number of bytes in this field. It is invalid to set this field if type ≠ "STRING" and ≠ "BYTES".
             */
            maxLength?: pulumi.Input<string>;
            /**
             * [Optional] The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
             */
            mode?: pulumi.Input<string>;
            /**
             * [Required] The field name. The name must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_), and must start with a letter or underscore. The maximum length is 128 characters.
             */
            name?: pulumi.Input<string>;
            policyTags?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Optional] Precision (maximum number of total digits in base 10) and scale (maximum number of digits in the fractional part in base 10) constraints for values of this field for NUMERIC or BIGNUMERIC. It is invalid to set precision or scale if type ≠ "NUMERIC" and ≠ "BIGNUMERIC". If precision and scale are not specified, no value range constraint is imposed on this field insofar as values are permitted by the type. Values of this NUMERIC or BIGNUMERIC field must be in this range when: - Precision (P) and scale (S) are specified: [-10P-S + 10-S, 10P-S - 10-S] - Precision (P) is specified but not scale (and thus scale is interpreted to be equal to zero): [-10P + 1, 10P - 1]. Acceptable values for precision and scale if both are specified: - If type = "NUMERIC": 1 ≤ precision - scale ≤ 29 and 0 ≤ scale ≤ 9. - If type = "BIGNUMERIC": 1 ≤ precision - scale ≤ 38 and 0 ≤ scale ≤ 38. Acceptable values for precision if only precision is specified but not scale (and thus scale is interpreted to be equal to zero): - If type = "NUMERIC": 1 ≤ precision ≤ 29. - If type = "BIGNUMERIC": 1 ≤ precision ≤ 38. If scale is specified but not precision, then it is invalid.
             */
            precision?: pulumi.Input<string>;
            /**
             * [Optional] See documentation for precision.
             */
            scale?: pulumi.Input<string>;
            /**
             * [Required] The field data type. Possible values include STRING, BYTES, INTEGER, INT64 (same as INTEGER), FLOAT, FLOAT64 (same as FLOAT), NUMERIC, BIGNUMERIC, BOOLEAN, BOOL (same as BOOLEAN), TIMESTAMP, DATE, TIME, DATETIME, INTERVAL, RECORD (where RECORD indicates that the field contains a nested schema) or STRUCT (same as RECORD).
             */
            type?: pulumi.Input<string>;
        }
        interface TableReference {
            /**
             * [Required] The ID of the dataset containing this table.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the project containing this table.
             */
            projectId?: pulumi.Input<string>;
            /**
             * [Required] The ID of the table. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters.
             */
            tableId?: pulumi.Input<string>;
        }
        interface TableSchema {
            /**
             * Describes the fields in a table.
             */
            fields?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.TableFieldSchema>[]>;
        }
        interface TimePartitioning {
            /**
             * [Optional] Number of milliseconds for which to keep the storage for partitions in the table. The storage in a partition will have an expiration time of its partition time plus this value.
             */
            expirationMs?: pulumi.Input<string>;
            /**
             * [Beta] [Optional] If not set, the table is partitioned by pseudo column, referenced via either '_PARTITIONTIME' as TIMESTAMP type, or '_PARTITIONDATE' as DATE type. If field is specified, the table is instead partitioned by this field. The field must be a top-level TIMESTAMP or DATE field. Its mode must be NULLABLE or REQUIRED.
             */
            field?: pulumi.Input<string>;
            requirePartitionFilter?: pulumi.Input<boolean>;
            /**
             * [Required] The supported types are DAY, HOUR, MONTH, and YEAR, which will generate one partition per day, hour, month, and year, respectively. When the type is not specified, the default behavior is DAY.
             */
            type?: pulumi.Input<string>;
        }
        interface TransactionInfo {
            /**
             * [Output-only] // [Alpha] Id of the transaction.
             */
            transactionId?: pulumi.Input<string>;
        }
        /**
         * This is used for defining User Defined Function (UDF) resources only when using legacy SQL. Users of Standard SQL should leverage either DDL (e.g. CREATE [TEMPORARY] FUNCTION ... ) or the Routines API to define UDF resources. For additional information on migrating, see: https://cloud.google.com/bigquery/docs/reference/standard-sql/migrating-from-legacy-sql#differences_in_user-defined_javascript_functions
         */
        interface UserDefinedFunctionResource {
            /**
             * [Pick one] An inline resource that contains code for a user-defined function (UDF). Providing a inline code resource is equivalent to providing a URI for a file containing the same code.
             */
            inlineCode?: pulumi.Input<string>;
            /**
             * [Pick one] A code resource to load from a Google Cloud Storage URI (gs://bucket/path).
             */
            resourceUri?: pulumi.Input<string>;
        }
        interface ViewDefinition {
            /**
             * [Required] A query that BigQuery executes when the view is referenced.
             */
            query?: pulumi.Input<string>;
            /**
             * Specifies whether to use BigQuery's legacy SQL for this view. The default value is true. If set to false, the view will use BigQuery's standard SQL: https://cloud.google.com/bigquery/sql-reference/ Queries and views that reference this view must use the same flag value.
             */
            useLegacySql?: pulumi.Input<boolean>;
            /**
             * Describes user-defined function resources used in the query.
             */
            userDefinedFunctionResources?: pulumi.Input<pulumi.Input<inputs.bigquery.v2.UserDefinedFunctionResource>[]>;
        }
    }
}
export declare namespace bigqueryconnection {
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.bigqueryconnection.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.bigqueryconnection.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Credential info for the Cloud SQL.
         */
        interface CloudSqlCredential {
            /**
             * The password for the credential.
             */
            password?: pulumi.Input<string>;
            /**
             * The username for the credential.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Connection properties specific to the Cloud SQL.
         */
        interface CloudSqlProperties {
            /**
             * Input only. Cloud SQL credential.
             */
            credential?: pulumi.Input<inputs.bigqueryconnection.v1beta1.CloudSqlCredential>;
            /**
             * Database name.
             */
            database?: pulumi.Input<string>;
            /**
             * Cloud SQL instance ID in the form `project:location:instance`.
             */
            instanceId?: pulumi.Input<string>;
            /**
             * Type of the Cloud SQL database.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace bigquerydatatransfer {
    namespace v1 {
        /**
         * Represents preferences for sending email notifications for transfer run events.
         */
        interface EmailPreferences {
            /**
             * If true, email notifications will be sent on transfer run failures.
             */
            enableFailureEmail?: pulumi.Input<boolean>;
        }
        /**
         * Options customizing the data transfer schedule.
         */
        interface ScheduleOptions {
            /**
             * If true, automatic scheduling of data transfer runs for this configuration will be disabled. The runs can be started on ad-hoc basis using StartManualTransferRuns API. When automatic scheduling is disabled, the TransferConfig.schedule field will be ignored.
             */
            disableAutoScheduling?: pulumi.Input<boolean>;
            /**
             * Defines time to stop scheduling transfer runs. A transfer run cannot be scheduled at or after the end time. The end time can be changed at any moment. The time when a data transfer can be trigerred manually is not limited by this option.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Specifies time to start scheduling transfer runs. The first run will be scheduled at or after the start time according to a recurrence pattern defined in the schedule string. The start time can be changed at any moment. The time when a data transfer can be trigerred manually is not limited by this option.
             */
            startTime?: pulumi.Input<string>;
        }
    }
}
export declare namespace bigqueryreservation {
    namespace v1 {
    }
    namespace v1beta1 {
    }
}
export declare namespace bigtableadmin {
    namespace v2 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.bigtableadmin.v2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.bigtableadmin.v2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Cloud Key Management Service (Cloud KMS) settings for a CMEK-protected cluster.
         */
        interface EncryptionConfig {
            /**
             * Describes the Cloud KMS encryption key that will be used to protect the destination Bigtable cluster. The requirements for this key are: 1) The Cloud Bigtable service account associated with the project that contains this cluster must be granted the `cloudkms.cryptoKeyEncrypterDecrypter` role on the CMEK key. 2) Only regional keys can be used and the region of the CMEK key must match the region of the cluster. 3) All clusters within an instance must use the same CMEK key. Values are of the form `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{key}`
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability.
         */
        interface MultiClusterRoutingUseAny {
        }
        /**
         * Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability.
         */
        interface SingleClusterRouting {
            /**
             * Whether or not `CheckAndMutateRow` and `ReadModifyWriteRow` requests are allowed by this app profile. It is unsafe to send these requests to the same table/row/column in multiple clusters.
             */
            allowTransactionalWrites?: pulumi.Input<boolean>;
            /**
             * The cluster to which read/write requests should be routed.
             */
            clusterId?: pulumi.Input<string>;
        }
        /**
         * An initial split point for a newly created table.
         */
        interface Split {
            /**
             * Row key to use as an initial tablet boundary.
             */
            key?: pulumi.Input<string>;
        }
    }
}
export declare namespace billingbudgets {
    namespace v1 {
        /**
         * The budgeted amount for each usage period.
         */
        interface GoogleCloudBillingBudgetsV1BudgetAmount {
            /**
             * Use the last period's actual spend as the budget for the present period. Cannot be set in combination with Filter.custom_period.
             */
            lastPeriodAmount?: pulumi.Input<inputs.billingbudgets.v1.GoogleCloudBillingBudgetsV1LastPeriodAmount>;
            /**
             * A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
             */
            specifiedAmount?: pulumi.Input<inputs.billingbudgets.v1.GoogleTypeMoney>;
        }
        /**
         * All date times begin at 12 AM US and Canadian Pacific Time (UTC-8).
         */
        interface GoogleCloudBillingBudgetsV1CustomPeriod {
            /**
             * Optional. The end date of the time period. Budgets with elapsed end date won't be processed. If unset, specifies to track all usage incurred since the start_date.
             */
            endDate?: pulumi.Input<inputs.billingbudgets.v1.GoogleTypeDate>;
            /**
             * Required. The start date must be after January 1, 2017.
             */
            startDate?: pulumi.Input<inputs.billingbudgets.v1.GoogleTypeDate>;
        }
        /**
         * A filter for a budget, limiting the scope of the cost to calculate.
         */
        interface GoogleCloudBillingBudgetsV1Filter {
            /**
             * Optional. Specifies to track usage for recurring calendar period. E.g. Assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when current calendar month is July, August, September, and so on.
             */
            calendarPeriod?: pulumi.Input<string>;
            /**
             * Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type).
             */
            creditTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. If not set, default behavior is `INCLUDE_ALL_CREDITS`.
             */
            creditTypesTreatment?: pulumi.Input<string>;
            /**
             * Optional. Specifies to track usage from any start date (required) to any end date (optional).
             */
            customPeriod?: pulumi.Input<inputs.billingbudgets.v1.GoogleCloudBillingBudgetsV1CustomPeriod>;
            /**
             * Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
             */
            projects?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
             */
            services?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If the field is omitted, the report will include usage from the parent account and all subaccounts, if they exist.
             */
            subaccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Describes a budget amount targeted to last period's spend. At this time, the amount is automatically 100% of last period's spend; that is, there are no other options yet. Future configuration will be described here (for example, configuring a percentage of last period's spend).
         */
        interface GoogleCloudBillingBudgetsV1LastPeriodAmount {
        }
        /**
         * NotificationsRule defines notifications that are sent based on budget spend and thresholds.
         */
        interface GoogleCloudBillingBudgetsV1NotificationsRule {
            /**
             * Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
             */
            disableDefaultIamRecipients?: pulumi.Input<boolean>;
            /**
             * Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
             */
            monitoringNotificationChannels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets#manage-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details on Pub/Sub roles and permissions.
             */
            pubsubTopic?: pulumi.Input<string>;
            /**
             * Optional. Required when NotificationsRule.pubsub_topic is set. The schema version of the notification sent to NotificationsRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
             */
            schemaVersion?: pulumi.Input<string>;
        }
        /**
         * ThresholdRule contains a definition of a threshold which triggers an alert (a notification of a threshold being crossed) to be sent when spend goes above the specified amount. Alerts are automatically e-mailed to users with the Billing Account Administrator role or the Billing Account User role. The thresholds here have no effect on notifications sent to anything configured under `Budget.all_updates_rule`.
         */
        interface GoogleCloudBillingBudgetsV1ThresholdRule {
            /**
             * Optional. The type of basis used to determine if spend has passed the threshold. Behavior defaults to CURRENT_SPEND if not set.
             */
            spendBasis?: pulumi.Input<string>;
            /**
             * Required. Send an alert when this threshold is exceeded. This is a 1.0-based percentage, so 0.5 = 50%. Validation: non-negative number.
             */
            thresholdPercent?: pulumi.Input<number>;
        }
        /**
         * Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
         */
        interface GoogleTypeDate {
            /**
             * Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
             */
            day?: pulumi.Input<number>;
            /**
             * Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
             */
            month?: pulumi.Input<number>;
            /**
             * Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             */
            year?: pulumi.Input<number>;
        }
        /**
         * Represents an amount of money with its currency type.
         */
        interface GoogleTypeMoney {
            /**
             * The three-letter currency code defined in ISO 4217.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
             */
            nanos?: pulumi.Input<number>;
            /**
             * The whole units of the amount. For example if `currencyCode` is `"USD"`, then 1 unit is one US dollar.
             */
            units?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * AllUpdatesRule defines notifications that are sent based on budget spend and thresholds.
         */
        interface GoogleCloudBillingBudgetsV1beta1AllUpdatesRule {
            /**
             * Optional. When set to true, disables default notifications sent when a threshold is exceeded. Default notifications are sent to those with Billing Account Administrator and Billing Account User IAM roles for the target account.
             */
            disableDefaultIamRecipients?: pulumi.Input<boolean>;
            /**
             * Optional. Targets to send notifications to when a threshold is exceeded. This is in addition to default recipients who have billing account IAM roles. The value is the full REST resource name of a monitoring notification channel with the form `projects/{project_id}/notificationChannels/{channel_id}`. A maximum of 5 channels are allowed. See https://cloud.google.com/billing/docs/how-to/budgets-notification-recipients for more details.
             */
            monitoringNotificationChannels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The name of the Pub/Sub topic where budget related messages will be published, in the form `projects/{project_id}/topics/{topic_id}`. Updates are sent at regular intervals to the topic. The topic needs to be created before the budget is created; see https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications for more details. Caller is expected to have `pubsub.topics.setIamPolicy` permission on the topic when it's set for a budget, otherwise, the API call will fail with PERMISSION_DENIED. See https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#permissions_required_for_this_task for more details on Pub/Sub roles and permissions.
             */
            pubsubTopic?: pulumi.Input<string>;
            /**
             * Optional. Required when AllUpdatesRule.pubsub_topic is set. The schema version of the notification sent to AllUpdatesRule.pubsub_topic. Only "1.0" is accepted. It represents the JSON schema as defined in https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications#notification_format.
             */
            schemaVersion?: pulumi.Input<string>;
        }
        /**
         * The budgeted amount for each usage period.
         */
        interface GoogleCloudBillingBudgetsV1beta1BudgetAmount {
            /**
             * Use the last period's actual spend as the budget for the present period. Cannot be set in combination with Filter.custom_period.
             */
            lastPeriodAmount?: pulumi.Input<inputs.billingbudgets.v1beta1.GoogleCloudBillingBudgetsV1beta1LastPeriodAmount>;
            /**
             * A specified amount to use as the budget. `currency_code` is optional. If specified when creating a budget, it must match the currency of the billing account. If specified when updating a budget, it must match the currency_code of the existing budget. The `currency_code` is provided on output.
             */
            specifiedAmount?: pulumi.Input<inputs.billingbudgets.v1beta1.GoogleTypeMoney>;
        }
        /**
         * All date times begin at 12 AM US and Canadian Pacific Time (UTC-8).
         */
        interface GoogleCloudBillingBudgetsV1beta1CustomPeriod {
            /**
             * Optional. The end date of the time period. Budgets with elapsed end date won't be processed. If unset, specifies to track all usage incurred since the start_date.
             */
            endDate?: pulumi.Input<inputs.billingbudgets.v1beta1.GoogleTypeDate>;
            /**
             * Required. The start date must be after January 1, 2017.
             */
            startDate?: pulumi.Input<inputs.billingbudgets.v1beta1.GoogleTypeDate>;
        }
        /**
         * A filter for a budget, limiting the scope of the cost to calculate.
         */
        interface GoogleCloudBillingBudgetsV1beta1Filter {
            /**
             * Optional. Specifies to track usage for recurring calendar period. E.g. Assume that CalendarPeriod.QUARTER is set. The budget will track usage from April 1 to June 30, when current calendar month is April, May, June. After that, it will track usage from July 1 to September 30 when current calendar month is July, August, September, and so on.
             */
            calendarPeriod?: pulumi.Input<string>;
            /**
             * Optional. If Filter.credit_types_treatment is INCLUDE_SPECIFIED_CREDITS, this is a list of credit types to be subtracted from gross cost to determine the spend for threshold calculations. If Filter.credit_types_treatment is **not** INCLUDE_SPECIFIED_CREDITS, this field must be empty. See [a list of acceptable credit type values](https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#credits-type).
             */
            creditTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. If not set, default behavior is `INCLUDE_ALL_CREDITS`.
             */
            creditTypesTreatment?: pulumi.Input<string>;
            /**
             * Optional. Specifies to track usage from any start date (required) to any end date (optional).
             */
            customPeriod?: pulumi.Input<inputs.billingbudgets.v1beta1.GoogleCloudBillingBudgetsV1beta1CustomPeriod>;
            /**
             * Optional. A single label and value pair specifying that usage from only this set of labeled resources should be included in the budget. Currently, multiple entries or multiple values per entry are not allowed. If omitted, the report will include all labeled and unlabeled usage.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. A set of projects of the form `projects/{project}`, specifying that usage from only this set of projects should be included in the budget. If omitted, the report will include all usage for the billing account, regardless of which project the usage occurred on. Only zero or one project can be specified currently.
             */
            projects?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A set of services of the form `services/{service_id}`, specifying that usage from only this set of services should be included in the budget. If omitted, the report will include usage for all the services. The service names are available through the Catalog API: https://cloud.google.com/billing/v1/how-tos/catalog-api.
             */
            services?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A set of subaccounts of the form `billingAccounts/{account_id}`, specifying that usage from only this set of subaccounts should be included in the budget. If a subaccount is set to the name of the parent account, usage from the parent account will be included. If omitted, the report will include usage from the parent account and all subaccounts, if they exist.
             */
            subaccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Describes a budget amount targeted to last period's spend. At this time, the amount is automatically 100% of last period's spend; that is, there are no other options yet. Future configuration will be described here (for example, configuring a percentage of last period's spend).
         */
        interface GoogleCloudBillingBudgetsV1beta1LastPeriodAmount {
        }
        /**
         * ThresholdRule contains a definition of a threshold which triggers an alert (a notification of a threshold being crossed) to be sent when spend goes above the specified amount. Alerts are automatically e-mailed to users with the Billing Account Administrator role or the Billing Account User role. The thresholds here have no effect on notifications sent to anything configured under `Budget.all_updates_rule`.
         */
        interface GoogleCloudBillingBudgetsV1beta1ThresholdRule {
            /**
             * Optional. The type of basis used to determine if spend has passed the threshold. Behavior defaults to CURRENT_SPEND if not set.
             */
            spendBasis?: pulumi.Input<string>;
            /**
             * Required. Send an alert when this threshold is exceeded. This is a 1.0-based percentage, so 0.5 = 50%. Validation: non-negative number.
             */
            thresholdPercent?: pulumi.Input<number>;
        }
        /**
         * Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
         */
        interface GoogleTypeDate {
            /**
             * Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
             */
            day?: pulumi.Input<number>;
            /**
             * Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
             */
            month?: pulumi.Input<number>;
            /**
             * Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             */
            year?: pulumi.Input<number>;
        }
        /**
         * Represents an amount of money with its currency type.
         */
        interface GoogleTypeMoney {
            /**
             * The three-letter currency code defined in ISO 4217.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
             */
            nanos?: pulumi.Input<number>;
            /**
             * The whole units of the amount. For example if `currencyCode` is `"USD"`, then 1 unit is one US dollar.
             */
            units?: pulumi.Input<string>;
        }
    }
}
export declare namespace binaryauthorization {
    namespace v1 {
        /**
         * An attestor public key that will be used to verify attestations signed by this attestor.
         */
        interface AttestorPublicKey {
            /**
             * ASCII-armored representation of a PGP public key, as the entire output by the command `gpg --export --armor foo@example.com` (either LF or CRLF line endings). When using this field, `id` should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If `id` is provided by the caller, it will be overwritten by the API-calculated ID.
             */
            asciiArmoredPgpPublicKey?: pulumi.Input<string>;
            /**
             * Optional. A descriptive comment. This field may be updated.
             */
            comment?: pulumi.Input<string>;
            /**
             * The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on `public_key` cases below for details.
             */
            id?: pulumi.Input<string>;
            /**
             * A raw PKIX SubjectPublicKeyInfo format public key. NOTE: `id` may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If `id` is left blank, a default one will be computed based on the digest of the DER encoding of the public key.
             */
            pkixPublicKey?: pulumi.Input<inputs.binaryauthorization.v1.PkixPublicKey>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.binaryauthorization.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.
         */
        interface PkixPublicKey {
            /**
             * A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13
             */
            publicKeyPem?: pulumi.Input<string>;
            /**
             * The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in `public_key_pem` (i.e. this algorithm must match that of the public key).
             */
            signatureAlgorithm?: pulumi.Input<string>;
        }
        /**
         * An user owned Grafeas note references a Grafeas Attestation.Authority Note created by the user.
         */
        interface UserOwnedGrafeasNote {
            /**
             * Required. The Grafeas resource name of a Attestation.Authority Note, created by the user, in the format: `projects/*&#47;notes/*`. This field may not be updated. An attestation by this attestor is stored as a Grafeas Attestation.Authority Occurrence that names a container image and that links to this Note. Grafeas is an external dependency.
             */
            noteReference?: pulumi.Input<string>;
            /**
             * Optional. Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist.
             */
            publicKeys?: pulumi.Input<pulumi.Input<inputs.binaryauthorization.v1.AttestorPublicKey>[]>;
        }
    }
    namespace v1beta1 {
        /**
         * An attestor public key that will be used to verify attestations signed by this attestor.
         */
        interface AttestorPublicKey {
            /**
             * ASCII-armored representation of a PGP public key, as the entire output by the command `gpg --export --armor foo@example.com` (either LF or CRLF line endings). When using this field, `id` should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If `id` is provided by the caller, it will be overwritten by the API-calculated ID.
             */
            asciiArmoredPgpPublicKey?: pulumi.Input<string>;
            /**
             * Optional. A descriptive comment. This field may be updated.
             */
            comment?: pulumi.Input<string>;
            /**
             * The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on `public_key` cases below for details.
             */
            id?: pulumi.Input<string>;
            /**
             * A raw PKIX SubjectPublicKeyInfo format public key. NOTE: `id` may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If `id` is left blank, a default one will be computed based on the digest of the DER encoding of the public key.
             */
            pkixPublicKey?: pulumi.Input<inputs.binaryauthorization.v1beta1.PkixPublicKey>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.binaryauthorization.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.
         */
        interface PkixPublicKey {
            /**
             * A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13
             */
            publicKeyPem?: pulumi.Input<string>;
            /**
             * The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in `public_key_pem` (i.e. this algorithm must match that of the public key).
             */
            signatureAlgorithm?: pulumi.Input<string>;
        }
        /**
         * An user owned drydock note references a Drydock ATTESTATION_AUTHORITY Note created by the user.
         */
        interface UserOwnedDrydockNote {
            /**
             * Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note, created by the user, in the format: `projects/*&#47;notes/*` (or the legacy `providers/*&#47;notes/*`). This field may not be updated. An attestation by this attestor is stored as a Drydock ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note. Drydock is an external dependency.
             */
            noteReference?: pulumi.Input<string>;
            /**
             * Optional. Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist.
             */
            publicKeys?: pulumi.Input<pulumi.Input<inputs.binaryauthorization.v1beta1.AttestorPublicKey>[]>;
        }
    }
}
export declare namespace cloudasset {
    namespace v1 {
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Output configuration for asset feed destination.
         */
        interface FeedOutputConfig {
            /**
             * Destination on Pub/Sub.
             */
            pubsubDestination?: pulumi.Input<inputs.cloudasset.v1.PubsubDestination>;
        }
        /**
         * A Pub/Sub destination.
         */
        interface PubsubDestination {
            /**
             * The name of the Pub/Sub topic to publish to. Example: `projects/PROJECT_ID/topics/TOPIC_ID`.
             */
            topic?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudbilling {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudbilling.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudbilling.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudbuild {
    namespace v1 {
        /**
         * Files in the workspace to upload to Cloud Storage upon successful completion of all build steps.
         */
        interface ArtifactObjects {
            /**
             * Cloud Storage bucket and optional object path, in the form "gs://bucket/path/to/somewhere/". (see [Bucket Name Requirements](https://cloud.google.com/storage/docs/bucket-naming#requirements)). Files in the workspace matching any path pattern will be uploaded to Cloud Storage with this location as a prefix.
             */
            location?: pulumi.Input<string>;
            /**
             * Path globs used to match files in the build's workspace.
             */
            paths?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Artifacts produced by a build that should be uploaded upon successful completion of all build steps.
         */
        interface Artifacts {
            /**
             * A list of images to be pushed upon the successful completion of all build steps. The images will be pushed using the builder service account's credentials. The digests of the pushed images will be stored in the Build resource's results field. If any of the images fail to be pushed, the build is marked FAILURE.
             */
            images?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of objects to be uploaded to Cloud Storage upon successful completion of all build steps. Files in the workspace matching specified paths globs will be uploaded to the specified Cloud Storage location using the builder service account's credentials. The location and generation of the uploaded objects will be stored in the Build resource's results field. If any objects fail to be pushed, the build is marked FAILURE.
             */
            objects?: pulumi.Input<inputs.cloudbuild.v1.ArtifactObjects>;
        }
        /**
         * A build resource in the Cloud Build API. At a high level, a `Build` describes where to find source code, how to build it (for example, the builder image to run on the source), and where to store the built artifacts. Fields can include the following variables, which will be expanded when the build is created: - $PROJECT_ID: the project ID of the build. - $PROJECT_NUMBER: the project number of the build. - $BUILD_ID: the autogenerated ID of the build. - $REPO_NAME: the source repository name specified by RepoSource. - $BRANCH_NAME: the branch name specified by RepoSource. - $TAG_NAME: the tag name specified by RepoSource. - $REVISION_ID or $COMMIT_SHA: the commit SHA specified by RepoSource or resolved from the specified branch or tag. - $SHORT_SHA: first 7 characters of $REVISION_ID or $COMMIT_SHA.
         */
        interface Build {
            /**
             * Artifacts produced by the build that should be uploaded upon successful completion of all build steps.
             */
            artifacts?: pulumi.Input<inputs.cloudbuild.v1.Artifacts>;
            /**
             * Secrets and secret environment variables.
             */
            availableSecrets?: pulumi.Input<inputs.cloudbuild.v1.Secrets>;
            /**
             * A list of images to be pushed upon the successful completion of all build steps. The images are pushed using the builder service account's credentials. The digests of the pushed images will be stored in the `Build` resource's results field. If any of the images fail to be pushed, the build status is marked `FAILURE`.
             */
            images?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Google Cloud Storage bucket where logs should be written (see [Bucket Name Requirements](https://cloud.google.com/storage/docs/bucket-naming#requirements)). Logs file names will be of the format `${logs_bucket}/log-${build_id}.txt`.
             */
            logsBucket?: pulumi.Input<string>;
            /**
             * Special options for this build.
             */
            options?: pulumi.Input<inputs.cloudbuild.v1.BuildOptions>;
            /**
             * TTL in queue for this build. If provided and the build is enqueued longer than this value, the build will expire and the build status will be `EXPIRED`. The TTL starts ticking from create_time.
             */
            queueTtl?: pulumi.Input<string>;
            /**
             * Secrets to decrypt using Cloud Key Management Service. Note: Secret Manager is the recommended technique for managing sensitive data with Cloud Build. Use `available_secrets` to configure builds to access secrets from Secret Manager. For instructions, see: https://cloud.google.com/cloud-build/docs/securing-builds/use-secrets
             */
            secrets?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.Secret>[]>;
            /**
             * IAM service account whose credentials will be used at build runtime. Must be of the format `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. ACCOUNT can be email address or uniqueId of the service account. This field is in beta.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * The location of the source files to build.
             */
            source?: pulumi.Input<inputs.cloudbuild.v1.Source>;
            /**
             * Required. The operations to be performed on the workspace.
             */
            steps?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.BuildStep>[]>;
            /**
             * Substitutions data for `Build` resource.
             */
            substitutions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Tags for annotation of a `Build`. These are not docker tags.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be `TIMEOUT`. `timeout` starts ticking from `startTime`. Default time is ten minutes.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * Optional arguments to enable specific features of builds.
         */
        interface BuildOptions {
            /**
             * Requested disk size for the VM that runs the build. Note that this is *NOT* "disk free"; some of the space will be used by the operating system and build utilities. Also note that this is the minimum disk size that will be allocated for the build -- the build may run with a larger disk than requested. At present, the maximum disk size is 1000GB; builds that request more than the maximum are rejected with an error.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Option to specify whether or not to apply bash style string operations to the substitutions. NOTE: this is always enabled for triggered builds and cannot be overridden in the build configuration file.
             */
            dynamicSubstitutions?: pulumi.Input<boolean>;
            /**
             * A list of global environment variable definitions that will exist for all build steps in this build. If a variable is defined in both globally and in a build step, the variable will use the build step value. The elements are of the form "KEY=VALUE" for the environment variable "KEY" being given the value "VALUE".
             */
            env?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Option to define build log streaming behavior to Google Cloud Storage.
             */
            logStreamingOption?: pulumi.Input<string>;
            /**
             * Option to specify the logging mode, which determines if and where build logs are stored.
             */
            logging?: pulumi.Input<string>;
            /**
             * Compute Engine machine type on which to run the build.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Requested verifiability options.
             */
            requestedVerifyOption?: pulumi.Input<string>;
            /**
             * A list of global environment variables, which are encrypted using a Cloud Key Management Service crypto key. These values must be specified in the build's `Secret`. These variables will be available to all build steps in this build.
             */
            secretEnv?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Requested hash for SourceProvenance.
             */
            sourceProvenanceHash?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Option to specify behavior when there is an error in the substitution checks. NOTE: this is always set to ALLOW_LOOSE for triggered builds and cannot be overridden in the build configuration file.
             */
            substitutionOption?: pulumi.Input<string>;
            /**
             * Global list of volumes to mount for ALL build steps Each volume is created as an empty volume prior to starting the build process. Upon completion of the build, volumes and their contents are discarded. Global volume names and paths cannot conflict with the volumes defined a build step. Using a global volume in a build with only one step is not valid as it is indicative of a build request with an incorrect configuration.
             */
            volumes?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.Volume>[]>;
            /**
             * Option to specify a `WorkerPool` for the build. Format: projects/{project}/locations/{location}/workerPools/{workerPool} This field is in beta and is available only to restricted users.
             */
            workerPool?: pulumi.Input<string>;
        }
        /**
         * A step in the build pipeline.
         */
        interface BuildStep {
            /**
             * A list of arguments that will be presented to the step when it is started. If the image used to run the step's container has an entrypoint, the `args` are used as arguments to that entrypoint. If the image does not define an entrypoint, the first element in args is used as the entrypoint, and the remainder will be used as arguments.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Working directory to use when running this step's container. If this value is a relative path, it is relative to the build's working directory. If this value is absolute, it may be outside the build's working directory, in which case the contents of the path may not be persisted across build step executions, unless a `volume` for that path is specified. If the build specifies a `RepoSource` with `dir` and a step with a `dir`, which specifies an absolute path, the `RepoSource` `dir` is ignored for the step's execution.
             */
            dir?: pulumi.Input<string>;
            /**
             * Entrypoint to be used instead of the build step image's default entrypoint. If unset, the image's default entrypoint is used.
             */
            entrypoint?: pulumi.Input<string>;
            /**
             * A list of environment variable definitions to be used when running a step. The elements are of the form "KEY=VALUE" for the environment variable "KEY" being given the value "VALUE".
             */
            env?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Unique identifier for this build step, used in `wait_for` to reference this build step as a dependency.
             */
            id?: pulumi.Input<string>;
            /**
             * Required. The name of the container image that will run this particular build step. If the image is available in the host's Docker daemon's cache, it will be run directly. If not, the host will attempt to pull the image first, using the builder service account's credentials if necessary. The Docker daemon's cache will already have the latest versions of all of the officially supported build steps ([https://github.com/GoogleCloudPlatform/cloud-builders](https://github.com/GoogleCloudPlatform/cloud-builders)). The Docker daemon will also have cached many of the layers for some popular images, like "ubuntu", "debian", but they will be refreshed at the time you attempt to use them. If you built an image in a previous build step, it will be stored in the host's Docker daemon's cache and is available to use as the name for a later build step.
             */
            name?: pulumi.Input<string>;
            /**
             * A list of environment variables which are encrypted using a Cloud Key Management Service crypto key. These values must be specified in the build's `Secret`.
             */
            secretEnv?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Time limit for executing this build step. If not defined, the step has no time limit and will be allowed to continue to run until either it completes or the build itself times out.
             */
            timeout?: pulumi.Input<string>;
            /**
             * List of volumes to mount into the build step. Each volume is created as an empty volume prior to execution of the build step. Upon completion of the build, volumes and their contents are discarded. Using a named volume in only one step is not valid as it is indicative of a build request with an incorrect configuration.
             */
            volumes?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.Volume>[]>;
            /**
             * The ID(s) of the step(s) that this build step depends on. This build step will not start until all the build steps in `wait_for` have completed successfully. If `wait_for` is empty, this build step will start when all previous build steps in the `Build.Steps` list have completed successfully.
             */
            waitFor?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * GitHubEventsConfig describes the configuration of a trigger that creates a build whenever a GitHub event is received. This message is experimental.
         */
        interface GitHubEventsConfig {
            /**
             * The installationID that emits the GitHub event.
             */
            installationId?: pulumi.Input<string>;
            /**
             * Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
             */
            name?: pulumi.Input<string>;
            /**
             * Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
             */
            owner?: pulumi.Input<string>;
            /**
             * filter to match changes in pull requests.
             */
            pullRequest?: pulumi.Input<inputs.cloudbuild.v1.PullRequestFilter>;
            /**
             * filter to match changes in refs like branches, tags.
             */
            push?: pulumi.Input<inputs.cloudbuild.v1.PushFilter>;
        }
        /**
         * Pairs a set of secret environment variables mapped to encrypted values with the Cloud KMS key to use to decrypt the value.
         */
        interface InlineSecret {
            /**
             * Map of environment variable name to its encrypted value. Secret environment variables must be unique across all of a build's secrets, and must be used by at least one build step. Values can be at most 64 KB in size. There can be at most 100 secret values across all of a build's secrets.
             */
            envMap?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Resource name of Cloud KMS crypto key to decrypt the encrypted value. In format: projects/*&#47;locations/*&#47;keyRings/*&#47;cryptoKeys/*
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * PullRequestFilter contains filter properties for matching GitHub Pull Requests.
         */
        interface PullRequestFilter {
            /**
             * Regex of branches to match. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
             */
            branch?: pulumi.Input<string>;
            /**
             * Configure builds to run whether a repository owner or collaborator need to comment `/gcbrun`.
             */
            commentControl?: pulumi.Input<string>;
            /**
             * If true, branches that do NOT match the git_ref will trigger a build.
             */
            invertRegex?: pulumi.Input<boolean>;
        }
        /**
         * Push contains filter properties for matching GitHub git pushes.
         */
        interface PushFilter {
            /**
             * Regexes matching branches to build. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
             */
            branch?: pulumi.Input<string>;
            /**
             * When true, only trigger a build if the revision regex does NOT match the git_ref regex.
             */
            invertRegex?: pulumi.Input<boolean>;
            /**
             * Regexes matching tags to build. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
             */
            tag?: pulumi.Input<string>;
        }
        /**
         * Location of the source in a Google Cloud Source Repository.
         */
        interface RepoSource {
            /**
             * Regex matching branches to build. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
             */
            branchName?: pulumi.Input<string>;
            /**
             * Explicit commit SHA to build.
             */
            commitSha?: pulumi.Input<string>;
            /**
             * Directory, relative to the source root, in which to run the build. This must be a relative path. If a step's `dir` is specified and is an absolute path, this value is ignored for that step's execution.
             */
            dir?: pulumi.Input<string>;
            /**
             * Only trigger a build if the revision regex does NOT match the revision regex.
             */
            invertRegex?: pulumi.Input<boolean>;
            /**
             * ID of the project that owns the Cloud Source Repository. If omitted, the project ID requesting the build is assumed.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Name of the Cloud Source Repository.
             */
            repoName?: pulumi.Input<string>;
            /**
             * Substitutions to use in a triggered build. Should only be used with RunBuildTrigger
             */
            substitutions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Regex matching tags to build. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
             */
            tagName?: pulumi.Input<string>;
        }
        /**
         * Pairs a set of secret environment variables containing encrypted values with the Cloud KMS key to use to decrypt the value. Note: Use `kmsKeyName` with `available_secrets` instead of using `kmsKeyName` with `secret`. For instructions see: https://cloud.google.com/cloud-build/docs/securing-builds/use-encrypted-credentials.
         */
        interface Secret {
            /**
             * Cloud KMS key name to use to decrypt these envs.
             */
            kmsKeyName?: pulumi.Input<string>;
            /**
             * Map of environment variable name to its encrypted value. Secret environment variables must be unique across all of a build's secrets, and must be used by at least one build step. Values can be at most 64 KB in size. There can be at most 100 secret values across all of a build's secrets.
             */
            secretEnv?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Pairs a secret environment variable with a SecretVersion in Secret Manager.
         */
        interface SecretManagerSecret {
            /**
             * Environment variable name to associate with the secret. Secret environment variables must be unique across all of a build's secrets, and must be used by at least one build step.
             */
            env?: pulumi.Input<string>;
            /**
             * Resource name of the SecretVersion. In format: projects/*&#47;secrets/*&#47;versions/*
             */
            versionName?: pulumi.Input<string>;
        }
        /**
         * Secrets and secret environment variables.
         */
        interface Secrets {
            /**
             * Secrets encrypted with KMS key and the associated secret environment variable.
             */
            inline?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.InlineSecret>[]>;
            /**
             * Secrets in Secret Manager and associated secret environment variable.
             */
            secretManager?: pulumi.Input<pulumi.Input<inputs.cloudbuild.v1.SecretManagerSecret>[]>;
        }
        /**
         * Location of the source in a supported storage service.
         */
        interface Source {
            /**
             * If provided, get the source from this location in a Cloud Source Repository.
             */
            repoSource?: pulumi.Input<inputs.cloudbuild.v1.RepoSource>;
            /**
             * If provided, get the source from this location in Google Cloud Storage.
             */
            storageSource?: pulumi.Input<inputs.cloudbuild.v1.StorageSource>;
            /**
             * If provided, get the source from this manifest in Google Cloud Storage. This feature is in Preview.
             */
            storageSourceManifest?: pulumi.Input<inputs.cloudbuild.v1.StorageSourceManifest>;
        }
        /**
         * Location of the source in an archive file in Google Cloud Storage.
         */
        interface StorageSource {
            /**
             * Google Cloud Storage bucket containing the source (see [Bucket Name Requirements](https://cloud.google.com/storage/docs/bucket-naming#requirements)).
             */
            bucket?: pulumi.Input<string>;
            /**
             * Google Cloud Storage generation for the object. If the generation is omitted, the latest generation will be used.
             */
            generation?: pulumi.Input<string>;
            /**
             * Google Cloud Storage object containing the source. This object must be a gzipped archive file (`.tar.gz`) containing source to build.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * Location of the source manifest in Google Cloud Storage. This feature is in Preview.
         */
        interface StorageSourceManifest {
            /**
             * Google Cloud Storage bucket containing the source manifest (see [Bucket Name Requirements](https://cloud.google.com/storage/docs/bucket-naming#requirements)).
             */
            bucket?: pulumi.Input<string>;
            /**
             * Google Cloud Storage generation for the object. If the generation is omitted, the latest generation will be used.
             */
            generation?: pulumi.Input<string>;
            /**
             * Google Cloud Storage object containing the source manifest. This object must be a JSON file.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * Volume describes a Docker container volume which is mounted into build steps in order to persist files across build step execution.
         */
        interface Volume {
            /**
             * Name of the volume to mount. Volume names must be unique per build step and must be valid names for Docker volumes. Each named volume must be used by at least two build steps.
             */
            name?: pulumi.Input<string>;
            /**
             * Path at which to mount the volume. Paths must be absolute and cannot conflict with other volume paths on the same build step or with certain reserved volume paths.
             */
            path?: pulumi.Input<string>;
        }
    }
    namespace v1alpha1 {
        /**
         * Network describes the GCP network used to create workers in.
         */
        interface Network {
            /**
             * Network on which the workers are created. "default" network is used if empty.
             */
            network?: pulumi.Input<string>;
            /**
             * Project id containing the defined network and subnetwork. For a peered VPC, this will be the same as the project_id in which the workers are created. For a shared VPC, this will be the project sharing the network with the project_id project in which workers will be created. For custom workers with no VPC, this will be the same as project_id.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Subnetwork on which the workers are created. "default" subnetwork is used if empty.
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * WorkerConfig defines the configuration to be used for a creating workers in the pool.
         */
        interface WorkerConfig {
            /**
             * Size of the disk attached to the worker, in GB. See https://cloud.google.com/compute/docs/disks/ If `0` is specified, Cloud Build will use a standard disk size. `disk_size` is overridden if you specify a different disk size in `build_options`. In this case, a VM with a disk size specified in the `build_options` will be created on demand at build time. For more information see https://cloud.google.com/cloud-build/docs/api/reference/rest/v1/projects.builds#buildoptions
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Machine Type of the worker, such as n1-standard-1. See https://cloud.google.com/compute/docs/machine-types. If left blank, Cloud Build will use a standard unspecified machine to create the worker pool. `machine_type` is overridden if you specify a different machine type in `build_options`. In this case, the VM specified in the `build_options` will be created on demand at build time. For more information see https://cloud.google.com/cloud-build/docs/speeding-up-builds#using_custom_virtual_machine_sizes
             */
            machineType?: pulumi.Input<string>;
            /**
             * The network definition used to create the worker. If this section is left empty, the workers will be created in WorkerPool.project_id on the default network.
             */
            network?: pulumi.Input<inputs.cloudbuild.v1alpha1.Network>;
            /**
             * The tag applied to the worker, and the same tag used by the firewall rule. It is used to identify the Cloud Build workers among other VMs. The default value for tag is `worker`.
             */
            tag?: pulumi.Input<string>;
        }
    }
    namespace v1alpha2 {
        /**
         * Network describes the network configuration for a `WorkerPool`.
         */
        interface NetworkConfig {
            /**
             * Required. Immutable. The network definition that the workers are peered to. If this section is left empty, the workers will be peered to WorkerPool.project_id on the default network. Must be in the format `projects/{project}/global/networks/{network}`, where {project} is a project number, such as `12345`, and {network} is the name of a VPC network in the project.
             */
            peeredNetwork?: pulumi.Input<string>;
        }
        /**
         * WorkerConfig defines the configuration to be used for a creating workers in the pool.
         */
        interface WorkerConfig {
            /**
             * Size of the disk attached to the worker, in GB. See https://cloud.google.com/compute/docs/disks/ If `0` is specified, Cloud Build will use a standard disk size.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Machine Type of the worker, such as n1-standard-1. See https://cloud.google.com/compute/docs/machine-types. If left blank, Cloud Build will use a standard unspecified machine to create the worker pool.
             */
            machineType?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Network describes the network configuration for a `WorkerPool`.
         */
        interface NetworkConfig {
            /**
             * Required. Immutable. The network definition that the workers are peered to. If this section is left empty, the workers will be peered to `WorkerPool.project_id` on the service producer network. Must be in the format `projects/{project}/global/networks/{network}`, where `{project}` is a project number, such as `12345`, and `{network}` is the name of a VPC network in the project. See [Understanding network configuration options](https://cloud.google.com/cloud-build/docs/custom-workers/set-up-custom-worker-pool-environment#understanding_the_network_configuration_options)
             */
            peeredNetwork?: pulumi.Input<string>;
        }
        /**
         * Defines the configuration to be used for creating workers in the pool.
         */
        interface WorkerConfig {
            /**
             * Size of the disk attached to the worker, in GB. See [Worker pool config file](https://cloud.google.com/cloud-build/docs/custom-workers/worker-pool-config-file). Specify a value of up to 1000. If `0` is specified, Cloud Build will use a standard disk size.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Machine type of a worker, such as `n1-standard-1`. See [Worker pool config file](https://cloud.google.com/cloud-build/docs/custom-workers/worker-pool-config-file). If left blank, Cloud Build will use `n1-standard-1`.
             */
            machineType?: pulumi.Input<string>;
            /**
             * If true, workers are created without any public address, which prevents network egress to public IPs.
             */
            noExternalIp?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace cloudchannel {
    namespace v1 {
        /**
         * Association links that an entitlement has to other entitlements.
         */
        interface GoogleCloudChannelV1AssociationInfo {
            /**
             * The name of the base entitlement, for which this entitlement is an add-on.
             */
            baseEntitlement?: pulumi.Input<string>;
        }
        /**
         * Commitment settings for commitment-based offers.
         */
        interface GoogleCloudChannelV1CommitmentSettings {
            /**
             * Optional. Renewal settings applicable for a commitment-based Offer.
             */
            renewalSettings?: pulumi.Input<inputs.cloudchannel.v1.GoogleCloudChannelV1RenewalSettings>;
        }
        /**
         * Contact information for a customer account.
         */
        interface GoogleCloudChannelV1ContactInfo {
            /**
             * Email of the contact in the customer account. Email is required for entitlements that need creation of admin.google.com accounts. The email will be the username used in credentials to access the admin.google.com account.
             */
            email?: pulumi.Input<string>;
            /**
             * First name of the contact in the customer account.
             */
            firstName?: pulumi.Input<string>;
            /**
             * Last name of the contact in the customer account.
             */
            lastName?: pulumi.Input<string>;
            /**
             * Phone number of the contact in the customer account.
             */
            phone?: pulumi.Input<string>;
            /**
             * Optional. Job title of the contact in the customer account.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Definition for extended entitlement parameters.
         */
        interface GoogleCloudChannelV1Parameter {
            /**
             * Name of the parameter.
             */
            name?: pulumi.Input<string>;
            /**
             * Value of the parameter.
             */
            value?: pulumi.Input<inputs.cloudchannel.v1.GoogleCloudChannelV1Value>;
        }
        /**
         * Represents period in days/months/years.
         */
        interface GoogleCloudChannelV1Period {
            /**
             * Total duration of Period Type defined.
             */
            duration?: pulumi.Input<number>;
            /**
             * Period Type.
             */
            periodType?: pulumi.Input<string>;
        }
        /**
         * Renewal settings for renewable Offers.
         */
        interface GoogleCloudChannelV1RenewalSettings {
            /**
             * If false, the plan will be completed at the end date.
             */
            enableRenewal?: pulumi.Input<boolean>;
            /**
             * Describes how frequently the reseller will be billed, such as once per month.
             */
            paymentCycle?: pulumi.Input<inputs.cloudchannel.v1.GoogleCloudChannelV1Period>;
            /**
             * Describes how a reseller will be billed.
             */
            paymentPlan?: pulumi.Input<string>;
            /**
             * If true and enable_renewal = true, the unit (for example seats or licenses) will be set to the number of active units at renewal time.
             */
            resizeUnitCount?: pulumi.Input<boolean>;
        }
        /**
         * Data type and value of a parameter.
         */
        interface GoogleCloudChannelV1Value {
            /**
             * Represents a boolean value.
             */
            boolValue?: pulumi.Input<boolean>;
            /**
             * Represents a double value.
             */
            doubleValue?: pulumi.Input<number>;
            /**
             * Represents an int64 value.
             */
            int64Value?: pulumi.Input<string>;
            /**
             * Represents an 'Any' proto value.
             */
            protoValue?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Represents a string value.
             */
            stringValue?: pulumi.Input<string>;
        }
        /**
         * Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478
         */
        interface GoogleTypePostalAddress {
            /**
             * Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be "envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
             */
            addressLines?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
             */
            administrativeArea?: pulumi.Input<string>;
            /**
             * Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address' country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: "zh-Hant", "ja", "ja-Latn", "en".
             */
            languageCode?: pulumi.Input<string>;
            /**
             * Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
             */
            locality?: pulumi.Input<string>;
            /**
             * Optional. The name of the organization at the address.
             */
            organization?: pulumi.Input<string>;
            /**
             * Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
             */
            postalCode?: pulumi.Input<string>;
            /**
             * Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain "care of" information.
             */
            recipients?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.
             */
            regionCode?: pulumi.Input<string>;
            /**
             * The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
             */
            revision?: pulumi.Input<number>;
            /**
             * Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like "CEDEX", optionally followed by a number (e.g. "CEDEX 7"), or just a number alone, representing the "sector code" (Jamaica), "delivery area indicator" (Malawi) or "post office indicator" (e.g. Côte d'Ivoire).
             */
            sortingCode?: pulumi.Input<string>;
            /**
             * Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
             */
            sublocality?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudfunctions {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudfunctions.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudfunctions.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Describes EventTrigger, used to request events be sent from another service.
         */
        interface EventTrigger {
            /**
             * Required. The type of event to observe. For example: `providers/cloud.storage/eventTypes/object.change` and `providers/cloud.pubsub/eventTypes/topic.publish`. Event types match pattern `providers/*&#47;eventTypes/*.*`. The pattern contains: 1. namespace: For example, `cloud.storage` and `google.firebase.analytics`. 2. resource type: The type of resource on which event occurs. For example, the Google Cloud Storage API includes the type `object`. 3. action: The action that generates the event. For example, action for a Google Cloud Storage Object is 'change'. These parts are lower case.
             */
            eventType?: pulumi.Input<string>;
            /**
             * Specifies policy for failed executions.
             */
            failurePolicy?: pulumi.Input<inputs.cloudfunctions.v1.FailurePolicy>;
            /**
             * Required. The resource(s) from which to observe events, for example, `projects/_/buckets/myBucket`. Not all syntactically correct values are accepted by all services. For example: 1. The authorization model must support it. Google Cloud Functions only allows EventTriggers to be deployed that observe resources in the same project as the `CloudFunction`. 2. The resource type must match the pattern expected for an `event_type`. For example, an `EventTrigger` that has an `event_type` of "google.pubsub.topic.publish" should have a resource that matches Google Cloud Pub/Sub topics. Additionally, some services may support short names when creating an `EventTrigger`. These will always be returned in the normalized "long" format. See each *service's* documentation for supported formats.
             */
            resource?: pulumi.Input<string>;
            /**
             * The hostname of the service that should be observed. If no string is provided, the default service implementing the API will be used. For example, `storage.googleapis.com` is the default for all event types in the `google.storage` namespace.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Describes the policy in case of function's execution failure. If empty, then defaults to ignoring failures (i.e. not retrying them).
         */
        interface FailurePolicy {
            /**
             * If specified, then the function will be retried in case of a failure.
             */
            retry?: pulumi.Input<inputs.cloudfunctions.v1.Retry>;
        }
        /**
         * Describes HttpsTrigger, could be used to connect web hooks to function.
         */
        interface HttpsTrigger {
            /**
             * The security level for the function.
             */
            securityLevel?: pulumi.Input<string>;
        }
        /**
         * Describes the retry policy in case of function's execution failure. A function execution will be retried on any failure. A failed execution will be retried up to 7 days with an exponential backoff (capped at 10 seconds). Retried execution is charged as any other execution.
         */
        interface Retry {
        }
        /**
         * Describes SourceRepository, used to represent parameters related to source repository where a function is hosted.
         */
        interface SourceRepository {
            /**
             * The URL pointing to the hosted repository where the function is defined. There are supported Cloud Source Repository URLs in the following formats: To refer to a specific commit: `https://source.developers.google.com/projects/*&#47;repos/*&#47;revisions/*&#47;paths/*` To refer to a moveable alias (branch): `https://source.developers.google.com/projects/*&#47;repos/*&#47;moveable-aliases/*&#47;paths/*` In particular, to refer to HEAD use `master` moveable alias. To refer to a specific fixed alias (tag): `https://source.developers.google.com/projects/*&#47;repos/*&#47;fixed-aliases/*&#47;paths/*` You may omit `paths/*` if you want to use the main directory.
             */
            url?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudidentity {
    namespace v1 {
        /**
         * Dynamic group metadata like queries and status.
         */
        interface DynamicGroupMetadata {
            /**
             * Memberships will be the union of all queries. Only one entry with USER resource is currently supported. Customers can create up to 100 dynamic groups.
             */
            queries?: pulumi.Input<pulumi.Input<inputs.cloudidentity.v1.DynamicGroupQuery>[]>;
        }
        /**
         * Defines a query on a resource.
         */
        interface DynamicGroupQuery {
            /**
             * Query that determines the memberships of the dynamic group. Examples: All users with at least one `organizations.department` of engineering. `user.organizations.exists(org, org.department=='engineering')` All users with at least one location that has `area` of `foo` and `building_id` of `bar`. `user.locations.exists(loc, loc.area=='foo' && loc.building_id=='bar')`
             */
            query?: pulumi.Input<string>;
            /**
             * Resource type for the Dynamic Group Query
             */
            resourceType?: pulumi.Input<string>;
        }
        /**
         * A unique identifier for an entity in the Cloud Identity Groups API. An entity can represent either a group with an optional `namespace` or a user without a `namespace`. The combination of `id` and `namespace` must be unique; however, the same `id` can be used with different `namespace`s.
         */
        interface EntityKey {
            /**
             * The ID of the entity. For Google-managed entities, the `id` should be the email address of an existing group or user. For external-identity-mapped entities, the `id` must be a string conforming to the Identity Source's requirements. Must be unique within a `namespace`.
             */
            id?: pulumi.Input<string>;
            /**
             * The namespace in which the entity exists. If not specified, the `EntityKey` represents a Google-managed entity such as a Google user or a Google Group. If specified, the `EntityKey` represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of `identitysources/{identity_source_id}.
             */
            namespace?: pulumi.Input<string>;
        }
        /**
         * The `MembershipRole` expiry details.
         */
        interface ExpiryDetail {
            /**
             * The time at which the `MembershipRole` will expire.
             */
            expireTime?: pulumi.Input<string>;
        }
        /**
         * A membership role within the Cloud Identity Groups API. A `MembershipRole` defines the privileges granted to a `Membership`.
         */
        interface MembershipRole {
            /**
             * The expiry details of the `MembershipRole`. Expiry details are only supported for `MEMBER` `MembershipRoles`. May be set if `name` is `MEMBER`. Must not be set if `name` is any other value.
             */
            expiryDetail?: pulumi.Input<inputs.cloudidentity.v1.ExpiryDetail>;
            /**
             * The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
             */
            name?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Dynamic group metadata like queries and status.
         */
        interface DynamicGroupMetadata {
            /**
             * Memberships will be the union of all queries. Only one entry with USER resource is currently supported. Customers can create up to 100 dynamic groups.
             */
            queries?: pulumi.Input<pulumi.Input<inputs.cloudidentity.v1beta1.DynamicGroupQuery>[]>;
        }
        /**
         * Defines a query on a resource.
         */
        interface DynamicGroupQuery {
            /**
             * Query that determines the memberships of the dynamic group. Examples: All users with at least one `organizations.department` of engineering. `user.organizations.exists(org, org.department=='engineering')` All users with at least one location that has `area` of `foo` and `building_id` of `bar`. `user.locations.exists(loc, loc.area=='foo' && loc.building_id=='bar')`
             */
            query?: pulumi.Input<string>;
            resourceType?: pulumi.Input<string>;
        }
        /**
         * A unique identifier for an entity in the Cloud Identity Groups API. An entity can represent either a group with an optional `namespace` or a user without a `namespace`. The combination of `id` and `namespace` must be unique; however, the same `id` can be used with different `namespace`s.
         */
        interface EntityKey {
            /**
             * The ID of the entity. For Google-managed entities, the `id` must be the email address of an existing group or user. For external-identity-mapped entities, the `id` must be a string conforming to the Identity Source's requirements. Must be unique within a `namespace`.
             */
            id?: pulumi.Input<string>;
            /**
             * The namespace in which the entity exists. If not specified, the `EntityKey` represents a Google-managed entity such as a Google user or a Google Group. If specified, the `EntityKey` represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of `identitysources/{identity_source_id}.
             */
            namespace?: pulumi.Input<string>;
        }
        /**
         * The `MembershipRole` expiry details.
         */
        interface ExpiryDetail {
            /**
             * The time at which the `MembershipRole` will expire.
             */
            expireTime?: pulumi.Input<string>;
        }
        /**
         * A membership role within the Cloud Identity Groups API. A `MembershipRole` defines the privileges granted to a `Membership`.
         */
        interface MembershipRole {
            /**
             * The expiry details of the `MembershipRole`. Expiry details are only supported for `MEMBER` `MembershipRoles`. May be set if `name` is `MEMBER`. Must not be set if `name` is any other value.
             */
            expiryDetail?: pulumi.Input<inputs.cloudidentity.v1beta1.ExpiryDetail>;
            /**
             * The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
             */
            name?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudiot {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudiot.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * The device configuration. Eventually delivered to devices.
         */
        interface DeviceConfig {
            /**
             * The device configuration data.
             */
            binaryData?: pulumi.Input<string>;
            /**
             * [Output only] The time at which this configuration version was updated in Cloud IoT Core. This timestamp is set by the server.
             */
            cloudUpdateTime?: pulumi.Input<string>;
            /**
             * [Output only] The time at which Cloud IoT Core received the acknowledgment from the device, indicating that the device has received this configuration version. If this field is not present, the device has not yet acknowledged that it received this version. Note that when the config was sent to the device, many config versions may have been available in Cloud IoT Core while the device was disconnected, and on connection, only the latest version is sent to the device. Some versions may never be sent to the device, and therefore are never acknowledged. This timestamp is set by Cloud IoT Core.
             */
            deviceAckTime?: pulumi.Input<string>;
            /**
             * [Output only] The version of this update. The version number is assigned by the server, and is always greater than 0 after device creation. The version must be 0 on the `CreateDevice` request if a `config` is specified; the response of `CreateDevice` will always have a value of 1.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * A server-stored device credential used for authentication.
         */
        interface DeviceCredential {
            /**
             * [Optional] The time at which this credential becomes invalid. This credential will be ignored for new client authentication requests after this timestamp; however, it will not be automatically deleted.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * A public key used to verify the signature of JSON Web Tokens (JWTs). When adding a new device credential, either via device creation or via modifications, this public key credential may be required to be signed by one of the registry level certificates. More specifically, if the registry contains at least one certificate, any new device credential must be signed by one of the registry certificates. As a result, when the registry contains certificates, only X.509 certificates are accepted as device credentials. However, if the registry does not contain a certificate, self-signed certificates and public keys will be accepted. New device credentials must be different from every registry-level certificate.
             */
            publicKey?: pulumi.Input<inputs.cloudiot.v1.PublicKeyCredential>;
        }
        /**
         * The device state, as reported by the device.
         */
        interface DeviceState {
            /**
             * The device state data.
             */
            binaryData?: pulumi.Input<string>;
            /**
             * [Output only] The time at which this state version was updated in Cloud IoT Core.
             */
            updateTime?: pulumi.Input<string>;
        }
        /**
         * The configuration for forwarding telemetry events.
         */
        interface EventNotificationConfig {
            /**
             * A Cloud Pub/Sub topic name. For example, `projects/myProject/topics/deviceEvents`.
             */
            pubsubTopicName?: pulumi.Input<string>;
            /**
             * If the subfolder name matches this string exactly, this configuration will be used. The string must not include the leading '/' character. If empty, all strings are matched. This field is used only for telemetry events; subfolders are not supported for state changes.
             */
            subfolderMatches?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Gateway-related configuration and state.
         */
        interface GatewayConfig {
            /**
             * Indicates how to authorize and/or authenticate devices to access the gateway.
             */
            gatewayAuthMethod?: pulumi.Input<string>;
            /**
             * Indicates whether the device is a gateway.
             */
            gatewayType?: pulumi.Input<string>;
            /**
             * [Output only] The ID of the gateway the device accessed most recently.
             */
            lastAccessedGatewayId?: pulumi.Input<string>;
            /**
             * [Output only] The most recent time at which the device accessed the gateway specified in `last_accessed_gateway`.
             */
            lastAccessedGatewayTime?: pulumi.Input<string>;
        }
        /**
         * The configuration of the HTTP bridge for a device registry.
         */
        interface HttpConfig {
            /**
             * If enabled, allows devices to use DeviceService via the HTTP protocol. Otherwise, any requests to DeviceService will fail for this registry.
             */
            httpEnabledState?: pulumi.Input<string>;
        }
        /**
         * The configuration of MQTT for a device registry.
         */
        interface MqttConfig {
            /**
             * If enabled, allows connections using the MQTT protocol. Otherwise, MQTT connections to this registry will fail.
             */
            mqttEnabledState?: pulumi.Input<string>;
        }
        /**
         * A public key certificate format and data.
         */
        interface PublicKeyCertificate {
            /**
             * The certificate data.
             */
            certificate?: pulumi.Input<string>;
            /**
             * The certificate format.
             */
            format?: pulumi.Input<string>;
            /**
             * [Output only] The certificate details. Used only for X.509 certificates.
             */
            x509Details?: pulumi.Input<inputs.cloudiot.v1.X509CertificateDetails>;
        }
        /**
         * A public key format and data.
         */
        interface PublicKeyCredential {
            /**
             * The format of the key.
             */
            format?: pulumi.Input<string>;
            /**
             * The key data.
             */
            key?: pulumi.Input<string>;
        }
        /**
         * A server-stored registry credential used to validate device credentials.
         */
        interface RegistryCredential {
            /**
             * A public key certificate used to verify the device credentials.
             */
            publicKeyCertificate?: pulumi.Input<inputs.cloudiot.v1.PublicKeyCertificate>;
        }
        /**
         * The configuration for notification of new states received from the device.
         */
        interface StateNotificationConfig {
            /**
             * A Cloud Pub/Sub topic name. For example, `projects/myProject/topics/deviceEvents`.
             */
            pubsubTopicName?: pulumi.Input<string>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Details of an X.509 certificate. For informational purposes only.
         */
        interface X509CertificateDetails {
            /**
             * The time the certificate becomes invalid.
             */
            expiryTime?: pulumi.Input<string>;
            /**
             * The entity that signed the certificate.
             */
            issuer?: pulumi.Input<string>;
            /**
             * The type of public key in the certificate.
             */
            publicKeyType?: pulumi.Input<string>;
            /**
             * The algorithm used to sign the certificate.
             */
            signatureAlgorithm?: pulumi.Input<string>;
            /**
             * The time the certificate becomes valid.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The entity the certificate and public key belong to.
             */
            subject?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudkms {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudkms.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudkms.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.
         */
        interface CryptoKeyVersionTemplate {
            /**
             * Required. Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
             */
            protectionLevel?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level.
         */
        interface ExternalProtectionLevelOptions {
            /**
             * The URI for an external resource that this CryptoKeyVersion represents.
             */
            externalKeyUri?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudprofiler {
    namespace v2 {
        /**
         * Deployment contains the deployment identification information.
         */
        interface Deployment {
            /**
             * Labels identify the deployment within the user universe and same target. Validation regex for label names: `^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`. Value for an individual label must be <= 512 bytes, the total size of all label names and values must be <= 1024 bytes. Label named "language" can be used to record the programming language of the profiled deployment. The standard choices for the value include "java", "go", "python", "ruby", "nodejs", "php", "dotnet". For deployments running on Google Cloud Platform, "zone" or "region" label should be present describing the deployment location. An example of a zone is "us-central1-a", an example of a region is "us-central1" or "us-central".
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Project ID is the ID of a cloud project. Validation regex: `^a-z{4,61}[a-z0-9]$`.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Target is the service name used to group related deployments: * Service name for GAE Flex / Standard. * Cluster and container name for GKE. * User-specified string for direct GCE profiling (e.g. Java). * Job name for Dataflow. Validation regex: `^[a-z]([-a-z0-9_.]{0,253}[a-z0-9])?$`.
             */
            target?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudresourcemanager {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudresourcemanager.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudresourcemanager.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A container to reference an id for any resource type. A `resource` in Google Cloud Platform is a generic term for something you (a developer) may want to interact with through one of our API's. Some examples are an App Engine app, a Compute Engine instance, a Cloud SQL database, and so on.
         */
        interface ResourceId {
            /**
             * The type-specific id. This should correspond to the id used in the type-specific API's.
             */
            id?: pulumi.Input<string>;
            /**
             * The resource type this id is for. At present, the valid types are: "organization", "folder", and "project".
             */
            type?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudresourcemanager.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudresourcemanager.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A container to reference an id for any resource type. A `resource` in Google Cloud Platform is a generic term for something you (a developer) may want to interact with through one of our API's. Some examples are an App Engine app, a Compute Engine instance, a Cloud SQL database, and so on.
         */
        interface ResourceId {
            /**
             * Required field for the type-specific id. This should correspond to the id used in the type-specific API's.
             */
            id?: pulumi.Input<string>;
            /**
             * Required field representing the resource type this id is for. At present, the valid types are "project", "folder", and "organization".
             */
            type?: pulumi.Input<string>;
        }
    }
    namespace v2 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudresourcemanager.v2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudresourcemanager.v2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v2beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudresourcemanager.v2beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudresourcemanager.v2beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v3 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.cloudresourcemanager.v3.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudresourcemanager.v3.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudscheduler {
    namespace v1 {
        /**
         * App Engine target. The job will be pushed to a job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. Error 503 is considered an App Engine system error instead of an application error. Requests returning error 503 will be retried regardless of retry configuration and not counted against retry counts. Any other response code, or a failure to receive a response before the deadline, constitutes a failed attempt.
         */
        interface AppEngineHttpTarget {
            /**
             * App Engine Routing setting for the job.
             */
            appEngineRouting?: pulumi.Input<inputs.cloudscheduler.v1.AppEngineRouting>;
            /**
             * Body. HTTP request body. A request body is allowed only if the HTTP method is POST or PUT. It will result in invalid argument error to set a body on a job with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the job is created. Cloud Scheduler sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Scheduler will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. * `X-CloudScheduler`: This header will be set to true. If the job has an body, Cloud Scheduler sets the following headers: * `Content-Type`: By default, the `Content-Type` header is set to `"application/octet-stream"`. The default can be overridden by explictly setting `Content-Type` to a particular media type when the job is created. For example, `Content-Type` can be set to `"application/json"`. * `Content-Length`: This is computed by Cloud Scheduler. This value is output only. It cannot be changed. The headers below are output only. They cannot be set or overridden: * `X-Google-*`: For Google internal use only. * `X-AppEngine-*`: For Google internal use only. In addition, some App Engine headers, which contain job-specific information, are also be sent to the job handler.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. PATCH and OPTIONS are not permitted.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * The relative URI. The relative URL must begin with "/" and must be a valid HTTP relative URL. It can contain a path, query string arguments, and `#` fragments. If the relative URL is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.
             */
            relativeUri?: pulumi.Input<string>;
        }
        /**
         * App Engine Routing. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
         */
        interface AppEngineRouting {
            /**
             * The host that the job is sent to. For more information about how App Engine requests are routed, see [here](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed). The host is constructed as: * `host = [application_domain_name]` `| [service] + '.' + [application_domain_name]` `| [version] + '.' + [application_domain_name]` `| [version_dot_service]+ '.' + [application_domain_name]` `| [instance] + '.' + [application_domain_name]` `| [instance_dot_service] + '.' + [application_domain_name]` `| [instance_dot_version] + '.' + [application_domain_name]` `| [instance_dot_version_dot_service] + '.' + [application_domain_name]` * `application_domain_name` = The domain name of the app, for example .appspot.com, which is associated with the job's project ID. * `service =` service * `version =` version * `version_dot_service =` version `+ '.' +` service * `instance =` instance * `instance_dot_service =` instance `+ '.' +` service * `instance_dot_version =` instance `+ '.' +` version * `instance_dot_version_dot_service =` instance `+ '.' +` version `+ '.' +` service If service is empty, then the job will be sent to the service which is the default service when the job is attempted. If version is empty, then the job will be sent to the version which is the default version when the job is attempted. If instance is empty, then the job will be sent to an instance which is available when the job is attempted. If service, version, or instance is invalid, then the job will be sent to the default version of the default service when the job is attempted.
             */
            host?: pulumi.Input<string>;
            /**
             * App instance. By default, the job is sent to an instance which is available when the job is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?hl=en_US#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
             */
            instance?: pulumi.Input<string>;
            /**
             * App service. By default, the job is sent to the service which is the default service when the job is attempted.
             */
            service?: pulumi.Input<string>;
            /**
             * App version. By default, the job is sent to the version which is the default version when the job is attempted.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Http target. The job will be pushed to the job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. A failure to receive a response constitutes a failed execution. For a redirected request, the response returned by the redirected request is considered.
         */
        interface HttpTarget {
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST, PUT, or PATCH. It is an error to set body on a job with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * The user can specify HTTP request headers to send with the job's HTTP request. This map contains the header field names and values. Repeated headers are not supported, but a header value can contain commas. These headers represent a subset of the headers that will accompany the job's HTTP request. Some HTTP request headers will be ignored or replaced. A partial list of headers that will be ignored or replaced is below: - Host: This will be computed by Cloud Scheduler and derived from uri. * `Content-Length`: This will be computed by Cloud Scheduler. * `User-Agent`: This will be set to `"Google-Cloud-Scheduler"`. * `X-Google-*`: Google internal use only. * `X-AppEngine-*`: Google internal use only. The total size of headers must be less than 80KB.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Which HTTP method to use for the request.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * If specified, an [OAuth token](https://developers.google.com/identity/protocols/OAuth2) will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
             */
            oauthToken?: pulumi.Input<inputs.cloudscheduler.v1.OAuthToken>;
            /**
             * If specified, an [OIDC](https://developers.google.com/identity/protocols/OpenIDConnect) token will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
             */
            oidcToken?: pulumi.Input<inputs.cloudscheduler.v1.OidcToken>;
            /**
             * Required. The full URI path that the request will be sent to. This string must begin with either "http://" or "https://". Some examples of valid values for uri are: `http://acme.com` and `https://acme.com/sales:8080`. Cloud Scheduler will encode some characters for safety and compatibility. The maximum allowed URL length is 2083 characters after encoding.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OAuth token](https://developers.google.com/identity/protocols/OAuth2). This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
         */
        interface OAuthToken {
            /**
             * OAuth scope to be used for generating OAuth access token. If not specified, "https://www.googleapis.com/auth/cloud-platform" will be used.
             */
            scope?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OAuth token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect). This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. If not specified, the URI specified in target will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OIDC token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Pub/Sub target. The job will be delivered by publishing a message to the given Pub/Sub topic.
         */
        interface PubsubTarget {
            /**
             * Attributes for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.
             */
            attributes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The message payload for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.
             */
            data?: pulumi.Input<string>;
            /**
             * Required. The name of the Cloud Pub/Sub topic to which messages will be published when a job is delivered. The topic name must be in the same format as required by PubSub's [PublishRequest.name](https://cloud.google.com/pubsub/docs/reference/rpc/google.pubsub.v1#publishrequest), for example `projects/PROJECT_ID/topics/TOPIC_ID`. The topic must be in the same project as the Cloud Scheduler job.
             */
            topicName?: pulumi.Input<string>;
        }
        /**
         * Settings that determine the retry behavior. By default, if a job does not complete successfully (meaning that an acknowledgement is not received from the handler, then it will be retried with exponential backoff according to the settings in RetryConfig.
         */
        interface RetryConfig {
            /**
             * The maximum amount of time to wait before retrying a job after it fails. The default value of this field is 1 hour.
             */
            maxBackoffDuration?: pulumi.Input<string>;
            /**
             * The time between retries will double `max_doublings` times. A job's retry interval starts at min_backoff_duration, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff_duration up to retry_count times. For example, if min_backoff_duration is 10s, max_backoff_duration is 300s, and `max_doublings` is 3, then the a job will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the job will retry at intervals of max_backoff_duration until the job has been attempted retry_count times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... The default value of this field is 5.
             */
            maxDoublings?: pulumi.Input<number>;
            /**
             * The time limit for retrying a failed job, measured from time when an execution was first attempted. If specified with retry_count, the job will be retried until both limits are reached. The default value for max_retry_duration is zero, which means retry duration is unlimited.
             */
            maxRetryDuration?: pulumi.Input<string>;
            /**
             * The minimum amount of time to wait before retrying a job after it fails. The default value of this field is 5 seconds.
             */
            minBackoffDuration?: pulumi.Input<string>;
            /**
             * The number of attempts that the system will make to run a job using the exponential backoff procedure described by max_doublings. The default value of retry_count is zero. If retry_count is zero, a job attempt will *not* be retried if it fails. Instead the Cloud Scheduler system will wait for the next scheduled execution time. If retry_count is set to a non-zero number then Cloud Scheduler will retry failed attempts, using exponential backoff, retry_count times, or until the next scheduled execution time, whichever comes first. Values greater than 5 and negative values are not allowed.
             */
            retryCount?: pulumi.Input<number>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * App Engine target. The job will be pushed to a job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. Error 503 is considered an App Engine system error instead of an application error. Requests returning error 503 will be retried regardless of retry configuration and not counted against retry counts. Any other response code, or a failure to receive a response before the deadline, constitutes a failed attempt.
         */
        interface AppEngineHttpTarget {
            /**
             * App Engine Routing setting for the job.
             */
            appEngineRouting?: pulumi.Input<inputs.cloudscheduler.v1beta1.AppEngineRouting>;
            /**
             * Body. HTTP request body. A request body is allowed only if the HTTP method is POST or PUT. It will result in invalid argument error to set a body on a job with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the job is created. Cloud Scheduler sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Scheduler will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. * `X-CloudScheduler`: This header will be set to true. If the job has an body, Cloud Scheduler sets the following headers: * `Content-Type`: By default, the `Content-Type` header is set to `"application/octet-stream"`. The default can be overridden by explictly setting `Content-Type` to a particular media type when the job is created. For example, `Content-Type` can be set to `"application/json"`. * `Content-Length`: This is computed by Cloud Scheduler. This value is output only. It cannot be changed. The headers below are output only. They cannot be set or overridden: * `X-Google-*`: For Google internal use only. * `X-AppEngine-*`: For Google internal use only. In addition, some App Engine headers, which contain job-specific information, are also be sent to the job handler.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. PATCH and OPTIONS are not permitted.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * The relative URI. The relative URL must begin with "/" and must be a valid HTTP relative URL. It can contain a path, query string arguments, and `#` fragments. If the relative URL is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.
             */
            relativeUri?: pulumi.Input<string>;
        }
        /**
         * App Engine Routing. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
         */
        interface AppEngineRouting {
            /**
             * The host that the job is sent to. For more information about how App Engine requests are routed, see [here](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed). The host is constructed as: * `host = [application_domain_name]` `| [service] + '.' + [application_domain_name]` `| [version] + '.' + [application_domain_name]` `| [version_dot_service]+ '.' + [application_domain_name]` `| [instance] + '.' + [application_domain_name]` `| [instance_dot_service] + '.' + [application_domain_name]` `| [instance_dot_version] + '.' + [application_domain_name]` `| [instance_dot_version_dot_service] + '.' + [application_domain_name]` * `application_domain_name` = The domain name of the app, for example .appspot.com, which is associated with the job's project ID. * `service =` service * `version =` version * `version_dot_service =` version `+ '.' +` service * `instance =` instance * `instance_dot_service =` instance `+ '.' +` service * `instance_dot_version =` instance `+ '.' +` version * `instance_dot_version_dot_service =` instance `+ '.' +` version `+ '.' +` service If service is empty, then the job will be sent to the service which is the default service when the job is attempted. If version is empty, then the job will be sent to the version which is the default version when the job is attempted. If instance is empty, then the job will be sent to an instance which is available when the job is attempted. If service, version, or instance is invalid, then the job will be sent to the default version of the default service when the job is attempted.
             */
            host?: pulumi.Input<string>;
            /**
             * App instance. By default, the job is sent to an instance which is available when the job is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?hl=en_US#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
             */
            instance?: pulumi.Input<string>;
            /**
             * App service. By default, the job is sent to the service which is the default service when the job is attempted.
             */
            service?: pulumi.Input<string>;
            /**
             * App version. By default, the job is sent to the version which is the default version when the job is attempted.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Http target. The job will be pushed to the job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. A failure to receive a response constitutes a failed execution. For a redirected request, the response returned by the redirected request is considered.
         */
        interface HttpTarget {
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST, PUT, or PATCH. It is an error to set body on a job with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * The user can specify HTTP request headers to send with the job's HTTP request. This map contains the header field names and values. Repeated headers are not supported, but a header value can contain commas. These headers represent a subset of the headers that will accompany the job's HTTP request. Some HTTP request headers will be ignored or replaced. A partial list of headers that will be ignored or replaced is below: - Host: This will be computed by Cloud Scheduler and derived from uri. * `Content-Length`: This will be computed by Cloud Scheduler. * `User-Agent`: This will be set to `"Google-Cloud-Scheduler"`. * `X-Google-*`: Google internal use only. * `X-AppEngine-*`: Google internal use only. The total size of headers must be less than 80KB.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Which HTTP method to use for the request.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * If specified, an [OAuth token](https://developers.google.com/identity/protocols/OAuth2) will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
             */
            oauthToken?: pulumi.Input<inputs.cloudscheduler.v1beta1.OAuthToken>;
            /**
             * If specified, an [OIDC](https://developers.google.com/identity/protocols/OpenIDConnect) token will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
             */
            oidcToken?: pulumi.Input<inputs.cloudscheduler.v1beta1.OidcToken>;
            /**
             * Required. The full URI path that the request will be sent to. This string must begin with either "http://" or "https://". Some examples of valid values for uri are: `http://acme.com` and `https://acme.com/sales:8080`. Cloud Scheduler will encode some characters for safety and compatibility. The maximum allowed URL length is 2083 characters after encoding.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OAuth token](https://developers.google.com/identity/protocols/OAuth2). This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
         */
        interface OAuthToken {
            /**
             * OAuth scope to be used for generating OAuth access token. If not specified, "https://www.googleapis.com/auth/cloud-platform" will be used.
             */
            scope?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OAuth token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect). This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. If not specified, the URI specified in target will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OIDC token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Pub/Sub target. The job will be delivered by publishing a message to the given Pub/Sub topic.
         */
        interface PubsubTarget {
            /**
             * Attributes for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.
             */
            attributes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The message payload for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.
             */
            data?: pulumi.Input<string>;
            /**
             * Required. The name of the Cloud Pub/Sub topic to which messages will be published when a job is delivered. The topic name must be in the same format as required by PubSub's [PublishRequest.name](https://cloud.google.com/pubsub/docs/reference/rpc/google.pubsub.v1#publishrequest), for example `projects/PROJECT_ID/topics/TOPIC_ID`. The topic must be in the same project as the Cloud Scheduler job.
             */
            topicName?: pulumi.Input<string>;
        }
        /**
         * Settings that determine the retry behavior. By default, if a job does not complete successfully (meaning that an acknowledgement is not received from the handler, then it will be retried with exponential backoff according to the settings in RetryConfig.
         */
        interface RetryConfig {
            /**
             * The maximum amount of time to wait before retrying a job after it fails. The default value of this field is 1 hour.
             */
            maxBackoffDuration?: pulumi.Input<string>;
            /**
             * The time between retries will double `max_doublings` times. A job's retry interval starts at min_backoff_duration, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff_duration up to retry_count times. For example, if min_backoff_duration is 10s, max_backoff_duration is 300s, and `max_doublings` is 3, then the a job will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the job will retry at intervals of max_backoff_duration until the job has been attempted retry_count times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... The default value of this field is 5.
             */
            maxDoublings?: pulumi.Input<number>;
            /**
             * The time limit for retrying a failed job, measured from time when an execution was first attempted. If specified with retry_count, the job will be retried until both limits are reached. The default value for max_retry_duration is zero, which means retry duration is unlimited.
             */
            maxRetryDuration?: pulumi.Input<string>;
            /**
             * The minimum amount of time to wait before retrying a job after it fails. The default value of this field is 5 seconds.
             */
            minBackoffDuration?: pulumi.Input<string>;
            /**
             * The number of attempts that the system will make to run a job using the exponential backoff procedure described by max_doublings. The default value of retry_count is zero. If retry_count is zero, a job attempt will *not* be retried if it fails. Instead the Cloud Scheduler system will wait for the next scheduled execution time. If retry_count is set to a non-zero number then Cloud Scheduler will retry failed attempts, using exponential backoff, retry_count times, or until the next scheduled execution time, whichever comes first. Values greater than 5 and negative values are not allowed.
             */
            retryCount?: pulumi.Input<number>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudsearch {
    namespace v1 {
        interface CompositeFilter {
            /**
             * The logic operator of the sub filter.
             */
            logicOperator?: pulumi.Input<string>;
            /**
             * Sub filters.
             */
            subFilters?: pulumi.Input<pulumi.Input<inputs.cloudsearch.v1.Filter>[]>;
        }
        /**
         * Restriction on Datasource.
         */
        interface DataSourceRestriction {
            /**
             * Filter options restricting the results. If multiple filters are present, they are grouped by object type before joining. Filters with the same object type are joined conjunctively, then the resulting expressions are joined disjunctively. The maximum number of elements is 20. NOTE: Suggest API supports only few filters at the moment: "objecttype", "type" and "mimetype". For now, schema specific filters cannot be used to filter suggestions.
             */
            filterOptions?: pulumi.Input<pulumi.Input<inputs.cloudsearch.v1.FilterOptions>[]>;
            /**
             * The source of restriction.
             */
            source?: pulumi.Input<inputs.cloudsearch.v1.Source>;
        }
        /**
         * Represents a whole calendar date, for example a date of birth. The time of day and time zone are either specified elsewhere or are not significant. The date is relative to the [Proleptic Gregorian Calendar](https://en.wikipedia.org/wiki/Proleptic_Gregorian_calendar). The date must be a valid calendar date between the year 1 and 9999.
         */
        interface Date {
            /**
             * Day of month. Must be from 1 to 31 and valid for the year and month.
             */
            day?: pulumi.Input<number>;
            /**
             * Month of date. Must be from 1 to 12.
             */
            month?: pulumi.Input<number>;
            /**
             * Year of date. Must be from 1 to 9999.
             */
            year?: pulumi.Input<number>;
        }
        /**
         * Specifies operators to return facet results for. There will be one FacetResult for every source_name/object_type/operator_name combination.
         */
        interface FacetOptions {
            /**
             * Maximum number of facet buckets that should be returned for this facet. Defaults to 10. Maximum value is 100.
             */
            numFacetBuckets?: pulumi.Input<number>;
            /**
             * If object_type is set, only those objects of that type will be used to compute facets. If empty, then all objects will be used to compute facets.
             */
            objectType?: pulumi.Input<string>;
            /**
             * Name of the operator chosen for faceting. @see cloudsearch.SchemaPropertyOptions
             */
            operatorName?: pulumi.Input<string>;
            /**
             * Source name to facet on. Format: datasources/{source_id} If empty, all data sources will be used.
             */
            sourceName?: pulumi.Input<string>;
        }
        /**
         * A generic way of expressing filters in a query, which supports two approaches: **1. Setting a ValueFilter.** The name must match an operator_name defined in the schema for your data source. **2. Setting a CompositeFilter.** The filters are evaluated using the logical operator. The top-level operators can only be either an AND or a NOT. AND can appear only at the top-most level. OR can appear only under a top-level AND.
         */
        interface Filter {
            compositeFilter?: pulumi.Input<inputs.cloudsearch.v1.CompositeFilter>;
            valueFilter?: pulumi.Input<inputs.cloudsearch.v1.ValueFilter>;
        }
        /**
         * Filter options to be applied on query.
         */
        interface FilterOptions {
            /**
             * Generic filter to restrict the search, such as `lang:en`, `site:xyz`.
             */
            filter?: pulumi.Input<inputs.cloudsearch.v1.Filter>;
            /**
             * If object_type is set, only objects of that type are returned. This should correspond to the name of the object that was registered within the definition of schema. The maximum length is 256 characters.
             */
            objectType?: pulumi.Input<string>;
        }
        interface GSuitePrincipal {
            /**
             * This principal represents all users of the G Suite domain of the customer.
             */
            gsuiteDomain?: pulumi.Input<boolean>;
            /**
             * This principal references a G Suite group account
             */
            gsuiteGroupEmail?: pulumi.Input<string>;
            /**
             * This principal references a G Suite user account
             */
            gsuiteUserEmail?: pulumi.Input<string>;
        }
        /**
         * Scoring configurations for a source while processing a Search or Suggest request.
         */
        interface ScoringConfig {
            /**
             * Whether to use freshness as a ranking signal. By default, freshness is used as a ranking signal. Note that this setting is not available in the Admin UI.
             */
            disableFreshness?: pulumi.Input<boolean>;
            /**
             * Whether to personalize the results. By default, personal signals will be used to boost results.
             */
            disablePersonalization?: pulumi.Input<boolean>;
        }
        interface SortOptions {
            /**
             * Name of the operator corresponding to the field to sort on. The corresponding property must be marked as sortable.
             */
            operatorName?: pulumi.Input<string>;
            /**
             * Ascending is the default sort order
             */
            sortOrder?: pulumi.Input<string>;
        }
        /**
         * Defines sources for the suggest/search APIs.
         */
        interface Source {
            /**
             * Source name for content indexed by the Indexing API.
             */
            name?: pulumi.Input<string>;
            /**
             * Predefined content source for Google Apps.
             */
            predefinedSource?: pulumi.Input<string>;
        }
        /**
         * Configurations for a source while processing a Search or Suggest request.
         */
        interface SourceConfig {
            /**
             * The crowding configuration for the source.
             */
            crowdingConfig?: pulumi.Input<inputs.cloudsearch.v1.SourceCrowdingConfig>;
            /**
             * The scoring configuration for the source.
             */
            scoringConfig?: pulumi.Input<inputs.cloudsearch.v1.SourceScoringConfig>;
            /**
             * The source for which this configuration is to be used.
             */
            source?: pulumi.Input<inputs.cloudsearch.v1.Source>;
        }
        /**
         * Set search results crowding limits. Crowding is a situation in which multiple results from the same source or host "crowd out" other results, diminishing the quality of search for users. To foster better search quality and source diversity in search results, you can set a condition to reduce repetitive results by source.
         */
        interface SourceCrowdingConfig {
            /**
             * Maximum number of results allowed from a source. No limits will be set on results if this value is less than or equal to 0.
             */
            numResults?: pulumi.Input<number>;
            /**
             * Maximum number of suggestions allowed from a source. No limits will be set on results if this value is less than or equal to 0.
             */
            numSuggestions?: pulumi.Input<number>;
        }
        /**
         * Set the scoring configuration. This allows modifying the ranking of results for a source.
         */
        interface SourceScoringConfig {
            /**
             * Importance of the source.
             */
            sourceImportance?: pulumi.Input<string>;
        }
        /**
         * Definition of a single value with generic type.
         */
        interface Value {
            booleanValue?: pulumi.Input<boolean>;
            dateValue?: pulumi.Input<inputs.cloudsearch.v1.Date>;
            doubleValue?: pulumi.Input<number>;
            integerValue?: pulumi.Input<string>;
            stringValue?: pulumi.Input<string>;
            timestampValue?: pulumi.Input<string>;
        }
        interface ValueFilter {
            /**
             * The `operator_name` applied to the query, such as *price_greater_than*. The filter can work against both types of filters defined in the schema for your data source: 1. `operator_name`, where the query filters results by the property that matches the value. 2. `greater_than_operator_name` or `less_than_operator_name` in your schema. The query filters the results for the property values that are greater than or less than the supplied value in the query.
             */
            operatorName?: pulumi.Input<string>;
            /**
             * The value to be compared with.
             */
            value?: pulumi.Input<inputs.cloudsearch.v1.Value>;
        }
    }
}
export declare namespace cloudtasks {
    namespace v2 {
        /**
         * App Engine HTTP request. The message defines the HTTP request that is sent to an App Engine app when the task is dispatched. Using AppEngineHttpRequest requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform` The task will be delivered to the App Engine app which belongs to the same project as the queue. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and how routing is affected by [dispatch files](https://cloud.google.com/appengine/docs/python/config/dispatchref). Traffic is encrypted during transport and never leaves Google datacenters. Because this traffic is carried over a communication mechanism internal to Google, you cannot explicitly set the protocol (for example, HTTP or HTTPS). The request to the handler, however, will appear to have used the HTTP protocol. The AppEngineRouting used to construct the URL that the task is delivered to can be set at the queue-level or task-level: * If app_engine_routing_override is set on the queue, this value is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing. The `url` that the task will be sent to is: * `url =` host `+` relative_uri Tasks can be dispatched to secure app handlers, unsecure app handlers, and URIs restricted with [`login: admin`](https://cloud.google.com/appengine/docs/standard/python/config/appref). Because tasks are not run as any user, they cannot be dispatched to URIs restricted with [`login: required`](https://cloud.google.com/appengine/docs/standard/python/config/appref) Task dispatches also do not follow redirects. The task attempt has succeeded if the app's request handler returns an HTTP response code in the range [`200` - `299`]. The task attempt has failed if the app's handler returns a non-2xx response code or Cloud Tasks does not receive response before the deadline. Failed tasks will be retried according to the retry configuration. `503` (Service Unavailable) is considered an App Engine system error instead of an application error and will cause Cloud Tasks' traffic congestion control to temporarily throttle the queue's dispatches. Unlike other types of task targets, a `429` (Too Many Requests) response from an app handler does not cause traffic congestion control to throttle the queue.
         */
        interface AppEngineHttpRequest {
            /**
             * Task-level setting for App Engine routing. * If app_engine_routing_override is set on the queue, this value is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing.
             */
            appEngineRouting?: pulumi.Input<inputs.cloudtasks.v2.AppEngineRouting>;
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST or PUT. It is an error to set a body on a task with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the task is created. Repeated headers are not supported but a header value can contain commas. Cloud Tasks sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Tasks will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. If the task has a body, Cloud Tasks sets the following headers: * `Content-Type`: By default, the `Content-Type` header is set to `"application/octet-stream"`. The default can be overridden by explicitly setting `Content-Type` to a particular media type when the task is created. For example, `Content-Type` can be set to `"application/json"`. * `Content-Length`: This is computed by Cloud Tasks. This value is output only. It cannot be changed. The headers below cannot be set or overridden: * `Host` * `X-Google-*` * `X-AppEngine-*` In addition, Cloud Tasks sets some headers when the task is dispatched, such as headers containing information about the task; see [request headers](https://cloud.google.com/tasks/docs/creating-appengine-handlers#reading_request_headers). These headers are set only when the task is dispatched, so they are not visible when the task is returned in a Cloud Tasks response. Although there is no specific limit for the maximum number of headers or the size, there is a limit on the maximum size of the Task. For more information, see the CreateTask documentation.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. The default is POST. The app's request handler for the task's target URL must be able to handle HTTP requests with this http_method, otherwise the task attempt fails with error code 405 (Method Not Allowed). See [Writing a push task request handler](https://cloud.google.com/appengine/docs/java/taskqueue/push/creating-handlers#writing_a_push_task_request_handler) and the App Engine documentation for your runtime on [How Requests are Handled](https://cloud.google.com/appengine/docs/standard/python3/how-requests-are-handled).
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * The relative URI. The relative URI must begin with "/" and must be a valid HTTP relative URI. It can contain a path and query string arguments. If the relative URI is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.
             */
            relativeUri?: pulumi.Input<string>;
        }
        /**
         * App Engine Routing. Defines routing characteristics specific to App Engine - service, version, and instance. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed). Using AppEngineRouting requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform`
         */
        interface AppEngineRouting {
            /**
             * The host that the task is sent to. The host is constructed from the domain name of the app associated with the queue's project ID (for example .appspot.com), and the service, version, and instance. Tasks which were created using the App Engine SDK might have a custom domain name. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed).
             */
            host?: pulumi.Input<string>;
            /**
             * App instance. By default, the task is sent to an instance which is available when the task is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?hl=en_US#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
             */
            instance?: pulumi.Input<string>;
            /**
             * App service. By default, the task is sent to the service which is the default service when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            service?: pulumi.Input<string>;
            /**
             * App version. By default, the task is sent to the version which is the default version when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * The status of a task attempt.
         */
        interface Attempt {
            /**
             * The time that this attempt was dispatched. `dispatch_time` will be truncated to the nearest microsecond.
             */
            dispatchTime?: pulumi.Input<string>;
            /**
             * The response from the worker for this attempt. If `response_time` is unset, then the task has not been attempted or is currently running and the `response_status` field is meaningless.
             */
            responseStatus?: pulumi.Input<inputs.cloudtasks.v2.Status>;
            /**
             * The time that this attempt response was received. `response_time` will be truncated to the nearest microsecond.
             */
            responseTime?: pulumi.Input<string>;
            /**
             * The time that this attempt was scheduled. `schedule_time` will be truncated to the nearest microsecond.
             */
            scheduleTime?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudtasks.v2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * HTTP request. The task will be pushed to the worker as an HTTP request. If the worker or the redirected worker acknowledges the task by returning a successful HTTP response code ([`200` - `299`]), the task will be removed from the queue. If any other HTTP response code is returned or no response is received, the task will be retried according to the following: * User-specified throttling: retry configuration, rate limits, and the queue's state. * System throttling: To prevent the worker from overloading, Cloud Tasks may temporarily reduce the queue's effective rate. User-specified settings will not be changed. System throttling happens because: * Cloud Tasks backs off on all errors. Normally the backoff specified in rate limits will be used. But if the worker returns `429` (Too Many Requests), `503` (Service Unavailable), or the rate of errors is high, Cloud Tasks will use a higher backoff rate. The retry specified in the `Retry-After` HTTP response header is considered. * To prevent traffic spikes and to smooth sudden increases in traffic, dispatches ramp up slowly when the queue is newly created or idle and if large numbers of tasks suddenly become available to dispatch (due to spikes in create task rates, the queue being unpaused, or many tasks that are scheduled at the same time).
         */
        interface HttpRequest {
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST, PUT, or PATCH. It is an error to set body on a task with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the task is created. These headers represent a subset of the headers that will accompany the task's HTTP request. Some HTTP request headers will be ignored or replaced. A partial list of headers that will be ignored or replaced is: * Host: This will be computed by Cloud Tasks and derived from HttpRequest.url. * Content-Length: This will be computed by Cloud Tasks. * User-Agent: This will be set to `"Google-Cloud-Tasks"`. * X-Google-*: Google use only. * X-AppEngine-*: Google use only. `Content-Type` won't be set by Cloud Tasks. You can explicitly set `Content-Type` to a media type when the task is created. For example, `Content-Type` can be set to `"application/octet-stream"` or `"application/json"`. Headers which can have multiple values (according to RFC2616) can be specified using comma-separated values. The size of the headers must be less than 80KB.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. The default is POST.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * If specified, an [OAuth token](https://developers.google.com/identity/protocols/OAuth2) will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
             */
            oauthToken?: pulumi.Input<inputs.cloudtasks.v2.OAuthToken>;
            /**
             * If specified, an [OIDC](https://developers.google.com/identity/protocols/OpenIDConnect) token will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
             */
            oidcToken?: pulumi.Input<inputs.cloudtasks.v2.OidcToken>;
            /**
             * Required. The full url path that the request will be sent to. This string must begin with either "http://" or "https://". Some examples are: `http://acme.com` and `https://acme.com/sales:8080`. Cloud Tasks will encode some characters for safety and compatibility. The maximum allowed URL length is 2083 characters after encoding. The `Location` header response from a redirect response [`300` - `399`] may be followed. The redirect is not counted as a separate attempt.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OAuth token](https://developers.google.com/identity/protocols/OAuth2). This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
         */
        interface OAuthToken {
            /**
             * OAuth scope to be used for generating OAuth access token. If not specified, "https://www.googleapis.com/auth/cloud-platform" will be used.
             */
            scope?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OAuth token. The service account must be within the same project as the queue. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect). This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. If not specified, the URI specified in target will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OIDC token. The service account must be within the same project as the queue. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Rate limits. This message determines the maximum rate that tasks can be dispatched by a queue, regardless of whether the dispatch is a first task attempt or a retry. Note: The debugging command, RunTask, will run a task even if the queue has reached its RateLimits.
         */
        interface RateLimits {
            /**
             * The max burst size. Max burst size limits how fast tasks in queue are processed when many tasks are in the queue and the rate is high. This field allows the queue to have a high rate so processing starts shortly after a task is enqueued, but still limits resource usage when many tasks are enqueued in a short period of time. The [token bucket](https://wikipedia.org/wiki/Token_Bucket) algorithm is used to control the rate of task dispatches. Each queue has a token bucket that holds tokens, up to the maximum specified by `max_burst_size`. Each time a task is dispatched, a token is removed from the bucket. Tasks will be dispatched until the queue's bucket runs out of tokens. The bucket will be continuously refilled with new tokens based on max_dispatches_per_second. Cloud Tasks will pick the value of `max_burst_size` based on the value of max_dispatches_per_second. For queues that were created or updated using `queue.yaml/xml`, `max_burst_size` is equal to [bucket_size](https://cloud.google.com/appengine/docs/standard/python/config/queueref#bucket_size). Since `max_burst_size` is output only, if UpdateQueue is called on a queue created by `queue.yaml/xml`, `max_burst_size` will be reset based on the value of max_dispatches_per_second, regardless of whether max_dispatches_per_second is updated.
             */
            maxBurstSize?: pulumi.Input<number>;
            /**
             * The maximum number of concurrent tasks that Cloud Tasks allows to be dispatched for this queue. After this threshold has been reached, Cloud Tasks stops dispatching tasks until the number of concurrent requests decreases. If unspecified when the queue is created, Cloud Tasks will pick the default. The maximum allowed value is 5,000. This field has the same meaning as [max_concurrent_requests in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#max_concurrent_requests).
             */
            maxConcurrentDispatches?: pulumi.Input<number>;
            /**
             * The maximum rate at which tasks are dispatched from this queue. If unspecified when the queue is created, Cloud Tasks will pick the default. * The maximum allowed value is 500. This field has the same meaning as [rate in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#rate).
             */
            maxDispatchesPerSecond?: pulumi.Input<number>;
        }
        /**
         * Retry config. These settings determine when a failed task attempt is retried.
         */
        interface RetryConfig {
            /**
             * Number of attempts per task. Cloud Tasks will attempt the task `max_attempts` times (that is, if the first attempt fails, then there will be `max_attempts - 1` retries). Must be >= -1. If unspecified when the queue is created, Cloud Tasks will pick the default. -1 indicates unlimited attempts. This field has the same meaning as [task_retry_limit in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxAttempts?: pulumi.Input<number>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. `max_backoff` will be truncated to the nearest second. This field has the same meaning as [max_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxBackoff?: pulumi.Input<string>;
            /**
             * The time between retries will double `max_doublings` times. A task's retry interval starts at min_backoff, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff up to max_attempts times. For example, if min_backoff is 10s, max_backoff is 300s, and `max_doublings` is 3, then the a task will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the task will retry at intervals of max_backoff until the task has been attempted max_attempts times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... If unspecified when the queue is created, Cloud Tasks will pick the default. This field has the same meaning as [max_doublings in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxDoublings?: pulumi.Input<number>;
            /**
             * If positive, `max_retry_duration` specifies the time limit for retrying a failed task, measured from when the task was first attempted. Once `max_retry_duration` time has passed *and* the task has been attempted max_attempts times, no further attempts will be made and the task will be deleted. If zero, then the task age is unlimited. If unspecified when the queue is created, Cloud Tasks will pick the default. `max_retry_duration` will be truncated to the nearest second. This field has the same meaning as [task_age_limit in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxRetryDuration?: pulumi.Input<string>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. `min_backoff` will be truncated to the nearest second. This field has the same meaning as [min_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            minBackoff?: pulumi.Input<string>;
        }
        /**
         * Configuration options for writing logs to [Stackdriver Logging](https://cloud.google.com/logging/docs/).
         */
        interface StackdriverLoggingConfig {
            /**
             * Specifies the fraction of operations to write to [Stackdriver Logging](https://cloud.google.com/logging/docs/). This field may contain any value between 0.0 and 1.0, inclusive. 0.0 is the default and means that no operations are logged.
             */
            samplingRatio?: pulumi.Input<number>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
    namespace v2beta2 {
        /**
         * App Engine HTTP request. The message defines the HTTP request that is sent to an App Engine app when the task is dispatched. This proto can only be used for tasks in a queue which has app_engine_http_target set. Using AppEngineHttpRequest requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform` The task will be delivered to the App Engine app which belongs to the same project as the queue. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and how routing is affected by [dispatch files](https://cloud.google.com/appengine/docs/python/config/dispatchref). Traffic is encrypted during transport and never leaves Google datacenters. Because this traffic is carried over a communication mechanism internal to Google, you cannot explicitly set the protocol (for example, HTTP or HTTPS). The request to the handler, however, will appear to have used the HTTP protocol. The AppEngineRouting used to construct the URL that the task is delivered to can be set at the queue-level or task-level: * If set, app_engine_routing_override is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing. The `url` that the task will be sent to is: * `url =` host `+` relative_url Tasks can be dispatched to secure app handlers, unsecure app handlers, and URIs restricted with [`login: admin`](https://cloud.google.com/appengine/docs/standard/python/config/appref). Because tasks are not run as any user, they cannot be dispatched to URIs restricted with [`login: required`](https://cloud.google.com/appengine/docs/standard/python/config/appref) Task dispatches also do not follow redirects. The task attempt has succeeded if the app's request handler returns an HTTP response code in the range [`200` - `299`]. The task attempt has failed if the app's handler returns a non-2xx response code or Cloud Tasks does not receive response before the deadline. Failed tasks will be retried according to the retry configuration. `503` (Service Unavailable) is considered an App Engine system error instead of an application error and will cause Cloud Tasks' traffic congestion control to temporarily throttle the queue's dispatches. Unlike other types of task targets, a `429` (Too Many Requests) response from an app handler does not cause traffic congestion control to throttle the queue.
         */
        interface AppEngineHttpRequest {
            /**
             * Task-level setting for App Engine routing. If set, app_engine_routing_override is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing.
             */
            appEngineRouting?: pulumi.Input<inputs.cloudtasks.v2beta2.AppEngineRouting>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the task is created. Repeated headers are not supported but a header value can contain commas. Cloud Tasks sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Tasks will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. If the task has a payload, Cloud Tasks sets the following headers: * `Content-Type`: By default, the `Content-Type` header is set to `"application/octet-stream"`. The default can be overridden by explicitly setting `Content-Type` to a particular media type when the task is created. For example, `Content-Type` can be set to `"application/json"`. * `Content-Length`: This is computed by Cloud Tasks. This value is output only. It cannot be changed. The headers below cannot be set or overridden: * `Host` * `X-Google-*` * `X-AppEngine-*` In addition, Cloud Tasks sets some headers when the task is dispatched, such as headers containing information about the task; see [request headers](https://cloud.google.com/appengine/docs/python/taskqueue/push/creating-handlers#reading_request_headers). These headers are set only when the task is dispatched, so they are not visible when the task is returned in a Cloud Tasks response. Although there is no specific limit for the maximum number of headers or the size, there is a limit on the maximum size of the Task. For more information, see the CreateTask documentation.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. The default is POST. The app's request handler for the task's target URL must be able to handle HTTP requests with this http_method, otherwise the task attempt fails with error code 405 (Method Not Allowed). See [Writing a push task request handler](https://cloud.google.com/appengine/docs/java/taskqueue/push/creating-handlers#writing_a_push_task_request_handler) and the App Engine documentation for your runtime on [How Requests are Handled](https://cloud.google.com/appengine/docs/standard/python3/how-requests-are-handled).
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * Payload. The payload will be sent as the HTTP message body. A message body, and thus a payload, is allowed only if the HTTP method is POST or PUT. It is an error to set a data payload on a task with an incompatible HttpMethod.
             */
            payload?: pulumi.Input<string>;
            /**
             * The relative URL. The relative URL must begin with "/" and must be a valid HTTP relative URL. It can contain a path and query string arguments. If the relative URL is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.
             */
            relativeUrl?: pulumi.Input<string>;
        }
        /**
         * App Engine HTTP target. The task will be delivered to the App Engine application hostname specified by its AppEngineHttpTarget and AppEngineHttpRequest. The documentation for AppEngineHttpRequest explains how the task's host URL is constructed. Using AppEngineHttpTarget requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform`
         */
        interface AppEngineHttpTarget {
            /**
             * Overrides for the task-level app_engine_routing. If set, `app_engine_routing_override` is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing.
             */
            appEngineRoutingOverride?: pulumi.Input<inputs.cloudtasks.v2beta2.AppEngineRouting>;
        }
        /**
         * App Engine Routing. Defines routing characteristics specific to App Engine - service, version, and instance. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
         */
        interface AppEngineRouting {
            /**
             * The host that the task is sent to. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed). The host is constructed as: * `host = [application_domain_name]` `| [service] + '.' + [application_domain_name]` `| [version] + '.' + [application_domain_name]` `| [version_dot_service]+ '.' + [application_domain_name]` `| [instance] + '.' + [application_domain_name]` `| [instance_dot_service] + '.' + [application_domain_name]` `| [instance_dot_version] + '.' + [application_domain_name]` `| [instance_dot_version_dot_service] + '.' + [application_domain_name]` * `application_domain_name` = The domain name of the app, for example .appspot.com, which is associated with the queue's project ID. Some tasks which were created using the App Engine SDK use a custom domain name. * `service =` service * `version =` version * `version_dot_service =` version `+ '.' +` service * `instance =` instance * `instance_dot_service =` instance `+ '.' +` service * `instance_dot_version =` instance `+ '.' +` version * `instance_dot_version_dot_service =` instance `+ '.' +` version `+ '.' +` service If service is empty, then the task will be sent to the service which is the default service when the task is attempted. If version is empty, then the task will be sent to the version which is the default version when the task is attempted. If instance is empty, then the task will be sent to an instance which is available when the task is attempted. If service, version, or instance is invalid, then the task will be sent to the default version of the default service when the task is attempted.
             */
            host?: pulumi.Input<string>;
            /**
             * App instance. By default, the task is sent to an instance which is available when the task is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?hl=en_US#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
             */
            instance?: pulumi.Input<string>;
            /**
             * App service. By default, the task is sent to the service which is the default service when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            service?: pulumi.Input<string>;
            /**
             * App version. By default, the task is sent to the version which is the default version when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * The status of a task attempt.
         */
        interface AttemptStatus {
            /**
             * The time that this attempt was dispatched. `dispatch_time` will be truncated to the nearest microsecond.
             */
            dispatchTime?: pulumi.Input<string>;
            /**
             * The response from the target for this attempt. If the task has not been attempted or the task is currently running then the response status is unset.
             */
            responseStatus?: pulumi.Input<inputs.cloudtasks.v2beta2.Status>;
            /**
             * The time that this attempt response was received. `response_time` will be truncated to the nearest microsecond.
             */
            responseTime?: pulumi.Input<string>;
            /**
             * The time that this attempt was scheduled. `schedule_time` will be truncated to the nearest microsecond.
             */
            scheduleTime?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudtasks.v2beta2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The pull message contains data that can be used by the caller of LeaseTasks to process the task. This proto can only be used for tasks in a queue which has pull_target set.
         */
        interface PullMessage {
            /**
             * A data payload consumed by the worker to execute the task.
             */
            payload?: pulumi.Input<string>;
            /**
             * The task's tag. Tags allow similar tasks to be processed in a batch. If you label tasks with a tag, your worker can lease tasks with the same tag using filter. For example, if you want to aggregate the events associated with a specific user once a day, you could tag tasks with the user ID. The task's tag can only be set when the task is created. The tag must be less than 500 characters. SDK compatibility: Although the SDK allows tags to be either string or [bytes](https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/taskqueue/TaskOptions.html#tag-byte:A-), only UTF-8 encoded tags can be used in Cloud Tasks. If a tag isn't UTF-8 encoded, the tag will be empty when the task is returned by Cloud Tasks.
             */
            tag?: pulumi.Input<string>;
        }
        /**
         * Pull target.
         */
        interface PullTarget {
        }
        /**
         * Rate limits. This message determines the maximum rate that tasks can be dispatched by a queue, regardless of whether the dispatch is a first task attempt or a retry. Note: The debugging command, RunTask, will run a task even if the queue has reached its RateLimits.
         */
        interface RateLimits {
            /**
             * The max burst size. Max burst size limits how fast tasks in queue are processed when many tasks are in the queue and the rate is high. This field allows the queue to have a high rate so processing starts shortly after a task is enqueued, but still limits resource usage when many tasks are enqueued in a short period of time. The [token bucket](https://wikipedia.org/wiki/Token_Bucket) algorithm is used to control the rate of task dispatches. Each queue has a token bucket that holds tokens, up to the maximum specified by `max_burst_size`. Each time a task is dispatched, a token is removed from the bucket. Tasks will be dispatched until the queue's bucket runs out of tokens. The bucket will be continuously refilled with new tokens based on max_dispatches_per_second. The default value of `max_burst_size` is picked by Cloud Tasks based on the value of max_dispatches_per_second. The maximum value of `max_burst_size` is 500. For App Engine queues that were created or updated using `queue.yaml/xml`, `max_burst_size` is equal to [bucket_size](https://cloud.google.com/appengine/docs/standard/python/config/queueref#bucket_size). If UpdateQueue is called on a queue without explicitly setting a value for `max_burst_size`, `max_burst_size` value will get updated if UpdateQueue is updating max_dispatches_per_second.
             */
            maxBurstSize?: pulumi.Input<number>;
            /**
             * The maximum number of concurrent tasks that Cloud Tasks allows to be dispatched for this queue. After this threshold has been reached, Cloud Tasks stops dispatching tasks until the number of concurrent requests decreases. If unspecified when the queue is created, Cloud Tasks will pick the default. The maximum allowed value is 5,000. This field is output only for pull queues and always -1, which indicates no limit. No other queue types can have `max_concurrent_tasks` set to -1. This field has the same meaning as [max_concurrent_requests in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#max_concurrent_requests).
             */
            maxConcurrentTasks?: pulumi.Input<number>;
            /**
             * The maximum rate at which tasks are dispatched from this queue. If unspecified when the queue is created, Cloud Tasks will pick the default. * For App Engine queues, the maximum allowed value is 500. * This field is output only for pull queues. In addition to the `max_tasks_dispatched_per_second` limit, a maximum of 10 QPS of LeaseTasks requests are allowed per pull queue. This field has the same meaning as [rate in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#rate).
             */
            maxTasksDispatchedPerSecond?: pulumi.Input<number>;
        }
        /**
         * Retry config. These settings determine how a failed task attempt is retried.
         */
        interface RetryConfig {
            /**
             * The maximum number of attempts for a task. Cloud Tasks will attempt the task `max_attempts` times (that is, if the first attempt fails, then there will be `max_attempts - 1` retries). Must be > 0.
             */
            maxAttempts?: pulumi.Input<number>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. This field is output only for pull queues. `max_backoff` will be truncated to the nearest second. This field has the same meaning as [max_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxBackoff?: pulumi.Input<string>;
            /**
             * The time between retries will double `max_doublings` times. A task's retry interval starts at min_backoff, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff up to max_attempts times. For example, if min_backoff is 10s, max_backoff is 300s, and `max_doublings` is 3, then the a task will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the task will retry at intervals of max_backoff until the task has been attempted max_attempts times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... If unspecified when the queue is created, Cloud Tasks will pick the default. This field is output only for pull queues. This field has the same meaning as [max_doublings in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxDoublings?: pulumi.Input<number>;
            /**
             * If positive, `max_retry_duration` specifies the time limit for retrying a failed task, measured from when the task was first attempted. Once `max_retry_duration` time has passed *and* the task has been attempted max_attempts times, no further attempts will be made and the task will be deleted. If zero, then the task age is unlimited. If unspecified when the queue is created, Cloud Tasks will pick the default. This field is output only for pull queues. `max_retry_duration` will be truncated to the nearest second. This field has the same meaning as [task_age_limit in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxRetryDuration?: pulumi.Input<string>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. This field is output only for pull queues. `min_backoff` will be truncated to the nearest second. This field has the same meaning as [min_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            minBackoff?: pulumi.Input<string>;
            /**
             * If true, then the number of attempts is unlimited.
             */
            unlimitedAttempts?: pulumi.Input<boolean>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Status of the task.
         */
        interface TaskStatus {
            /**
             * The number of attempts dispatched. This count includes attempts which have been dispatched but haven't received a response.
             */
            attemptDispatchCount?: pulumi.Input<number>;
            /**
             * The number of attempts which have received a response. This field is not calculated for pull tasks.
             */
            attemptResponseCount?: pulumi.Input<number>;
            /**
             * The status of the task's first attempt. Only dispatch_time will be set. The other AttemptStatus information is not retained by Cloud Tasks. This field is not calculated for pull tasks.
             */
            firstAttemptStatus?: pulumi.Input<inputs.cloudtasks.v2beta2.AttemptStatus>;
            /**
             * The status of the task's last attempt. This field is not calculated for pull tasks.
             */
            lastAttemptStatus?: pulumi.Input<inputs.cloudtasks.v2beta2.AttemptStatus>;
        }
    }
    namespace v2beta3 {
        /**
         * App Engine HTTP queue. The task will be delivered to the App Engine application hostname specified by its AppEngineHttpQueue and AppEngineHttpRequest. The documentation for AppEngineHttpRequest explains how the task's host URL is constructed. Using AppEngineHttpQueue requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform`
         */
        interface AppEngineHttpQueue {
            /**
             * Overrides for the task-level app_engine_routing. If set, `app_engine_routing_override` is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing.
             */
            appEngineRoutingOverride?: pulumi.Input<inputs.cloudtasks.v2beta3.AppEngineRouting>;
        }
        /**
         * App Engine HTTP request. The message defines the HTTP request that is sent to an App Engine app when the task is dispatched. Using AppEngineHttpRequest requires [`appengine.applications.get`](https://cloud.google.com/appengine/docs/admin-api/access-control) Google IAM permission for the project and the following scope: `https://www.googleapis.com/auth/cloud-platform` The task will be delivered to the App Engine app which belongs to the same project as the queue. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and how routing is affected by [dispatch files](https://cloud.google.com/appengine/docs/python/config/dispatchref). Traffic is encrypted during transport and never leaves Google datacenters. Because this traffic is carried over a communication mechanism internal to Google, you cannot explicitly set the protocol (for example, HTTP or HTTPS). The request to the handler, however, will appear to have used the HTTP protocol. The AppEngineRouting used to construct the URL that the task is delivered to can be set at the queue-level or task-level: * If set, app_engine_routing_override is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing. The `url` that the task will be sent to is: * `url =` host `+` relative_uri Tasks can be dispatched to secure app handlers, unsecure app handlers, and URIs restricted with [`login: admin`](https://cloud.google.com/appengine/docs/standard/python/config/appref). Because tasks are not run as any user, they cannot be dispatched to URIs restricted with [`login: required`](https://cloud.google.com/appengine/docs/standard/python/config/appref) Task dispatches also do not follow redirects. The task attempt has succeeded if the app's request handler returns an HTTP response code in the range [`200` - `299`]. The task attempt has failed if the app's handler returns a non-2xx response code or Cloud Tasks does not receive response before the deadline. Failed tasks will be retried according to the retry configuration. `503` (Service Unavailable) is considered an App Engine system error instead of an application error and will cause Cloud Tasks' traffic congestion control to temporarily throttle the queue's dispatches. Unlike other types of task targets, a `429` (Too Many Requests) response from an app handler does not cause traffic congestion control to throttle the queue.
         */
        interface AppEngineHttpRequest {
            /**
             * Task-level setting for App Engine routing. If set, app_engine_routing_override is used for all tasks in the queue, no matter what the setting is for the task-level app_engine_routing.
             */
            appEngineRouting?: pulumi.Input<inputs.cloudtasks.v2beta3.AppEngineRouting>;
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST or PUT. It is an error to set a body on a task with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the task is created. Repeated headers are not supported but a header value can contain commas. Cloud Tasks sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Tasks will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. If the task has a body, Cloud Tasks sets the following headers: * `Content-Type`: By default, the `Content-Type` header is set to `"application/octet-stream"`. The default can be overridden by explicitly setting `Content-Type` to a particular media type when the task is created. For example, `Content-Type` can be set to `"application/json"`. * `Content-Length`: This is computed by Cloud Tasks. This value is output only. It cannot be changed. The headers below cannot be set or overridden: * `Host` * `X-Google-*` * `X-AppEngine-*` In addition, Cloud Tasks sets some headers when the task is dispatched, such as headers containing information about the task; see [request headers](https://cloud.google.com/tasks/docs/creating-appengine-handlers#reading_request_headers). These headers are set only when the task is dispatched, so they are not visible when the task is returned in a Cloud Tasks response. Although there is no specific limit for the maximum number of headers or the size, there is a limit on the maximum size of the Task. For more information, see the CreateTask documentation.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. The default is POST. The app's request handler for the task's target URL must be able to handle HTTP requests with this http_method, otherwise the task attempt fails with error code 405 (Method Not Allowed). See [Writing a push task request handler](https://cloud.google.com/appengine/docs/java/taskqueue/push/creating-handlers#writing_a_push_task_request_handler) and the App Engine documentation for your runtime on [How Requests are Handled](https://cloud.google.com/appengine/docs/standard/python3/how-requests-are-handled).
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * The relative URI. The relative URI must begin with "/" and must be a valid HTTP relative URI. It can contain a path and query string arguments. If the relative URI is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.
             */
            relativeUri?: pulumi.Input<string>;
        }
        /**
         * App Engine Routing. Defines routing characteristics specific to App Engine - service, version, and instance. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
         */
        interface AppEngineRouting {
            /**
             * The host that the task is sent to. The host is constructed from the domain name of the app associated with the queue's project ID (for example .appspot.com), and the service, version, and instance. Tasks which were created using the App Engine SDK might have a custom domain name. For more information, see [How Requests are Routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed).
             */
            host?: pulumi.Input<string>;
            /**
             * App instance. By default, the task is sent to an instance which is available when the task is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?hl=en_US#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).
             */
            instance?: pulumi.Input<string>;
            /**
             * App service. By default, the task is sent to the service which is the default service when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            service?: pulumi.Input<string>;
            /**
             * App version. By default, the task is sent to the version which is the default version when the task is attempted. For some queues or tasks which were created using the App Engine Task Queue API, host is not parsable into service, version, and instance. For example, some tasks which were created using the App Engine SDK use a custom domain name; custom domains are not parsed by Cloud Tasks. If host is not parsable, then service, version, and instance are the empty string.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * The status of a task attempt.
         */
        interface Attempt {
            /**
             * The time that this attempt was dispatched. `dispatch_time` will be truncated to the nearest microsecond.
             */
            dispatchTime?: pulumi.Input<string>;
            /**
             * The response from the worker for this attempt. If `response_time` is unset, then the task has not been attempted or is currently running and the `response_status` field is meaningless.
             */
            responseStatus?: pulumi.Input<inputs.cloudtasks.v2beta3.Status>;
            /**
             * The time that this attempt response was received. `response_time` will be truncated to the nearest microsecond.
             */
            responseTime?: pulumi.Input<string>;
            /**
             * The time that this attempt was scheduled. `schedule_time` will be truncated to the nearest microsecond.
             */
            scheduleTime?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.cloudtasks.v2beta3.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * HTTP request. The task will be pushed to the worker as an HTTP request. If the worker or the redirected worker acknowledges the task by returning a successful HTTP response code ([`200` - `299`]), the task will be removed from the queue. If any other HTTP response code is returned or no response is received, the task will be retried according to the following: * User-specified throttling: retry configuration, rate limits, and the queue's state. * System throttling: To prevent the worker from overloading, Cloud Tasks may temporarily reduce the queue's effective rate. User-specified settings will not be changed. System throttling happens because: * Cloud Tasks backs off on all errors. Normally the backoff specified in rate limits will be used. But if the worker returns `429` (Too Many Requests), `503` (Service Unavailable), or the rate of errors is high, Cloud Tasks will use a higher backoff rate. The retry specified in the `Retry-After` HTTP response header is considered. * To prevent traffic spikes and to smooth sudden increases in traffic, dispatches ramp up slowly when the queue is newly created or idle and if large numbers of tasks suddenly become available to dispatch (due to spikes in create task rates, the queue being unpaused, or many tasks that are scheduled at the same time).
         */
        interface HttpRequest {
            /**
             * HTTP request body. A request body is allowed only if the HTTP method is POST, PUT, or PATCH. It is an error to set body on a task with an incompatible HttpMethod.
             */
            body?: pulumi.Input<string>;
            /**
             * HTTP request headers. This map contains the header field names and values. Headers can be set when the task is created. These headers represent a subset of the headers that will accompany the task's HTTP request. Some HTTP request headers will be ignored or replaced. A partial list of headers that will be ignored or replaced is: * Host: This will be computed by Cloud Tasks and derived from HttpRequest.url. * Content-Length: This will be computed by Cloud Tasks. * User-Agent: This will be set to `"Google-Cloud-Tasks"`. * X-Google-*: Google use only. * X-AppEngine-*: Google use only. `Content-Type` won't be set by Cloud Tasks. You can explicitly set `Content-Type` to a media type when the task is created. For example, `Content-Type` can be set to `"application/octet-stream"` or `"application/json"`. Headers which can have multiple values (according to RFC2616) can be specified using comma-separated values. The size of the headers must be less than 80KB.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HTTP method to use for the request. The default is POST.
             */
            httpMethod?: pulumi.Input<string>;
            /**
             * If specified, an [OAuth token](https://developers.google.com/identity/protocols/OAuth2) will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
             */
            oauthToken?: pulumi.Input<inputs.cloudtasks.v2beta3.OAuthToken>;
            /**
             * If specified, an [OIDC](https://developers.google.com/identity/protocols/OpenIDConnect) token will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
             */
            oidcToken?: pulumi.Input<inputs.cloudtasks.v2beta3.OidcToken>;
            /**
             * Required. The full url path that the request will be sent to. This string must begin with either "http://" or "https://". Some examples are: `http://acme.com` and `https://acme.com/sales:8080`. Cloud Tasks will encode some characters for safety and compatibility. The maximum allowed URL length is 2083 characters after encoding. The `Location` header response from a redirect response [`300` - `399`] may be followed. The redirect is not counted as a separate attempt.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OAuth token](https://developers.google.com/identity/protocols/OAuth2). This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.
         */
        interface OAuthToken {
            /**
             * OAuth scope to be used for generating OAuth access token. If not specified, "https://www.googleapis.com/auth/cloud-platform" will be used.
             */
            scope?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OAuth token. The service account must be within the same project as the queue. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect). This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. If not specified, the URI specified in target will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OIDC token. The service account must be within the same project as the queue. The caller must have iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Pull Message. This proto can only be used for tasks in a queue which has PULL type. It currently exists for backwards compatibility with the App Engine Task Queue SDK. This message type maybe returned with methods list and get, when the response view is FULL.
         */
        interface PullMessage {
            /**
             * A data payload consumed by the worker to execute the task.
             */
            payload?: pulumi.Input<string>;
            /**
             * The tasks's tag. The tag is less than 500 characters. SDK compatibility: Although the SDK allows tags to be either string or [bytes](https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/taskqueue/TaskOptions.html#tag-byte:A-), only UTF-8 encoded tags can be used in Cloud Tasks. If a tag isn't UTF-8 encoded, the tag will be empty when the task is returned by Cloud Tasks.
             */
            tag?: pulumi.Input<string>;
        }
        /**
         * Rate limits. This message determines the maximum rate that tasks can be dispatched by a queue, regardless of whether the dispatch is a first task attempt or a retry. Note: The debugging command, RunTask, will run a task even if the queue has reached its RateLimits.
         */
        interface RateLimits {
            /**
             * The max burst size. Max burst size limits how fast tasks in queue are processed when many tasks are in the queue and the rate is high. This field allows the queue to have a high rate so processing starts shortly after a task is enqueued, but still limits resource usage when many tasks are enqueued in a short period of time. The [token bucket](https://wikipedia.org/wiki/Token_Bucket) algorithm is used to control the rate of task dispatches. Each queue has a token bucket that holds tokens, up to the maximum specified by `max_burst_size`. Each time a task is dispatched, a token is removed from the bucket. Tasks will be dispatched until the queue's bucket runs out of tokens. The bucket will be continuously refilled with new tokens based on max_dispatches_per_second. The default value of `max_burst_size` is picked by Cloud Tasks based on the value of max_dispatches_per_second. The maximum value of `max_burst_size` is 500. For App Engine queues that were created or updated using `queue.yaml/xml`, `max_burst_size` is equal to [bucket_size](https://cloud.google.com/appengine/docs/standard/python/config/queueref#bucket_size). If UpdateQueue is called on a queue without explicitly setting a value for `max_burst_size`, `max_burst_size` value will get updated if UpdateQueue is updating max_dispatches_per_second.
             */
            maxBurstSize?: pulumi.Input<number>;
            /**
             * The maximum number of concurrent tasks that Cloud Tasks allows to be dispatched for this queue. After this threshold has been reached, Cloud Tasks stops dispatching tasks until the number of concurrent requests decreases. If unspecified when the queue is created, Cloud Tasks will pick the default. The maximum allowed value is 5,000. This field has the same meaning as [max_concurrent_requests in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#max_concurrent_requests).
             */
            maxConcurrentDispatches?: pulumi.Input<number>;
            /**
             * The maximum rate at which tasks are dispatched from this queue. If unspecified when the queue is created, Cloud Tasks will pick the default. * For App Engine queues, the maximum allowed value is 500. This field has the same meaning as [rate in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#rate).
             */
            maxDispatchesPerSecond?: pulumi.Input<number>;
        }
        /**
         * Retry config. These settings determine when a failed task attempt is retried.
         */
        interface RetryConfig {
            /**
             * Number of attempts per task. Cloud Tasks will attempt the task `max_attempts` times (that is, if the first attempt fails, then there will be `max_attempts - 1` retries). Must be >= -1. If unspecified when the queue is created, Cloud Tasks will pick the default. -1 indicates unlimited attempts. This field has the same meaning as [task_retry_limit in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxAttempts?: pulumi.Input<number>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. `max_backoff` will be truncated to the nearest second. This field has the same meaning as [max_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxBackoff?: pulumi.Input<string>;
            /**
             * The time between retries will double `max_doublings` times. A task's retry interval starts at min_backoff, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff up to max_attempts times. For example, if min_backoff is 10s, max_backoff is 300s, and `max_doublings` is 3, then the a task will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the task will retry at intervals of max_backoff until the task has been attempted max_attempts times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... If unspecified when the queue is created, Cloud Tasks will pick the default. This field has the same meaning as [max_doublings in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxDoublings?: pulumi.Input<number>;
            /**
             * If positive, `max_retry_duration` specifies the time limit for retrying a failed task, measured from when the task was first attempted. Once `max_retry_duration` time has passed *and* the task has been attempted max_attempts times, no further attempts will be made and the task will be deleted. If zero, then the task age is unlimited. If unspecified when the queue is created, Cloud Tasks will pick the default. `max_retry_duration` will be truncated to the nearest second. This field has the same meaning as [task_age_limit in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            maxRetryDuration?: pulumi.Input<string>;
            /**
             * A task will be scheduled for retry between min_backoff and max_backoff duration after it fails, if the queue's RetryConfig specifies that the task should be retried. If unspecified when the queue is created, Cloud Tasks will pick the default. `min_backoff` will be truncated to the nearest second. This field has the same meaning as [min_backoff_seconds in queue.yaml/xml](https://cloud.google.com/appengine/docs/standard/python/config/queueref#retry_parameters).
             */
            minBackoff?: pulumi.Input<string>;
        }
        /**
         * Configuration options for writing logs to [Stackdriver Logging](https://cloud.google.com/logging/docs/).
         */
        interface StackdriverLoggingConfig {
            /**
             * Specifies the fraction of operations to write to [Stackdriver Logging](https://cloud.google.com/logging/docs/). This field may contain any value between 0.0 and 1.0, inclusive. 0.0 is the default and means that no operations are logged.
             */
            samplingRatio?: pulumi.Input<number>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
}
export declare namespace cloudtrace {
    namespace v2beta1 {
        /**
         * OutputConfig contains a destination for writing trace data.
         */
        interface OutputConfig {
            /**
             * The destination for writing trace data. Currently only BigQuery is supported. E.g.: "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]"
             */
            destination?: pulumi.Input<string>;
        }
    }
}
export declare namespace composer {
    namespace v1 {
        /**
         * Allowed IP range with user-provided description.
         */
        interface AllowedIpRange {
            /**
             * Optional. User-provided description. It must contain at most 300 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * IP address or range, defined using CIDR notation, of requests that this rule applies to. Examples: `192.168.1.1` or `192.168.0.0/16` or `2001:db8::/32` or `2001:0db8:0000:0042:0000:8a2e:0370:7334`. IP range prefixes should be properly truncated. For example, `1.2.3.4/24` should be truncated to `1.2.3.0/24`. Similarly, for IPv6, `2001:db8::1/32` should be truncated to `2001:db8::/32`.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The configuration of Cloud SQL instance that is used by the Apache Airflow software.
         */
        interface DatabaseConfig {
            /**
             * Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
             */
            machineType?: pulumi.Input<string>;
        }
        /**
         * The encryption options for the Cloud Composer environment and its dependencies.
         */
        interface EncryptionConfig {
            /**
             * Optional. Customer-managed Encryption Key available through Google's Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Configuration information for an environment.
         */
        interface EnvironmentConfig {
            /**
             * The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).
             */
            airflowUri?: pulumi.Input<string>;
            /**
             * The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using "/"-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.
             */
            dagGcsPrefix?: pulumi.Input<string>;
            /**
             * Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
             */
            databaseConfig?: pulumi.Input<inputs.composer.v1.DatabaseConfig>;
            /**
             * Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.
             */
            encryptionConfig?: pulumi.Input<inputs.composer.v1.EncryptionConfig>;
            /**
             * The Kubernetes Engine cluster used to run this environment.
             */
            gkeCluster?: pulumi.Input<string>;
            /**
             * The configuration used for the Kubernetes Engine cluster.
             */
            nodeConfig?: pulumi.Input<inputs.composer.v1.NodeConfig>;
            /**
             * The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
             */
            nodeCount?: pulumi.Input<number>;
            /**
             * The configuration used for the Private IP Cloud Composer environment.
             */
            privateEnvironmentConfig?: pulumi.Input<inputs.composer.v1.PrivateEnvironmentConfig>;
            /**
             * The configuration settings for software inside the environment.
             */
            softwareConfig?: pulumi.Input<inputs.composer.v1.SoftwareConfig>;
            /**
             * Optional. The configuration settings for the Airflow web server App Engine instance.
             */
            webServerConfig?: pulumi.Input<inputs.composer.v1.WebServerConfig>;
            /**
             * Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
             */
            webServerNetworkAccessControl?: pulumi.Input<inputs.composer.v1.WebServerNetworkAccessControl>;
        }
        /**
         * Configuration for controlling how IPs are allocated in the GKE cluster running the Apache Airflow software.
         */
        interface IPAllocationPolicy {
            /**
             * Optional. The IP address range used to allocate IP addresses to pods in the GKE cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            clusterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. The name of the GKE cluster's secondary range used to allocate IP addresses to pods. This field is applicable only when `use_ip_aliases` is true.
             */
            clusterSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Optional. The IP address range of the services IP addresses in this GKE cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            servicesIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. The name of the services' secondary range used to allocate IP addresses to the GKE cluster. This field is applicable only when `use_ip_aliases` is true.
             */
            servicesSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
             */
            useIpAliases?: pulumi.Input<boolean>;
        }
        /**
         * The configuration information for the Kubernetes Engine nodes running the Apache Airflow software.
         */
        interface NodeConfig {
            /**
             * Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Optional. The configuration for controlling how IPs are allocated in the GKE cluster.
             */
            ipAllocationPolicy?: pulumi.Input<inputs.composer.v1.IPAllocationPolicy>;
            /**
             * Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}". This `location` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}". The `machineType` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to "n1-standard-1".
             */
            machineType?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/global/networks/{networkId}". If unspecified, the "default" network ID in the environment's project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
             */
            network?: pulumi.Input<string>;
            /**
             * Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to ["https://www.googleapis.com/auth/cloud-platform"]. Cannot be updated.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The Google Cloud Platform Service Account to be used by the node VMs. If a service account is not specified, the "default" Compute Engine service account is used. Cannot be updated.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}" If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment's project and location.
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Configuration options for the private GKE cluster in a Cloud Composer environment.
         */
        interface PrivateClusterConfig {
            /**
             * Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
             */
            enablePrivateEndpoint?: pulumi.Input<boolean>;
            /**
             * Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of '172.16.0.0/23' is used.
             */
            masterIpv4CidrBlock?: pulumi.Input<string>;
        }
        /**
         * The configuration information for configuring a Private IP Cloud Composer environment.
         */
        interface PrivateEnvironmentConfig {
            /**
             * Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from `web_server_ipv4_cidr_block`.
             */
            cloudSqlIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true.
             */
            enablePrivateEnvironment?: pulumi.Input<boolean>;
            /**
             * Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
             */
            privateClusterConfig?: pulumi.Input<inputs.composer.v1.PrivateClusterConfig>;
            /**
             * Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from `private_cluster_config.master_ipv4_cidr_block` and `cloud_sql_ipv4_cidr_block`.
             */
            webServerIpv4CidrBlock?: pulumi.Input<string>;
        }
        /**
         * Specifies the selection and configuration of software inside the environment.
         */
        interface SoftwareConfig {
            /**
             * Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example "core-dags_are_paused_at_creation". Section names must not contain hyphens ("-"), opening square brackets ("["), or closing square brackets ("]"). The property name must not be empty and must not contain an equals sign ("=") or semicolon (";"). Section and property names must not contain a period ("."). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
             */
            airflowConfigOverrides?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes. Environment variable names must match the regular expression `a-zA-Z_*`. They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression `AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+`), and they cannot match any of the following reserved names: * `AIRFLOW_HOME` * `C_FORCE_ROOT` * `CONTAINER_NAME` * `DAGS_FOLDER` * `GCP_PROJECT` * `GCS_BUCKET` * `GKE_CLUSTER_NAME` * `SQL_DATABASE` * `SQL_INSTANCE` * `SQL_PASSWORD` * `SQL_PROJECT` * `SQL_REGION` * `SQL_USER`
             */
            envVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The version of the software running in the environment. This encapsulates both the version of Cloud Composer functionality and the version of Apache Airflow. It must match the regular expression `composer-([0-9]+\.[0-9]+\.[0-9]+|latest)-airflow-[0-9]+\.[0-9]+(\.[0-9]+.*)?`. When used as input, the server also checks if the provided version is supported and denies the request for an unsupported version. The Cloud Composer portion of the version is a [semantic version](https://semver.org) or `latest`. When the patch version is omitted, the current Cloud Composer patch version is selected. When `latest` is provided instead of an explicit version number, the server replaces `latest` with the current Cloud Composer version and stores that version number in the same field. The portion of the image version that follows *airflow-* is an official Apache Airflow repository [release name](https://github.com/apache/incubator-airflow/releases). See also [Version List](/composer/docs/concepts/versioning/composer-versions).
             */
            imageVersion?: pulumi.Input<string>;
            /**
             * Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as "numpy" and values are the lowercase extras and version specifier such as "==1.12.0", "[devel,gcp_api]", or "[devel]>=1.8.2, <1.9.2". To specify a package without pinning it to a version specifier, use the empty string as the value.
             */
            pypiPackages?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to '2' or '3'. If not specified, the default is '2'. Cannot be updated.
             */
            pythonVersion?: pulumi.Input<string>;
        }
        /**
         * The configuration settings for the Airflow web server App Engine instance.
         */
        interface WebServerConfig {
            /**
             * Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
             */
            machineType?: pulumi.Input<string>;
        }
        /**
         * Network-level access control policy for the Airflow web server.
         */
        interface WebServerNetworkAccessControl {
            /**
             * A collection of allowed IP ranges with descriptions.
             */
            allowedIpRanges?: pulumi.Input<pulumi.Input<inputs.composer.v1.AllowedIpRange>[]>;
        }
    }
    namespace v1beta1 {
        /**
         * Allowed IP range with user-provided description.
         */
        interface AllowedIpRange {
            /**
             * Optional. User-provided description. It must contain at most 300 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * IP address or range, defined using CIDR notation, of requests that this rule applies to. Examples: `192.168.1.1` or `192.168.0.0/16` or `2001:db8::/32` or `2001:0db8:0000:0042:0000:8a2e:0370:7334`. IP range prefixes should be properly truncated. For example, `1.2.3.4/24` should be truncated to `1.2.3.0/24`. Similarly, for IPv6, `2001:db8::1/32` should be truncated to `2001:db8::/32`.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The configuration of Cloud SQL instance that is used by the Apache Airflow software.
         */
        interface DatabaseConfig {
            /**
             * Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used.
             */
            machineType?: pulumi.Input<string>;
        }
        /**
         * The encryption options for the Composer environment and its dependencies.
         */
        interface EncryptionConfig {
            /**
             * Optional. Customer-managed Encryption Key available through Google's Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Configuration information for an environment.
         */
        interface EnvironmentConfig {
            /**
             * Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.
             */
            databaseConfig?: pulumi.Input<inputs.composer.v1beta1.DatabaseConfig>;
            /**
             * Optional. The encryption options for the Composer environment and its dependencies. Cannot be updated.
             */
            encryptionConfig?: pulumi.Input<inputs.composer.v1beta1.EncryptionConfig>;
            /**
             * Optional. The maintenance window is the period when Cloud Composer components may undergo maintenance. It is defined so that maintenance is not executed during peak hours or critical time periods. The system will not be under maintenance for every occurrence of this window, but when maintenance is planned, it will be scheduled during the window. The maintenance window period must encompass at least 12 hours per week. This may be split into multiple chunks, each with a size of at least 4 hours. If this value is omitted, Cloud Composer components may be subject to maintenance at any time.
             */
            maintenanceWindow?: pulumi.Input<inputs.composer.v1beta1.MaintenanceWindow>;
            /**
             * The configuration used for the Kubernetes Engine cluster.
             */
            nodeConfig?: pulumi.Input<inputs.composer.v1beta1.NodeConfig>;
            /**
             * The number of nodes in the Kubernetes Engine cluster that will be used to run this environment.
             */
            nodeCount?: pulumi.Input<number>;
            /**
             * The configuration used for the Private IP Cloud Composer environment.
             */
            privateEnvironmentConfig?: pulumi.Input<inputs.composer.v1beta1.PrivateEnvironmentConfig>;
            /**
             * The configuration settings for software inside the environment.
             */
            softwareConfig?: pulumi.Input<inputs.composer.v1beta1.SoftwareConfig>;
            /**
             * Optional. The configuration settings for the Airflow web server App Engine instance.
             */
            webServerConfig?: pulumi.Input<inputs.composer.v1beta1.WebServerConfig>;
            /**
             * Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.
             */
            webServerNetworkAccessControl?: pulumi.Input<inputs.composer.v1beta1.WebServerNetworkAccessControl>;
        }
        /**
         * Configuration for controlling how IPs are allocated in the GKE cluster.
         */
        interface IPAllocationPolicy {
            /**
             * Optional. The IP address range used to allocate IP addresses to pods in the cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both.
             */
            clusterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. The name of the cluster's secondary range used to allocate IP addresses to pods. Specify either `cluster_secondary_range_name` or `cluster_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
             */
            clusterSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Optional. The IP address range of the services IP addresses in this cluster. This field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. Specify `services_secondary_range_name` or `services_ipv4_cidr_block` but not both.
             */
            servicesIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. The name of the services' secondary range used to allocate IP addresses to the cluster. Specify either `services_secondary_range_name` or `services_ipv4_cidr_block` but not both. This field is applicable only when `use_ip_aliases` is true.
             */
            servicesSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created.
             */
            useIpAliases?: pulumi.Input<boolean>;
        }
        /**
         * The configuration settings for Cloud Composer maintenance window. The following example: { "startTime":"2019-08-01T01:00:00Z" "endTime":"2019-08-01T07:00:00Z" "recurrence":"FREQ=WEEKLY;BYDAY=TU,WE" } would define a maintenance window between 01 and 07 hours UTC during each Tuesday and Wednesday.
         */
        interface MaintenanceWindow {
            /**
             * Required. Maintenance window end time. It is used only to calculate the duration of the maintenance window. The value for end_time must be in the future, relative to `start_time`.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Required. Maintenance window recurrence. Format is a subset of [RFC-5545](https://tools.ietf.org/html/rfc5545) `RRULE`. The only allowed values for `FREQ` field are `FREQ=DAILY` and `FREQ=WEEKLY;BYDAY=...` Example values: `FREQ=WEEKLY;BYDAY=TU,WE`, `FREQ=DAILY`.
             */
            recurrence?: pulumi.Input<string>;
            /**
             * Required. Start time of the first recurrence of the maintenance window.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * The configuration information for the Kubernetes Engine nodes running the Apache Airflow software.
         */
        interface NodeConfig {
            /**
             * Optional. The disk size in GB used for node VMs. Minimum size is 20GB. If unspecified, defaults to 100GB. Cannot be updated.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Optional. The IPAllocationPolicy fields for the GKE cluster.
             */
            ipAllocationPolicy?: pulumi.Input<inputs.composer.v1beta1.IPAllocationPolicy>;
            /**
             * Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}". This `location` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}". The `machineType` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to "n1-standard-1".
             */
            machineType?: pulumi.Input<string>;
            /**
             * Optional. The maximum number of pods per node in the Cloud Composer GKE cluster. The value must be between 8 and 110 and it can be set only if the environment is VPC-native. The default value is 32. Values of this field will be propagated both to the `default-pool` node pool of the newly created GKE cluster, and to the default "Maximum Pods per Node" value which is used for newly created node pools if their value is not explicitly set during node pool creation. For more information, see [Optimizing IP address allocation] (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr). Cannot be updated.
             */
            maxPodsPerNode?: pulumi.Input<number>;
            /**
             * Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/global/networks/{networkId}". If unspecified, the default network in the environment's project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.
             */
            network?: pulumi.Input<string>;
            /**
             * Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to ["https://www.googleapis.com/auth/cloud-platform"]. Cannot be updated.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The Google Cloud Platform Service Account to be used by the node VMs. If a service account is not specified, the "default" Compute Engine service account is used. Cannot be updated.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}" If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment's project and location.
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * Optional. The list of instance tags applied to all node VMs. Tags are used to identify valid sources or targets for network firewalls. Each tag within the list must comply with [RFC1035](https://www.ietf.org/rfc/rfc1035.txt). Cannot be updated.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Configuration options for the private GKE cluster in a Cloud Composer environment.
         */
        interface PrivateClusterConfig {
            /**
             * Optional. If `true`, access to the public endpoint of the GKE cluster is denied.
             */
            enablePrivateEndpoint?: pulumi.Input<boolean>;
            /**
             * Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of '172.16.0.0/23' is used.
             */
            masterIpv4CidrBlock?: pulumi.Input<string>;
        }
        /**
         * The configuration information for configuring a Private IP Cloud Composer environment.
         */
        interface PrivateEnvironmentConfig {
            /**
             * Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from web_server_ipv4_cidr_block
             */
            cloudSqlIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true.
             */
            enablePrivateEnvironment?: pulumi.Input<boolean>;
            /**
             * Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.
             */
            privateClusterConfig?: pulumi.Input<inputs.composer.v1beta1.PrivateClusterConfig>;
            /**
             * Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block.
             */
            webServerIpv4CidrBlock?: pulumi.Input<string>;
        }
        /**
         * Specifies the selection and configuration of software inside the environment.
         */
        interface SoftwareConfig {
            /**
             * Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example "core-dags_are_paused_at_creation". Section names must not contain hyphens ("-"), opening square brackets ("["), or closing square brackets ("]"). The property name must not be empty and must not contain an equals sign ("=") or semicolon (";"). Section and property names must not contain a period ("."). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.
             */
            airflowConfigOverrides?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes. Environment variable names must match the regular expression `a-zA-Z_*`. They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression `AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+`), and they cannot match any of the following reserved names: * `AIRFLOW_HOME` * `C_FORCE_ROOT` * `CONTAINER_NAME` * `DAGS_FOLDER` * `GCP_PROJECT` * `GCS_BUCKET` * `GKE_CLUSTER_NAME` * `SQL_DATABASE` * `SQL_INSTANCE` * `SQL_PASSWORD` * `SQL_PROJECT` * `SQL_REGION` * `SQL_USER`
             */
            envVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The version of the software running in the environment. This encapsulates both the version of Cloud Composer functionality and the version of Apache Airflow. It must match the regular expression `composer-([0-9]+\.[0-9]+\.[0-9]+|latest)-airflow-[0-9]+\.[0-9]+(\.[0-9]+.*)?`. When used as input, the server also checks if the provided version is supported and denies the request for an unsupported version. The Cloud Composer portion of the version is a [semantic version](https://semver.org) or `latest`. When the patch version is omitted, the current Cloud Composer patch version is selected. When `latest` is provided instead of an explicit version number, the server replaces `latest` with the current Cloud Composer version and stores that version number in the same field. The portion of the image version that follows *airflow-* is an official Apache Airflow repository [release name](https://github.com/apache/incubator-airflow/releases). See also [Version List](/composer/docs/concepts/versioning/composer-versions).
             */
            imageVersion?: pulumi.Input<string>;
            /**
             * Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as "numpy" and values are the lowercase extras and version specifier such as "==1.12.0", "[devel,gcp_api]", or "[devel]>=1.8.2, <1.9.2". To specify a package without pinning it to a version specifier, use the empty string as the value.
             */
            pypiPackages?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to '2' or '3'. If not specified, the default is '2'. Cannot be updated.
             */
            pythonVersion?: pulumi.Input<string>;
        }
        /**
         * The configuration settings for the Airflow web server App Engine instance.
         */
        interface WebServerConfig {
            /**
             * Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.
             */
            machineType?: pulumi.Input<string>;
        }
        /**
         * Network-level access control policy for the Airflow web server.
         */
        interface WebServerNetworkAccessControl {
            /**
             * A collection of allowed IP ranges with descriptions.
             */
            allowedIpRanges?: pulumi.Input<pulumi.Input<inputs.composer.v1beta1.AllowedIpRange>[]>;
        }
    }
}
export declare namespace compute {
    namespace alpha {
        /**
         * A specification of the type and number of accelerator cards attached to the instance.
         */
        interface AcceleratorConfig {
            /**
             * The number of the guest accelerator cards exposed to this instance.
             */
            acceleratorCount?: pulumi.Input<number>;
            /**
             * Full or partial URL of the accelerator type resource to attach to this instance. For example: projects/my-project/zones/us-central1-c/acceleratorTypes/nvidia-tesla-p100 If you are creating an instance template, specify only the accelerator name. See GPUs on Compute Engine for a full list of accelerator types.
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * An access configuration attached to an instance's network interface. Only one access config per instance is supported.
         */
        interface AccessConfig {
            /**
             * [Output Only] The first IPv6 address of the external IPv6 range associated with this instance, prefix length is stored in externalIpv6PrefixLength in ipv6AccessConfig. The field is output only, an IPv6 address from a subnetwork associated with the instance will be allocated dynamically.
             */
            externalIpv6?: pulumi.Input<string>;
            /**
             * [Output Only] The prefix length of the external IPv6 range.
             */
            externalIpv6PrefixLength?: pulumi.Input<number>;
            /**
             * [Output Only] Type of the resource. Always compute#accessConfig for access configs.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of this access configuration. The default and recommended name is External NAT, but you can use any arbitrary string, such as My external IP or Network Access.
             */
            name?: pulumi.Input<string>;
            /**
             * An external IP address associated with this instance. Specify an unused static external IP address available to the project or leave this field undefined to use an IP from a shared ephemeral IP address pool. If you specify a static external IP address, it must live in the same region as the zone of the instance.
             */
            natIP?: pulumi.Input<string>;
            /**
             * This signifies the networking tier used for configuring this access configuration and can only take the following values: PREMIUM, STANDARD.
             *
             * If an AccessConfig is specified without a valid external IP address, an ephemeral IP will be created with this networkTier.
             *
             * If an AccessConfig with a valid external IP address is specified, it must match that of the networkTier associated with the Address resource owning that IP.
             */
            networkTier?: pulumi.Input<string>;
            /**
             * [Output Only] The public DNS domain name for the instance.
             */
            publicDnsName?: pulumi.Input<string>;
            /**
             * The DNS domain name for the public PTR record. You can set this field only if the `setPublicPtr` field is enabled.
             */
            publicPtrDomainName?: pulumi.Input<string>;
            /**
             * Specifies whether a public DNS 'A' record should be created for the external IP address of this access configuration.
             */
            setPublicDns?: pulumi.Input<boolean>;
            /**
             * Specifies whether a public DNS 'PTR' record should be created to map the external IP address of the instance to a DNS domain name.
             */
            setPublicPtr?: pulumi.Input<boolean>;
            /**
             * The type of configuration. The default and only option is ONE_TO_ONE_NAT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled).
         */
        interface AdvancedMachineFeatures {
            /**
             * Whether to enable nested virtualization or not (default is false).
             */
            enableNestedVirtualization?: pulumi.Input<boolean>;
            /**
             * The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
             */
            threadsPerCore?: pulumi.Input<number>;
            /**
             * The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance's nominal CPU count and the underlying platform's SMT width.
             */
            visibleCoreCount?: pulumi.Input<number>;
        }
        /**
         * An alias IP range attached to an instance's network interface.
         */
        interface AliasIpRange {
            /**
             * The IP alias ranges to allocate for this interface. This IP CIDR range must belong to the specified subnetwork and cannot contain IP addresses reserved by system or used by other network interfaces. This range may be a single IP address (such as 10.2.3.4), a netmask (such as /24) or a CIDR-formatted string (such as 10.1.2.0/24).
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name of a subnetwork secondary IP range from which to allocate an IP alias range. If not specified, the primary range of the subnetwork is used.
             */
            subnetworkRangeName?: pulumi.Input<string>;
        }
        interface AllocationShareSettings {
            /**
             * A List of Project names to specify consumer projects for this shared-reservation. This is only valid when share_type's value is SPECIFIC_PROJECTS.
             */
            projects?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Type of sharing for this shared-reservation
             */
            shareType?: pulumi.Input<string>;
        }
        interface AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk {
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
        }
        /**
         * Properties of the SKU instances being reserved. Next ID: 9
         */
        interface AllocationSpecificSKUAllocationReservedInstanceProperties {
            /**
             * Specifies accelerator type and count.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AcceleratorConfig>[]>;
            /**
             * Specifies amount of local ssd to reserve with each instance. The type of disk is local-ssd.
             */
            localSsds?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk>[]>;
            /**
             * An opaque location hint used to place the allocation close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * Specifies type of machine (name only) which has fixed number of vCPUs and fixed amount of memory. This also includes specifying custom machine type following custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY pattern.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Specifies the number of hours after reservation creation where instances using the reservation won't be scheduled for maintenance.
             */
            maintenanceFreezeDurationHours?: pulumi.Input<number>;
            /**
             * Specifies whether this VM may be a stable fleet VM. Setting this to "Periodic" designates this VM as a Stable Fleet VM.
             *
             * See go/stable-fleet-ug for more details.
             */
            maintenanceInterval?: pulumi.Input<string>;
            /**
             * Minimum cpu platform the reservation.
             */
            minCpuPlatform?: pulumi.Input<string>;
        }
        /**
         * This reservation type allows to pre allocate specific instance configuration.
         */
        interface AllocationSpecificSKUReservation {
            /**
             * Specifies the number of resources that are allocated.
             */
            count?: pulumi.Input<string>;
            /**
             * [Output Only] Indicates how many instances are in use.
             */
            inUseCount?: pulumi.Input<string>;
            /**
             * The instance properties for the reservation.
             */
            instanceProperties?: pulumi.Input<inputs.compute.alpha.AllocationSpecificSKUAllocationReservedInstanceProperties>;
        }
        /**
         * An instance-attached disk resource.
         */
        interface AttachedDisk {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             */
            boot?: pulumi.Input<boolean>;
            /**
             * Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance.
             *
             * If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Encrypts or decrypts a disk using a customer-supplied encryption key.
             *
             * If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key.
             *
             * If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance.
             *
             * If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.alpha.CustomerEncryptionKey>;
            /**
             * The size of the disk in GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * [Input Only] Whether to force attach the regional disk even if it's currently attached to another instance. If you try to force attach a zonal disk to an instance, you will receive an error.
             */
            forceAttach?: pulumi.Input<boolean>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.alpha.GuestOsFeature>[]>;
            /**
             * [Output Only] A zero-based index to this disk, where 0 is reserved for the boot disk. If you have many disks attached to an instance, each disk would have a unique index number.
             */
            index?: pulumi.Input<number>;
            /**
             * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
             *
             * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
             */
            initializeParams?: pulumi.Input<inputs.compute.alpha.AttachedDiskInitializeParams>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. Persistent disks must always use SCSI and the request will fail if you attempt to attach a persistent disk in any other format than SCSI. Local SSDs can use either NVME or SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#attachedDisk for attached disks.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Any valid publicly visible licenses.
             */
            licenses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If not specified, the default is to attach the disk in READ_WRITE mode.
             */
            mode?: pulumi.Input<string>;
            /**
             * For LocalSSD disks on VM Instances in STOPPED or SUSPENDED state, this field is set to PRESERVED if the LocalSSD data has been saved to a persistent location by customer request. (see the discard_local_ssd option on Stop/Suspend). Read-only in the api.
             */
            savedState?: pulumi.Input<string>;
            /**
             * [Output Only] shielded vm initial state stored on disk
             */
            shieldedInstanceInitialState?: pulumi.Input<inputs.compute.alpha.InitialStateConfig>;
            /**
             * Specifies a valid partial or full URL to an existing Persistent Disk resource. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * If desired, you can also attach existing non-root persistent disks using this property. This field is only applicable for persistent disks.
             *
             * Note that for InstanceTemplate, specify the disk name, not the URL for the disk.
             */
            source?: pulumi.Input<string>;
            /**
             * Specifies the type of the disk, either SCRATCH or PERSISTENT. If not specified, the default is PERSISTENT.
             */
            type?: pulumi.Input<string>;
            /**
             * [Output Only] A list of user provided licenses. It represents a list of URLs to the license resource. Unlike regular licenses, user provided licenses can be modified after the disk is created.
             */
            userLicenses?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
         *
         * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
         */
        interface AttachedDiskInitializeParams {
            /**
             * An optional description. Provide this property when creating the disk.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies the disk name. If not specified, the default is to use the name of the instance. If a disk with the same name already exists in the given region, the existing disk is attached to the new instance and the new disk is not created.
             */
            diskName?: pulumi.Input<string>;
            /**
             * Specifies the size of the disk in base-2 GB. The size must be at least 10 GB. If you specify a sourceImage, which is required for boot disks, the default size is the size of the sourceImage. If you do not specify a sourceImage, the default disk size is 500 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk type to use to create the instance. If not specified, the default is pd-standard, specified using the full URL. For example:
             * https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/pd-standard
             *
             *
             * Other values include pd-ssd and local-ssd. If you define this field, you can provide either the full or partial URL. For example, the following are valid values:
             * - https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/diskType
             * - projects/project/zones/zone/diskTypes/diskType
             * - zones/zone/diskTypes/diskType  Note that for InstanceTemplate, this is the name of the disk type, not URL.
             */
            diskType?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             *
             * Guest OS features are applied by merging initializeParams.guestOsFeatures and disks.guestOsFeatures
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.alpha.GuestOsFeature>[]>;
            /**
             * Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Indicates whether or not the disk can be read/write attached to more than one instance.
             */
            multiWriter?: pulumi.Input<boolean>;
            /**
             * Specifies which action to take on instance update with this disk. Default is to use the existing disk.
             */
            onUpdateAction?: pulumi.Input<string>;
            /**
             * Indicates how many IOPS must be provisioned for the disk.
             */
            provisionedIops?: pulumi.Input<string>;
            /**
             * URLs of the zones where the disk should be replicated to. Only applicable for regional resources.
             */
            replicaZones?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Resource policies applied to this disk for automatic snapshot creations. Specified using the full or partial URL. For instance template, specify only the resource policy name.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image:
             * projects/debian-cloud/global/images/family/debian-9
             *
             *
             * Alternatively, use a specific version of a public operating system image:
             * projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD
             *
             *
             * To create a disk with a custom image that you created, specify the image name in the following format:
             * global/images/my-custom-image
             *
             *
             * You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name:
             * global/images/family/my-image-family
             *
             *
             * If the source image is deleted later, this field will not be set.
             */
            sourceImage?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
             */
            sourceImageEncryptionKey?: pulumi.Input<inputs.compute.alpha.CustomerEncryptionKey>;
            /**
             * The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD.
             *
             * To create a disk with a snapshot that you created, specify the snapshot name in the following format:
             * global/snapshots/my-backup
             *
             *
             * If the source snapshot is deleted later, this field will not be set.
             */
            sourceSnapshot?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source snapshot.
             */
            sourceSnapshotEncryptionKey?: pulumi.Input<inputs.compute.alpha.CustomerEncryptionKey>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.
         *
         * If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.
         *
         * Example Policy with multiple AuditConfigs:
         *
         * { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] }
         *
         * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AuditLogConfig>[]>;
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example:
         *
         * { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] }
         *
         * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of [Binding.members][].
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            ignoreChildExemptions?: pulumi.Input<boolean>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] The authentication settings for the backend service. The authentication settings for the backend service.
         */
        interface AuthenticationPolicy {
            /**
             * List of authentication methods that can be used for origin authentication. Similar to peers, these will be evaluated in order the first valid one will be used to set origin identity. If none of these methods pass, the request will be rejected with authentication failed error (401). Leave the list empty if origin authentication is not required.
             */
            origins?: pulumi.Input<pulumi.Input<inputs.compute.alpha.OriginAuthenticationMethod>[]>;
            /**
             * List of authentication methods that can be used for peer authentication. They will be evaluated in order the first valid one will be used to set peer identity. If none of these methods pass, the request will be rejected with authentication failed error (401). Leave the list empty if peer authentication is not required.
             */
            peers?: pulumi.Input<pulumi.Input<inputs.compute.alpha.PeerAuthenticationMethod>[]>;
            /**
             * Define whether peer or origin identity should be used for principal. Default value is USE_PEER. If peer (or origin) identity is not available, either because peer/origin authentication is not defined, or failed, principal will be left unset. In other words, binding rule does not affect the decision to accept or reject request. This field can be set to one of the following: USE_PEER: Principal will be set to the identity from peer authentication. USE_ORIGIN: Principal will be set to the identity from origin authentication.
             */
            principalBinding?: pulumi.Input<string>;
            /**
             * Configures the mechanism to obtain server-side security certificates and identity information.
             */
            serverTlsContext?: pulumi.Input<inputs.compute.alpha.TlsContext>;
        }
        /**
         * [Deprecated] Authorization configuration provides service-level and method-level access control for a service. control for a service.
         */
        interface AuthorizationConfig {
            /**
             * List of RbacPolicies.
             */
            policies?: pulumi.Input<pulumi.Input<inputs.compute.alpha.RbacPolicy>[]>;
        }
        /**
         * Authorization-related information used by Cloud Audit Logging.
         */
        interface AuthorizationLoggingOptions {
            /**
             * The type of the permission that was checked.
             */
            permissionType?: pulumi.Input<string>;
        }
        interface AutoscalerStatusDetails {
            /**
             * The status message.
             */
            message?: pulumi.Input<string>;
            /**
             * The type of error, warning, or notice returned. Current set of possible values:
             * - ALL_INSTANCES_UNHEALTHY (WARNING): All instances in the instance group are unhealthy (not in RUNNING state).
             * - BACKEND_SERVICE_DOES_NOT_EXIST (ERROR): There is no backend service attached to the instance group.
             * - CAPPED_AT_MAX_NUM_REPLICAS (WARNING): Autoscaler recommends a size greater than maxNumReplicas.
             * - CUSTOM_METRIC_DATA_POINTS_TOO_SPARSE (WARNING): The custom metric samples are not exported often enough to be a credible base for autoscaling.
             * - CUSTOM_METRIC_INVALID (ERROR): The custom metric that was specified does not exist or does not have the necessary labels.
             * - MIN_EQUALS_MAX (WARNING): The minNumReplicas is equal to maxNumReplicas. This means the autoscaler cannot add or remove instances from the instance group.
             * - MISSING_CUSTOM_METRIC_DATA_POINTS (WARNING): The autoscaler did not receive any data from the custom metric configured for autoscaling.
             * - MISSING_LOAD_BALANCING_DATA_POINTS (WARNING): The autoscaler is configured to scale based on a load balancing signal but the instance group has not received any requests from the load balancer.
             * - MODE_OFF (WARNING): Autoscaling is turned off. The number of instances in the group won't change automatically. The autoscaling configuration is preserved.
             * - MODE_ONLY_UP (WARNING): Autoscaling is in the "Autoscale only out" mode. The autoscaler can add instances but not remove any.
             * - MORE_THAN_ONE_BACKEND_SERVICE (ERROR): The instance group cannot be autoscaled because it has more than one backend service attached to it.
             * - NOT_ENOUGH_QUOTA_AVAILABLE (ERROR): There is insufficient quota for the necessary resources, such as CPU or number of instances.
             * - REGION_RESOURCE_STOCKOUT (ERROR): Shown only for regional autoscalers: there is a resource stockout in the chosen region.
             * - SCALING_TARGET_DOES_NOT_EXIST (ERROR): The target to be scaled does not exist.
             * - UNSUPPORTED_MAX_RATE_LOAD_BALANCING_CONFIGURATION (ERROR): Autoscaling does not work with an HTTP/S load balancer that has been configured for maxRate.
             * - ZONE_RESOURCE_STOCKOUT (ERROR): For zonal autoscalers: there is a resource stockout in the chosen zone. For regional autoscalers: in at least one of the zones you're using there is a resource stockout.  New values might be added in the future. Some of the values might not be available in all API versions.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Cloud Autoscaler policy.
         */
        interface AutoscalingPolicy {
            /**
             * The number of seconds that the autoscaler waits before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. The default time autoscaler waits is 60 seconds.
             *
             * Virtual machine initialization times might vary because of numerous factors. We recommend that you test how long an instance may take to initialize. To do this, create an instance and time the startup process.
             */
            coolDownPeriodSec?: pulumi.Input<number>;
            /**
             * Defines the CPU utilization policy that allows the autoscaler to scale based on the average CPU utilization of a managed instance group.
             */
            cpuUtilization?: pulumi.Input<inputs.compute.alpha.AutoscalingPolicyCpuUtilization>;
            /**
             * Configuration parameters of autoscaling based on a custom metric.
             */
            customMetricUtilizations?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AutoscalingPolicyCustomMetricUtilization>[]>;
            /**
             * Configuration parameters of autoscaling based on load balancer.
             */
            loadBalancingUtilization?: pulumi.Input<inputs.compute.alpha.AutoscalingPolicyLoadBalancingUtilization>;
            /**
             * The maximum number of instances that the autoscaler can scale out to. This is required when creating or updating an autoscaler. The maximum number of replicas must not be lower than minimal number of replicas.
             */
            maxNumReplicas?: pulumi.Input<number>;
            /**
             * The minimum number of replicas that the autoscaler can scale in to. This cannot be less than 0. If not provided, autoscaler chooses a default value depending on maximum number of instances allowed.
             */
            minNumReplicas?: pulumi.Input<number>;
            /**
             * Defines operating mode for this policy.
             */
            mode?: pulumi.Input<string>;
            scaleDownControl?: pulumi.Input<inputs.compute.alpha.AutoscalingPolicyScaleDownControl>;
            scaleInControl?: pulumi.Input<inputs.compute.alpha.AutoscalingPolicyScaleInControl>;
            /**
             * Scaling schedules defined for an autoscaler. Multiple schedules can be set on an autoscaler, and they can overlap. During overlapping periods the greatest min_required_replicas of all scaling schedules is applied. Up to 128 scaling schedules are allowed.
             */
            scalingSchedules?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * CPU utilization policy.
         */
        interface AutoscalingPolicyCpuUtilization {
            /**
             * Indicates whether predictive autoscaling based on CPU metric is enabled. Valid values are:
             *
             * * NONE (default). No predictive method is used. The autoscaler scales the group to meet current demand based on real-time metrics. * OPTIMIZE_AVAILABILITY. Predictive autoscaling improves availability by monitoring daily and weekly load patterns and scaling out ahead of anticipated demand.
             */
            predictiveMethod?: pulumi.Input<string>;
            /**
             * The target CPU utilization that the autoscaler maintains. Must be a float value in the range (0, 1]. If not specified, the default is 0.6.
             *
             * If the CPU level is below the target utilization, the autoscaler scales in the number of instances until it reaches the minimum number of instances you specified or until the average CPU of your instances reaches the target utilization.
             *
             * If the average CPU is above the target utilization, the autoscaler scales out until it reaches the maximum number of instances you specified or until the average utilization reaches the target utilization.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Custom utilization metric policy.
         */
        interface AutoscalingPolicyCustomMetricUtilization {
            /**
             * A filter string, compatible with a Stackdriver Monitoring filter string for TimeSeries.list API call. This filter is used to select a specific TimeSeries for the purpose of autoscaling and to determine whether the metric is exporting per-instance or per-group data.
             *
             * For the filter to be valid for autoscaling purposes, the following rules apply:
             * - You can only use the AND operator for joining selectors.
             * - You can only use direct equality comparison operator (=) without any functions for each selector.
             * - You can specify the metric in both the filter string and in the metric field. However, if specified in both places, the metric must be identical.
             * - The monitored resource type determines what kind of values are expected for the metric. If it is a gce_instance, the autoscaler expects the metric to include a separate TimeSeries for each instance in a group. In such a case, you cannot filter on resource labels.
             * If the resource type is any other value, the autoscaler expects this metric to contain values that apply to the entire autoscaled instance group and resource label filtering can be performed to point autoscaler at the correct TimeSeries to scale upon. This is called a per-group metric for the purpose of autoscaling.
             *
             * If not specified, the type defaults to gce_instance.
             *
             * Try to provide a filter that is selective enough to pick just one TimeSeries for the autoscaled group or for each of the instances (if you are using gce_instance resource type). If multiple TimeSeries are returned upon the query execution, the autoscaler will sum their respective values to obtain its scaling value.
             */
            filter?: pulumi.Input<string>;
            /**
             * The identifier (type) of the Stackdriver Monitoring metric. The metric cannot have negative values.
             *
             * The metric must have a value type of INT64 or DOUBLE.
             */
            metric?: pulumi.Input<string>;
            /**
             * If scaling is based on a per-group metric value that represents the total amount of work to be done or resource usage, set this value to an amount assigned for a single instance of the scaled group. Autoscaler keeps the number of instances proportional to the value of this metric. The metric itself does not change value due to group resizing.
             *
             * A good metric to use with the target is for example pubsub.googleapis.com/subscription/num_undelivered_messages or a custom metric exporting the total number of requests coming to your instances.
             *
             * A bad example would be a metric exporting an average or median latency, since this value can't include a chunk assignable to a single instance, it could be better used with utilization_target instead.
             */
            singleInstanceAssignment?: pulumi.Input<number>;
            /**
             * The target value of the metric that autoscaler maintains. This must be a positive value. A utilization metric scales number of virtual machines handling requests to increase or decrease proportionally to the metric.
             *
             * For example, a good metric to use as a utilization_target is https://www.googleapis.com/compute/v1/instance/network/received_bytes_count. The autoscaler works to keep this value constant for each of the instances.
             */
            utilizationTarget?: pulumi.Input<number>;
            /**
             * Defines how target utilization value is expressed for a Stackdriver Monitoring metric. Either GAUGE, DELTA_PER_SECOND, or DELTA_PER_MINUTE.
             */
            utilizationTargetType?: pulumi.Input<string>;
        }
        /**
         * Configuration parameters of autoscaling based on load balancing.
         */
        interface AutoscalingPolicyLoadBalancingUtilization {
            /**
             * Fraction of backend capacity utilization (set in HTTP(S) load balancing configuration) that the autoscaler maintains. Must be a positive float value. If not defined, the default is 0.8.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Configuration that allows for slower scale in so that even if Autoscaler recommends an abrupt scale in of a MIG, it will be throttled as specified by the parameters below.
         */
        interface AutoscalingPolicyScaleDownControl {
            /**
             * Maximum allowed number (or %) of VMs that can be deducted from the peak recommendation during the window autoscaler looks at when computing recommendations. Possibly all these VMs can be deleted at once so user service needs to be prepared to lose that many VMs in one step.
             */
            maxScaledDownReplicas?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
            /**
             * How far back autoscaling looks when computing recommendations to include directives regarding slower scale in, as described above.
             */
            timeWindowSec?: pulumi.Input<number>;
        }
        /**
         * Configuration that allows for slower scale in so that even if Autoscaler recommends an abrupt scale in of a MIG, it will be throttled as specified by the parameters below.
         */
        interface AutoscalingPolicyScaleInControl {
            /**
             * Maximum allowed number (or %) of VMs that can be deducted from the peak recommendation during the window autoscaler looks at when computing recommendations. Possibly all these VMs can be deleted at once so user service needs to be prepared to lose that many VMs in one step.
             */
            maxScaledInReplicas?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
            /**
             * How far back autoscaling looks when computing recommendations to include directives regarding slower scale in, as described above.
             */
            timeWindowSec?: pulumi.Input<number>;
        }
        /**
         * Message containing information of one individual backend.
         */
        interface Backend {
            /**
             * Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see  Connection balancing mode.
             */
            balancingMode?: pulumi.Input<string>;
            /**
             * A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
             *
             * Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            capacityScaler?: pulumi.Input<number>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
             */
            failover?: pulumi.Input<boolean>;
            /**
             * The fully-qualified URL of an instance group or network endpoint group (NEG) resource. The type of backend that a backend service supports depends on the backend service's loadBalancingScheme.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL (except Network Load Balancing),  INTERNAL_SELF_MANAGED, or INTERNAL_MANAGED , the backend can be either an instance group or a NEG. The backends on the backend service must be either all instance groups or all NEGs. You cannot mix instance group and NEG backends on the same backend service.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL for Network Load Balancing or INTERNAL for Internal TCP/UDP Load Balancing, the backend must be an instance group. NEGs are not supported.
             *
             * For regional services, the backend must be in the same region as the backend service.
             *
             * You must use the fully-qualified URL (starting with https://www.googleapis.com/) to specify the instance group or NEG. Partial URLs are not supported.
             */
            group?: pulumi.Input<string>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerInstance?: pulumi.Input<number>;
            /**
             * Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRate?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerInstance?: pulumi.Input<number>;
            maxUtilization?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend bucket.
         */
        interface BackendBucketCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.alpha.BackendBucketCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.alpha.BackendBucketCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendBucketCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendBucketCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend service.
         */
        interface BackendServiceCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.alpha.BackendServiceCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * The CacheKeyPolicy for this CdnPolicy.
             */
            cacheKeyPolicy?: pulumi.Input<inputs.compute.alpha.CacheKeyPolicy>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.alpha.BackendServiceCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendServiceCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendServiceCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Connection Tracking configuration for this BackendService.
         */
        interface BackendServiceConnectionTrackingPolicy {
            /**
             * Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL.
             *
             * If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP.
             *
             * If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy).
             *
             * If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
             */
            connectionPersistenceOnUnhealthyBackends?: pulumi.Input<string>;
            /**
             * Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds).
             *
             * For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours.
             *
             * For NLB the minimum(default) is 60 seconds and the maximum is 16 hours.
             *
             * This field will be supported only if the Connection Tracking key is less than 5-tuple.
             */
            idleTimeoutSec?: pulumi.Input<number>;
            /**
             * Specifies the key used for connection tracking. There are two options:
             *
             * PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol.
             *
             * PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
             */
            trackingMode?: pulumi.Input<string>;
        }
        /**
         * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. On failover or failback, this field indicates whether connection draining will be honored. GCP has a fixed connection draining timeout of 10 minutes. A setting of true terminates existing TCP connections to the active pool during failover and failback, immediately draining traffic. A setting of false allows existing TCP connections to persist, even on VMs no longer in the active pool, for up to the duration of the connection draining timeout (10 minutes).
         */
        interface BackendServiceFailoverPolicy {
            /**
             * This can be set to true only if the protocol is TCP.
             *
             * The default is false.
             */
            disableConnectionDrainOnFailover?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing, If set to true, connections to the load balancer are dropped when all primary and all backup backend VMs are unhealthy.If set to false, connections are distributed among all primary VMs when all primary and all backup backend VMs are unhealthy. The default is false.
             */
            dropTrafficIfUnhealthy?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. The value of the field must be in the range [0, 1]. If the value is 0, the load balancer performs a failover when the number of healthy primary VMs equals zero. For all other values, the load balancer performs a failover when the total number of healthy primary VMs is less than this ratio.
             */
            failoverRatio?: pulumi.Input<number>;
        }
        /**
         * Identity-Aware Proxy
         */
        interface BackendServiceIAP {
            /**
             * Whether the serving infrastructure will authenticate and authorize all incoming requests. If true, the oauth2ClientId and oauth2ClientSecret fields must be non-empty.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * OAuth2 client ID to use for the authentication flow.
             */
            oauth2ClientId?: pulumi.Input<string>;
            /**
             * [Input Only] OAuth client info required to generate client id to be used for IAP.
             */
            oauth2ClientInfo?: pulumi.Input<inputs.compute.alpha.BackendServiceIAPOAuth2ClientInfo>;
            /**
             * OAuth2 client secret to use for the authentication flow. For security reasons, this value cannot be retrieved via the API. Instead, the SHA-256 hash of the value is returned in the oauth2ClientSecretSha256 field.
             */
            oauth2ClientSecret?: pulumi.Input<string>;
            /**
             * [Output Only] SHA256 hash value for the field oauth2_client_secret above.
             */
            oauth2ClientSecretSha256?: pulumi.Input<string>;
        }
        interface BackendServiceIAPOAuth2ClientInfo {
            /**
             * Application name to be used in OAuth consent screen.
             */
            applicationName?: pulumi.Input<string>;
            /**
             * Name of the client to be generated. Optional - If not provided, the name will be autogenerated by the backend.
             */
            clientName?: pulumi.Input<string>;
            /**
             * Developer's information to be used in OAuth consent screen.
             */
            developerEmailAddress?: pulumi.Input<string>;
        }
        /**
         * The available logging options for the load balancer traffic served by this backend service.
         */
        interface BackendServiceLogConfig {
            /**
             * This field denotes whether to enable logging for the load balancer traffic served by this backend service.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified if logging is enabled for this backend service. The value of the field must be in [0, 1]. This configures the sampling rate of requests to the load balancer where 1.0 means all logged requests are reported and 0.0 means no logged requests are reported. The default value is 1.0.
             */
            sampleRate?: pulumi.Input<number>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            bindingId?: pulumi.Input<string>;
            /**
             * The condition that is associated with this binding.
             *
             * If the condition evaluates to `true`, then this binding applies to the current request.
             *
             * If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.
             *
             * To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.compute.alpha.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
             *
             * * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
             *
             * * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
             *
             * * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` .
             *
             *
             *
             * * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
             *
             * * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
             *
             * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding.
             *
             * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding.
             *
             * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
             *
             *
             *
             * * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Message containing what to include in the cache key for a request for Cloud CDN.
         */
        interface CacheKeyPolicy {
            /**
             * If true, requests to different hosts will be cached separately.
             */
            includeHost?: pulumi.Input<boolean>;
            /**
             * If true, http and https requests will be cached separately.
             */
            includeProtocol?: pulumi.Input<boolean>;
            /**
             * If true, include query string parameters in the cache key according to query_string_whitelist and query_string_blacklist. If neither is set, the entire query string will be included. If false, the query string will be excluded from the cache key entirely.
             */
            includeQueryString?: pulumi.Input<boolean>;
            /**
             * Names of query string parameters to exclude in cache keys. All other parameters will be included. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringBlacklist?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Names of query string parameters to include in cache keys. All other parameters will be excluded. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringWhitelist?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Deprecated] gRPC call credentials to access the SDS server. gRPC call credentials to access the SDS server.
         */
        interface CallCredentials {
            /**
             * The type of call credentials to use for GRPC requests to the SDS server. This field can be set to one of the following:
             * - GCE_VM: The local GCE VM service account credentials are used to access the SDS server.
             * - FROM_PLUGIN: Custom authenticator credentials are used to access the SDS server.
             */
            callCredentialType?: pulumi.Input<string>;
            /**
             * Custom authenticator credentials. Valid if callCredentialType is FROM_PLUGIN.
             */
            fromPlugin?: pulumi.Input<inputs.compute.alpha.MetadataCredentialsFromPlugin>;
        }
        /**
         * [Deprecated] gRPC channel credentials to access the SDS server. gRPC channel credentials to access the SDS server.
         */
        interface ChannelCredentials {
            /**
             * The call credentials to access the SDS server.
             */
            certificates?: pulumi.Input<inputs.compute.alpha.TlsCertificatePaths>;
            /**
             * The channel credentials to access the SDS server. This field can be set to one of the following: CERTIFICATES: Use TLS certificates to access the SDS server. GCE_VM: Use local GCE VM credentials to access the SDS server.
             */
            channelCredentialType?: pulumi.Input<string>;
        }
        /**
         * Settings controlling the volume of connections to a backend service.
         */
        interface CircuitBreakers {
            /**
             * The timeout for new network connections to hosts.
             */
            connectTimeout?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * The maximum number of connections to the backend service. If not specified, there is no limit.
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * The maximum number of pending requests allowed to the backend service. If not specified, there is no limit.
             */
            maxPendingRequests?: pulumi.Input<number>;
            /**
             * The maximum number of parallel requests that allowed to the backend service. If not specified, there is no limit.
             */
            maxRequests?: pulumi.Input<number>;
            /**
             * Maximum requests for a single connection to the backend service. This parameter is respected by both the HTTP/1.1 and HTTP/2 implementations. If not specified, there is no limit. Setting this parameter to 1 will effectively disable keep alive.
             */
            maxRequestsPerConnection?: pulumi.Input<number>;
            /**
             * The maximum number of parallel retries allowed to the backend cluster. If not specified, the default is 1.
             */
            maxRetries?: pulumi.Input<number>;
        }
        /**
         * [Deprecated] The client side authentication settings for connection originating from the backend service. the backend service.
         */
        interface ClientTlsSettings {
            /**
             * Configures the mechanism to obtain client-side security certificates and identity information. This field is only applicable when mode is set to MUTUAL.
             */
            clientTlsContext?: pulumi.Input<inputs.compute.alpha.TlsContext>;
            /**
             * Indicates whether connections to this port should be secured using TLS. The value of this field determines how TLS is enforced. This can be set to one of the following values: DISABLE: Do not setup a TLS connection to the backends. SIMPLE: Originate a TLS connection to the backends. MUTUAL: Secure connections to the backends using mutual TLS by presenting client certificates for authentication.
             */
            mode?: pulumi.Input<string>;
            /**
             * SNI string to present to the server during TLS handshake. This field is applicable only when mode is SIMPLE or MUTUAL.
             */
            sni?: pulumi.Input<string>;
            /**
             * A list of alternate names to verify the subject identity in the certificate.If specified, the proxy will verify that the server certificate's subject alt name matches one of the specified values. This field is applicable only when mode is SIMPLE or MUTUAL.
             */
            subjectAltNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A condition to be met.
         */
        interface Condition {
            /**
             * Trusted attributes supplied by the IAM system.
             */
            iam?: pulumi.Input<string>;
            /**
             * An operator to apply the subject with.
             */
            op?: pulumi.Input<string>;
            /**
             * Trusted attributes discharged by the service.
             */
            svc?: pulumi.Input<string>;
            /**
             * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
             */
            sys?: pulumi.Input<string>;
            /**
             * The objects of the condition.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A set of Confidential Instance options.
         */
        interface ConfidentialInstanceConfig {
            /**
             * Defines whether the instance should have confidential compute enabled.
             */
            enableConfidentialCompute?: pulumi.Input<boolean>;
        }
        /**
         * Message containing connection draining configuration.
         */
        interface ConnectionDraining {
            /**
             * Configures a duration timeout for existing requests on a removed backend instance. For supported load balancers and protocols, as described in Enabling connection draining.
             */
            drainingTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * This message defines settings for a consistent hash style load balancer.
         */
        interface ConsistentHashLoadBalancerSettings {
            /**
             * Hash is based on HTTP Cookie. This field describes a HTTP cookie that will be used as the hash key for the consistent hash load balancer. If the cookie is not present, it will be generated. This field is applicable if the sessionAffinity is set to HTTP_COOKIE.
             */
            httpCookie?: pulumi.Input<inputs.compute.alpha.ConsistentHashLoadBalancerSettingsHttpCookie>;
            /**
             * The hash based on the value of the specified header field. This field is applicable if the sessionAffinity is set to HEADER_FIELD.
             */
            httpHeaderName?: pulumi.Input<string>;
            /**
             * The minimum number of virtual nodes to use for the hash ring. Defaults to 1024. Larger ring sizes result in more granular load distributions. If the number of hosts in the load balancing pool is larger than the ring size, each host will be assigned a single virtual node.
             */
            minimumRingSize?: pulumi.Input<string>;
        }
        /**
         * The information about the HTTP Cookie on which the hash function is based for load balancing policies that use a consistent hash.
         */
        interface ConsistentHashLoadBalancerSettingsHttpCookie {
            /**
             * Name of the cookie.
             */
            name?: pulumi.Input<string>;
            /**
             * Path to set for the cookie.
             */
            path?: pulumi.Input<string>;
            /**
             * Lifetime of the cookie.
             */
            ttl?: pulumi.Input<inputs.compute.alpha.Duration>;
        }
        /**
         * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
         */
        interface CorsPolicy {
            /**
             * In response to a preflight request, setting this to true indicates that the actual request can include user credentials. This translates to the Access-Control-Allow-Credentials header.
             * Default is false.
             */
            allowCredentials?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Allow-Headers header.
             */
            allowHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the content for the Access-Control-Allow-Methods header.
             */
            allowMethods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the regualar expression patterns that match allowed origins. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOriginRegexes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the list of origins that will be allowed to do CORS requests.
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOrigins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If true, specifies the CORS policy is disabled. The default value of false, which indicates that the CORS policy is in effect.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Expose-Headers header.
             */
            exposeHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies how long results of a preflight request can be cached in seconds. This translates to the Access-Control-Max-Age header.
             */
            maxAge?: pulumi.Input<number>;
        }
        interface CustomerEncryptionKey {
            /**
             * The name of the encryption key that is stored in Google Cloud KMS.
             */
            kmsKeyName?: pulumi.Input<string>;
            /**
             * The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             */
            kmsKeyServiceAccount?: pulumi.Input<string>;
            /**
             * Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
             */
            rawKey?: pulumi.Input<string>;
            /**
             * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource.
             *
             * The key must meet the following requirements before you can provide it to Compute Engine:
             * - The key is wrapped using a RSA public key certificate provided by Google.
             * - After being wrapped, the key must be encoded in RFC 4648 base64 encoding.  Gets the RSA public key certificate provided by Google at:
             * https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             */
            rsaEncryptedKey?: pulumi.Input<string>;
            /**
             * [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             */
            sha256?: pulumi.Input<string>;
        }
        /**
         * Deprecation status for a public resource.
         */
        interface DeprecationStatus {
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DELETED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deleted?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DEPRECATED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deprecated?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to OBSOLETE. This is only informational and the status will not change unless the client explicitly changes it.
             */
            obsolete?: pulumi.Input<string>;
            /**
             * The URL of the suggested replacement for a deprecated resource. The suggested replacement resource must be the same kind of resource as the deprecated resource.
             */
            replacement?: pulumi.Input<string>;
            /**
             * The deprecation state of this resource. This can be ACTIVE, DEPRECATED, OBSOLETE, or DELETED. Operations which communicate the end of life date for an image, can use ACTIVE. Operations which create a new resource using a DEPRECATED resource will return successfully, but with a warning indicating the deprecated resource and recommending its replacement. Operations which use OBSOLETE or DELETED resources will be rejected and result in an error.
             */
            state?: pulumi.Input<string>;
            /**
             * The rollout policy of this deprecation. This policy is only enforced by image family views. The rollout policy restricts the zones where the associated resource is considered in a deprecated state. When the rollout policy does not include the user specified zone, or if the zone is rolled out, the associated resource is considered in a deprecated state.
             */
            stateOverride?: pulumi.Input<inputs.compute.alpha.RolloutPolicy>;
        }
        /**
         * A specification of the desired way to instantiate a disk in the instance template when its created from a source instance.
         */
        interface DiskInstantiationConfig {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * The custom source image to be used to restore this disk when instantiating this instance template.
             */
            customImage?: pulumi.Input<string>;
            /**
             * Specifies the device name of the disk to which the configurations apply to.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Specifies whether to include the disk and what image to use. Possible values are:
             * - source-image: to use the same image that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - source-image-family: to use the same image family that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - custom-image: to use a user-provided image url for disk creation. Applicable to the boot disk and additional read-write disks.
             * - attach-read-only: to attach a read-only disk. Applicable to read-only disks.
             * - do-not-include: to exclude a disk from the template. Applicable to additional read-write disks, local SSDs, and read-only disks.
             */
            instantiateFrom?: pulumi.Input<string>;
        }
        /**
         * A set of Display Device options
         */
        interface DisplayDevice {
            /**
             * Defines whether the instance has Display enabled.
             */
            enableDisplay?: pulumi.Input<boolean>;
        }
        interface DistributionPolicy {
            /**
             * The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             */
            targetShape?: pulumi.Input<string>;
            /**
             * Zones where the regional managed instance group will create and manage its instances.
             */
            zones?: pulumi.Input<pulumi.Input<inputs.compute.alpha.DistributionPolicyZoneConfiguration>[]>;
        }
        interface DistributionPolicyZoneConfiguration {
            /**
             * The URL of the zone. The zone must exist in the region where the managed instance group is located.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A Duration represents a fixed-length span of time represented as a count of seconds and fractions of seconds at nanosecond resolution. It is independent of any calendar and concepts like "day" or "month". Range is approximately 10,000 years.
         */
        interface Duration {
            /**
             * Span of time that's a fraction of a second at nanosecond resolution. Durations less than one second are represented with a 0 `seconds` field and a positive `nanos` field. Must be from 0 to 999,999,999 inclusive.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Span of time at a resolution of a second. Must be from 0 to 315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
             */
            seconds?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.
         *
         * Example (Comparison):
         *
         * title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100"
         *
         * Example (Equality):
         *
         * title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email"
         *
         * Example (Logic):
         *
         * title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'"
         *
         * Example (Data Manipulation):
         *
         * title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)"
         *
         * The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The interface for the external VPN gateway.
         */
        interface ExternalVpnGatewayInterface {
            /**
             * The numeric ID of this interface. The allowed input values for this id for different redundancy types of external VPN gateway: SINGLE_IP_INTERNALLY_REDUNDANT - 0 TWO_IPS_REDUNDANCY - 0, 1 FOUR_IPS_REDUNDANCY - 0, 1, 2, 3
             */
            id?: pulumi.Input<number>;
            /**
             * IP address of the interface in the external VPN gateway. Only IPv4 is supported. This IP address can be either from your on-premise gateway or another Cloud provider's VPN gateway, it cannot be an IP address from Google Compute Engine.
             */
            ipAddress?: pulumi.Input<string>;
        }
        interface FileContentBuffer {
            /**
             * The raw content in the secure keys file.
             */
            content?: pulumi.Input<string>;
            /**
             * The file type of source file.
             */
            fileType?: pulumi.Input<string>;
        }
        /**
         * The available logging options for a firewall rule.
         */
        interface FirewallLogConfig {
            /**
             * This field denotes whether to enable logging for a particular firewall rule.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
             */
            metadata?: pulumi.Input<string>;
        }
        interface FirewallPolicyAssociation {
            /**
             * The target that the firewall policy is attached to.
             */
            attachmentTarget?: pulumi.Input<string>;
            /**
             * [Output Only] Deprecated, please use short name instead. The display name of the firewall policy of the association.
             */
            displayName?: pulumi.Input<string>;
            /**
             * [Output Only] The firewall policy ID of the association.
             */
            firewallPolicyId?: pulumi.Input<string>;
            /**
             * The name for an association.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The short name of the firewall policy of the association.
             */
            shortName?: pulumi.Input<string>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface FirewallPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description for this resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The direction in which this rule applies.
             */
            direction?: pulumi.Input<string>;
            /**
             * Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
             */
            enableLogging?: pulumi.Input<boolean>;
            /**
             * [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.alpha.FirewallPolicyRuleMatcher>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.
             */
            priority?: pulumi.Input<number>;
            /**
             * [Output Only] Calculation of the complexity of a single firewall policy rule.
             */
            ruleTupleCount?: pulumi.Input<number>;
            /**
             * A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
             */
            targetResources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of secure labels that controls which instances the firewall rule applies to. If targetSecureLabel are specified, then the firewall rule applies only to instances in the VPC network that have one of those secure labels. targetSecureLabel may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureLabel are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label values allowed is 256.
             */
            targetSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256.
             */
            targetSecureTags?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FirewallPolicyRuleSecureTag>[]>;
            /**
             * A list of service accounts indicating the sets of instances that are applied with this rule.
             */
            targetServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface FirewallPolicyRuleMatcher {
            /**
             * CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
             */
            destIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             */
            layer4Configs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FirewallPolicyRuleMatcherLayer4Config>[]>;
            /**
             * CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of firewall label values, which should be matched at the source of the traffic. Maximum number of source label values allowed is 256.
             */
            srcSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256.
             */
            srcSecureTags?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FirewallPolicyRuleSecureTag>[]>;
        }
        interface FirewallPolicyRuleMatcherLayer4Config {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface FirewallPolicyRuleSecureTag {
            /**
             * Name of the secure tag, created with TagManager's TagValue API.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] State of the secure tag, either `EFFECTIVE` or `INEFFECTIVE`. A secure tag is `INEFFECTIVE` when it is deleted or its network is deleted.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Encapsulates numeric value that can be either absolute or relative.
         */
        interface FixedOrPercent {
            /**
             * [Output Only] Absolute value of VM instances calculated based on the specific mode.
             *
             *
             * - If the value is fixed, then the calculated value is equal to the fixed value.
             * - If the value is a percent, then the calculated value is percent/100 * targetSize. For example, the calculated value of a 80% of a managed instance group with 150 instances would be (80/100 * 150) = 120 VM instances. If there is a remainder, the number is rounded up.
             */
            calculated?: pulumi.Input<number>;
            /**
             * Specifies a fixed number of VM instances. This must be a positive integer.
             */
            fixed?: pulumi.Input<number>;
            /**
             * Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * Describes the auto-registration of the Forwarding Rule to Service Directory. The region and project of the Service Directory resource generated from this registration will be the same as this Forwarding Rule.
         */
        interface ForwardingRuleServiceDirectoryRegistration {
            /**
             * Service Directory namespace to register the forwarding rule under.
             */
            namespace?: pulumi.Input<string>;
            /**
             * Service Directory service to register the forwarding rule under.
             */
            service?: pulumi.Input<string>;
            /**
             * [Optional] Service Directory region to register this global forwarding rule under. Default to "us-central1". Only used for PSC for Google APIs. All PSC for Google APIs Forwarding Rules on the same network should use the same Service Directory region.
             */
            serviceDirectoryRegion?: pulumi.Input<string>;
        }
        interface GRPCHealthCheck {
            /**
             * The gRPC service name for the health check. This field is optional. The value of grpc_service_name has the following meanings by convention:
             * - Empty service_name means the overall status of all services at the backend.
             * - Non-empty service_name means the health of that gRPC service, as defined by the owner of the service.
             * The grpc_service_name can only be ASCII.
             */
            grpcServiceName?: pulumi.Input<string>;
            /**
             * The port number for the health check request. Must be specified if port_name and port_specification are not set or if port_specification is USE_FIXED_PORT. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence. The port_name should conform to RFC1035.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, gRPC health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] gRPC config to access the SDS server. gRPC config to access the SDS server.
         */
        interface GrpcServiceConfig {
            /**
             * The call credentials to access the SDS server.
             */
            callCredentials?: pulumi.Input<inputs.compute.alpha.CallCredentials>;
            /**
             * The channel credentials to access the SDS server.
             */
            channelCredentials?: pulumi.Input<inputs.compute.alpha.ChannelCredentials>;
            /**
             * The target URI of the SDS server.
             */
            targetUri?: pulumi.Input<string>;
        }
        /**
         * Guest OS features.
         */
        interface GuestOsFeature {
            /**
             * The ID of a supported feature. Read  Enabling guest operating system features to see a list of available options.
             */
            type?: pulumi.Input<string>;
        }
        interface HTTP2HealthCheck {
            /**
             * The value of the host header in the HTTP/2 health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP2 health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP/2 health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
            /**
             * Weight report mode. used for weighted Load Balancing.
             */
            weightReportMode?: pulumi.Input<string>;
        }
        interface HTTPHealthCheck {
            /**
             * The value of the host header in the HTTP health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
            /**
             * Weight report mode. used for weighted Load Balancing.
             */
            weightReportMode?: pulumi.Input<string>;
        }
        interface HTTPSHealthCheck {
            /**
             * The value of the host header in the HTTPS health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTPS health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTPS health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
            /**
             * Weight report mode. used for weighted Load Balancing.
             */
            weightReportMode?: pulumi.Input<string>;
        }
        /**
         * Configuration of logging on a health check. If logging is enabled, logs will be exported to Stackdriver.
         */
        interface HealthCheckLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default, which means no health check logging will be done.
             */
            enable?: pulumi.Input<boolean>;
        }
        /**
         * UrlMaps A host-matching rule for a URL. If matched, will use the named PathMatcher to select the BackendService.
         */
        interface HostRule {
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The list of host patterns to match. They must be valid hostnames with optional port numbers in the format host:port. * matches any string of ([a-z0-9-.]*). In that case, * must be the first character and must be followed in the pattern by either - or ..
             * * based matching is not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            hosts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the PathMatcher to use to match the path portion of the URL if the hostRule matches the URL's host portion.
             */
            pathMatcher?: pulumi.Input<string>;
        }
        /**
         * Specification for how requests are aborted as part of fault injection.
         */
        interface HttpFaultAbort {
            /**
             * The HTTP status code used to abort the request.
             * The value must be between 200 and 599 inclusive.
             */
            httpStatus?: pulumi.Input<number>;
            /**
             * The percentage of traffic (connections/operations/requests) which will be aborted as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * Specifies the delay introduced by Loadbalancer before forwarding the request to the backend service as part of fault injection.
         */
        interface HttpFaultDelay {
            /**
             * Specifies the value of the fixed delay interval.
             */
            fixedDelay?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * The percentage of traffic (connections/operations/requests) on which delay will be introduced as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
         */
        interface HttpFaultInjection {
            /**
             * The specification for how client requests are aborted as part of fault injection.
             */
            abort?: pulumi.Input<inputs.compute.alpha.HttpFaultAbort>;
            /**
             * The specification for how client requests are delayed as part of fault injection, before being sent to a backend service.
             */
            delay?: pulumi.Input<inputs.compute.alpha.HttpFaultDelay>;
        }
        /**
         * HttpFilterConfiguration supplies additional contextual settings for networkservices.HttpFilter resources enabled by Traffic Director.
         */
        interface HttpFilterConfig {
            /**
             * The configuration needed to enable the networkservices.HttpFilter resource. The configuration must be YAML formatted and only contain fields defined in the protobuf identified in configTypeUrl
             */
            config?: pulumi.Input<string>;
            /**
             * The fully qualified versioned proto3 type url of the protobuf that the filter expects for its contextual settings, for example: type.googleapis.com/google.protobuf.Struct
             */
            configTypeUrl?: pulumi.Input<string>;
            /**
             * Name of the networkservices.HttpFilter resource this configuration belongs to. This name must be known to the xDS client. Example: envoy.wasm
             */
            filterName?: pulumi.Input<string>;
        }
        /**
         * The request and response header transformations that take effect before the request is passed along to the selected backendService.
         */
        interface HttpHeaderAction {
            /**
             * Headers to add to a matching request prior to forwarding the request to the backendService.
             */
            requestHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the request prior to forwarding the request to the backendService.
             */
            requestHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Headers to add the response prior to sending the response back to the client.
             */
            responseHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the response prior to sending the response back to the client.
             */
            responseHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * matchRule criteria for request header matches.
         */
        interface HttpHeaderMatch {
            /**
             * The value should exactly match contents of exactMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the HTTP header to match.
             * For matching against the HTTP request's authority, use a headerMatch with the header name ":authority".
             * For matching a request's method, use the headerName ":method".
             * When the URL map is bound to target gRPC proxy that has validateForProxyless field set to true, only non-binary user-specified custom metadata and the `content-type` header are supported. The following transport-level headers cannot be used in header matching rules: `:authority`, `:method`, `:path`, `:scheme`, `user-agent`, `accept-encoding`, `content-encoding`, `grpc-accept-encoding`, `grpc-encoding`, `grpc-previous-rpc-attempts`, `grpc-tags-bin`, `grpc-timeout` and `grpc-trace-bin.
             */
            headerName?: pulumi.Input<string>;
            /**
             * If set to false, the headerMatch is considered a match if the match criteria above are met. If set to true, the headerMatch is considered a match if the match criteria above are NOT met.
             * The default setting is false.
             */
            invertMatch?: pulumi.Input<boolean>;
            /**
             * The value of the header must start with the contents of prefixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * A header with the contents of headerName must exist. The match takes place whether or not the request's header has a value.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The header value must be an integer and its value must be in the range specified in rangeMatch. If the header does not contain an integer, number or is empty, the match fails.
             * For example for a range [-5, 0]
             * - -3 will match.
             * - 0 will not match.
             * - 0.25 will not match.
             * - -3someString will not match.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that rangeMatch is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             */
            rangeMatch?: pulumi.Input<inputs.compute.alpha.Int64RangeMatch>;
            /**
             * The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see:  github.com/google/re2/wiki/Syntax
             * For matching against a port specified in the HTTP request, use a headerMatch with headerName set to PORT and a regular expression that satisfies the RFC2616 Host header's port specifier.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
            /**
             * The value of the header must end with the contents of suffixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            suffixMatch?: pulumi.Input<string>;
        }
        /**
         * Specification determining how headers are added to requests or responses.
         */
        interface HttpHeaderOption {
            /**
             * The name of the header.
             */
            headerName?: pulumi.Input<string>;
            /**
             * The value of the header to add.
             */
            headerValue?: pulumi.Input<string>;
            /**
             * If false, headerValue is appended to any values that already exist for the header. If true, headerValue is set for the header, discarding any values that were set for that header.
             * The default value is false.
             */
            replace?: pulumi.Input<boolean>;
        }
        /**
         * HttpRouteRuleMatch criteria for a request's query parameter.
         */
        interface HttpQueryParameterMatch {
            /**
             * The queryParameterMatch matches if the value of the parameter exactly matches the contents of exactMatch.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the query parameter to match. The query parameter must exist in the request, in the absence of which the request match fails.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies that the queryParameterMatch matches if the request contains the query parameter, irrespective of whether the parameter has a value or not.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The queryParameterMatch matches if the value of the parameter matches the regular expression specified by regexMatch. For the regular expression grammar, please see github.com/google/re2/wiki/Syntax
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             * Note that regexMatch only applies when the loadBalancingScheme is set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Specifies settings for an HTTP redirect.
         */
        interface HttpRedirectAction {
            /**
             * The host that will be used in the redirect response instead of the one that was supplied in the request.
             * The value must be between 1 and 255 characters.
             */
            hostRedirect?: pulumi.Input<string>;
            /**
             * If set to true, the URL scheme in the redirected request is set to https. If set to false, the URL scheme of the redirected request will remain the same as that of the request.
             * This must only be set for UrlMaps used in TargetHttpProxys. Setting this true for TargetHttpsProxy is not permitted.
             * The default is set to false.
             */
            httpsRedirect?: pulumi.Input<boolean>;
            /**
             * The path that will be used in the redirect response instead of the one that was supplied in the request.
             * pathRedirect cannot be supplied together with prefixRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            pathRedirect?: pulumi.Input<string>;
            /**
             * The prefix that replaces the prefixMatch specified in the HttpRouteRuleMatch, retaining the remaining portion of the URL before redirecting the request.
             * prefixRedirect cannot be supplied together with pathRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            prefixRedirect?: pulumi.Input<string>;
            /**
             * The HTTP Status code to use for this RedirectAction.
             * Supported values are:
             * - MOVED_PERMANENTLY_DEFAULT, which is the default value and corresponds to 301.
             * - FOUND, which corresponds to 302.
             * - SEE_OTHER which corresponds to 303.
             * - TEMPORARY_REDIRECT, which corresponds to 307. In this case, the request method will be retained.
             * - PERMANENT_REDIRECT, which corresponds to 308. In this case, the request method will be retained.
             */
            redirectResponseCode?: pulumi.Input<string>;
            /**
             * If set to true, any accompanying query portion of the original URL is removed prior to redirecting the request. If set to false, the query portion of the original URL is retained.
             * The default is set to false.
             */
            stripQuery?: pulumi.Input<boolean>;
        }
        /**
         * The retry policy associates with HttpRouteRule
         */
        interface HttpRetryPolicy {
            /**
             * Specifies the allowed number retries. This number must be > 0. If not specified, defaults to 1.
             */
            numRetries?: pulumi.Input<number>;
            /**
             * Specifies a non-zero timeout per retry attempt.
             * If not specified, will use the timeout set in HttpRouteAction. If timeout in HttpRouteAction is not set, will use the largest timeout among all backend services associated with the route.
             */
            perTryTimeout?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * Specfies one or more conditions when this retry rule applies. Valid values are:
             * - 5xx: Loadbalancer will attempt a retry if the backend service responds with any 5xx response code, or if the backend service does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.
             * - gateway-error: Similar to 5xx, but only applies to response codes 502, 503 or 504.
             * -
             * - connect-failure: Loadbalancer will retry on failures connecting to backend services, for example due to connection timeouts.
             * - retriable-4xx: Loadbalancer will retry for retriable 4xx response codes. Currently the only retriable error supported is 409.
             * - refused-stream:Loadbalancer will retry if the backend service resets the stream with a REFUSED_STREAM error code. This reset type indicates that it is safe to retry.
             * - cancelledLoadbalancer will retry if the gRPC status code in the response header is set to cancelled
             * - deadline-exceeded: Loadbalancer will retry if the gRPC status code in the response header is set to deadline-exceeded
             * - resource-exhausted: Loadbalancer will retry if the gRPC status code in the response header is set to resource-exhausted
             * - unavailable: Loadbalancer will retry if the gRPC status code in the response header is set to unavailable
             */
            retryConditions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface HttpRouteAction {
            /**
             * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            corsPolicy?: pulumi.Input<inputs.compute.alpha.CorsPolicy>;
            /**
             * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
             * timeout and retry_policy will be ignored by clients that are configured with a fault_injection_policy.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            faultInjectionPolicy?: pulumi.Input<inputs.compute.alpha.HttpFaultInjection>;
            /**
             * Specifies the maximum duration (timeout) for streams on the selected route. Unlike the timeout field where the timeout duration starts from the time the request has been fully processed (i.e. end-of-stream), the duration in this field is computed from the beginning of the stream until the response has been completely processed, including all retries. A stream that does not complete in this duration is closed.
             * If not specified, will use the largest maxStreamDuration among all backend services associated with the route.
             * This field is only allowed if the Url map is used with backend services with loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            maxStreamDuration?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * Specifies the policy on how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            requestMirrorPolicy?: pulumi.Input<inputs.compute.alpha.RequestMirrorPolicy>;
            /**
             * Specifies the retry policy associated with this route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            retryPolicy?: pulumi.Input<inputs.compute.alpha.HttpRetryPolicy>;
            /**
             * Specifies the timeout for the selected route. Timeout is computed from the time the request has been fully processed (i.e. end-of-stream) up until the response has been completely processed. Timeout includes all retries.
             * If not specified, will use the largest timeout among all backend services associated with the route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            timeout?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * The spec to modify the URL of the request, prior to forwarding the request to the matched service.
             * urlRewrite is the only action supported in UrlMaps for external HTTP(S) load balancers.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            urlRewrite?: pulumi.Input<inputs.compute.alpha.UrlRewrite>;
            /**
             * A list of weighted backend services to send traffic to when a route match occurs. The weights determine the fraction of traffic that flows to their corresponding backend service. If all traffic needs to go to a single backend service, there must be one  weightedBackendService with weight set to a non-zero number.
             * Once a backendService is identified and before forwarding the request to the backend service, advanced routing actions such as URL rewrites and header transformations are applied depending on additional settings specified in this HttpRouteAction.
             */
            weightedBackendServices?: pulumi.Input<pulumi.Input<inputs.compute.alpha.WeightedBackendService>[]>;
        }
        /**
         * An HttpRouteRule specifies how to match an HTTP request and the corresponding routing action that load balancing proxies will perform.
         */
        interface HttpRouteRule {
            /**
             * The short description conveying the intent of this routeRule.
             * The description can have a maximum length of 1024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * The headerAction specified here are applied before the matching pathMatchers[].headerAction and after pathMatchers[].routeRules[].routeAction.weightedBackendService.backendServiceWeightAction[].headerAction
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.alpha.HttpHeaderAction>;
            /**
             * Outbound route specific configuration for networkservices.HttpFilter resources enabled by Traffic Director. httpFilterConfigs only applies for Loadbalancers with loadBalancingScheme set to INTERNAL_SELF_MANAGED. See ForwardingRule for more details.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            httpFilterConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpFilterConfig>[]>;
            /**
             * Outbound route specific metadata supplied to networkservices.HttpFilter resources enabled by Traffic Director. httpFilterMetadata only applies for Loadbalancers with loadBalancingScheme set to INTERNAL_SELF_MANAGED. See ForwardingRule for more details.
             * The only configTypeUrl supported is type.googleapis.com/google.protobuf.Struct
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            httpFilterMetadata?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpFilterConfig>[]>;
            /**
             * The list of criteria for matching attributes of a request to this routeRule. This list has OR semantics: the request matches this routeRule when any of the matchRules are satisfied. However predicates within a given matchRule have AND semantics. All predicates within a matchRule must match for the request to match the rule.
             */
            matchRules?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpRouteRuleMatch>[]>;
            /**
             * For routeRules within a given pathMatcher, priority determines the order in which load balancer will interpret routeRules. RouteRules are evaluated in order of priority, from the lowest to highest number. The priority of a rule decreases as its number increases (1, 2, 3, N+1). The first rule that matches the request is applied.
             * You cannot configure two or more routeRules with the same priority. Priority for each rule must be set to a number between 0 and 2147483647 inclusive.
             * Priority numbers can have gaps, which enable you to add or remove rules in the future without affecting the rest of the rules. For example, 1, 2, 3, 4, 5, 9, 12, 16 is a valid series of priority numbers to which you could add rules numbered from 6 to 8, 10 to 11, and 13 to 15 in the future without any impact on existing rules.
             */
            priority?: pulumi.Input<number>;
            /**
             * In response to a matching matchRule, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If  routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a routeRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.alpha.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When this rule is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.alpha.HttpRedirectAction>;
        }
        /**
         * HttpRouteRuleMatch specifies a set of criteria for matching requests to an HttpRouteRule. All specified criteria must be satisfied for a match to occur.
         */
        interface HttpRouteRuleMatch {
            /**
             * For satisfying the matchRule condition, the path of the request must exactly match the value specified in fullPathMatch after removing any query parameters and anchor that may be part of the original URL.
             * fullPathMatch must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            fullPathMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of header match criteria, all of which must match corresponding headers in the request.
             */
            headerMatches?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpHeaderMatch>[]>;
            /**
             * Specifies that prefixMatch and fullPathMatch matches are case sensitive.
             * The default value is false.
             * ignoreCase must not be used with regexMatch.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            ignoreCase?: pulumi.Input<boolean>;
            /**
             * Opaque filter criteria used by Loadbalancer to restrict routing configuration to a limited set of xDS compliant clients. In their xDS requests to Loadbalancer, xDS clients present node metadata. When there is a match, the relevant routing configuration is made available to those proxies.
             * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata. If multiple metadataFilters are specified, all of them need to be satisfied in order to be considered a match.
             * metadataFilters specified here will be applied after those specified in ForwardingRule that refers to the UrlMap this HttpRouteRuleMatch belongs to.
             * metadataFilters only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            metadataFilters?: pulumi.Input<pulumi.Input<inputs.compute.alpha.MetadataFilter>[]>;
            /**
             * For satisfying the matchRule condition, the request's path must begin with the specified prefixMatch. prefixMatch must begin with a /.
             * The value must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of query parameter match criteria, all of which must match corresponding query parameters in the request.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            queryParameterMatches?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpQueryParameterMatch>[]>;
            /**
             * For satisfying the matchRule condition, the path of the request must satisfy the regular expression specified in regexMatch after removing any query parameters and anchor supplied with the original URL. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Initial State for shielded instance, these are public keys which are safe to store in public
         */
        interface InitialStateConfig {
            /**
             * The Key Database (db).
             */
            dbs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FileContentBuffer>[]>;
            /**
             * The forbidden key database (dbx).
             */
            dbxs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FileContentBuffer>[]>;
            /**
             * The Key Exchange Key (KEK).
             */
            keks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.FileContentBuffer>[]>;
            /**
             * The Platform Key (PK).
             */
            pk?: pulumi.Input<inputs.compute.alpha.FileContentBuffer>;
        }
        interface InstanceGroupManagerActionsSummary {
            /**
             * [Output Only] The total number of instances in the managed instance group that are scheduled to be abandoned. Abandoning an instance removes it from the managed instance group without deleting it.
             */
            abandoning?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be created or are currently being created. If the group fails to create any of these instances, it tries again until it creates the instance successfully.
             *
             * If you have disabled creation retries, this field will not be populated; instead, the creatingWithoutRetries field will be populated.
             */
            creating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances that the managed instance group will attempt to create. The group attempts to create each instance only once. If the group fails to create any of these instances, it decreases the group's targetSize value accordingly.
             */
            creatingWithoutRetries?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be deleted or are currently being deleted.
             */
            deleting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are running and have no scheduled actions.
             */
            none?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be recreated or are currently being being recreated. Recreating an instance deletes the existing root persistent disk and creates a new disk from the image that is defined in the instance template.
             */
            recreating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being reconfigured with properties that do not require a restart or a recreate action. For example, setting or removing target pools for the instance.
             */
            refreshing?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
             */
            restarting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be resumed or are currently being resumed.
             */
            resuming?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be started or are currently being started.
             */
            starting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be stopped or are currently being stopped.
             */
            stopping?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be suspended or are currently being suspended.
             */
            suspending?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
             */
            verifying?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerAutoHealingPolicy {
            /**
             * The URL for the health check that signals autohealing.
             */
            healthCheck?: pulumi.Input<string>;
            /**
             * The number of seconds that the managed instance group waits before it applies autohealing policies to new instances or recently recreated instances. This initial delay allows instances to initialize and run their startup scripts before the instance group determines that they are UNHEALTHY. This prevents the managed instance group from recreating its instances prematurely. This value must be from range [0, 3600].
             */
            initialDelaySec?: pulumi.Input<number>;
            /**
             * Maximum number of instances that can be unavailable when autohealing. When 'percent' is used, the value is rounded UP. The instance is considered available if all of the following conditions are satisfied: 1. Instance's status is RUNNING. 2. Instance's currentAction is NONE (in particular its liveness health check result was observed to be HEALTHY at least once as it passed VERIFYING). 3. There is no outgoing action on an instance triggered by IGM.
             *
             * By default, number of concurrently autohealed instances is smaller than the managed instance group target size. However, if a zonal managed instance group has only one instance, or a regional managed instance group has only one instance per zone, autohealing will recreate these instances when they become unhealthy.
             */
            maxUnavailable?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
        }
        interface InstanceGroupManagerInstanceLifecyclePolicy {
            /**
             * The configuration for metadata based readiness signal sent by the instance during initialization when stopping / suspending an instance. The Instance Group Manager will wait for a signal that indicates successful initialization before stopping / suspending an instance.
             *
             * If a successful readiness signal is not sent before timeout, the corresponding instance will not be stopped / suspended. Instead, an error will be visible in the lastAttempt.errors field of the managed instance in the listmanagedinstances method.
             *
             * If metadataBasedReadinessSignal.timeoutSec is unset, the Instance Group Manager will directly proceed to suspend / stop instances, skipping initialization on them.
             */
            metadataBasedReadinessSignal?: pulumi.Input<inputs.compute.alpha.InstanceGroupManagerInstanceLifecyclePolicyMetadataBasedReadinessSignal>;
        }
        interface InstanceGroupManagerInstanceLifecyclePolicyMetadataBasedReadinessSignal {
            /**
             * The number of seconds to wait for a readiness signal during initialization before timing out.
             */
            timeoutSec?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerStatus {
            /**
             * [Output Only] The URL of the Autoscaler that targets this instance group manager.
             */
            autoscaler?: pulumi.Input<string>;
            /**
             * [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
             */
            isStable?: pulumi.Input<boolean>;
            /**
             * [Output Only] Stateful status of the given Instance Group Manager.
             */
            stateful?: pulumi.Input<inputs.compute.alpha.InstanceGroupManagerStatusStateful>;
            /**
             * [Output Only] A status of consistency of Instances' versions with their target version specified by version field on Instance Group Manager.
             */
            versionTarget?: pulumi.Input<inputs.compute.alpha.InstanceGroupManagerStatusVersionTarget>;
        }
        interface InstanceGroupManagerStatusStateful {
            /**
             * [Output Only] A bit indicating whether the managed instance group has stateful configuration, that is, if you have configured any items in a stateful policy or in per-instance configs. The group might report that it has no stateful config even when there is still some preserved state on a managed instance, for example, if you have deleted all PICs but not yet applied those deletions.
             */
            hasStatefulConfig?: pulumi.Input<boolean>;
            /**
             * [Output Only] A bit indicating whether the managed instance group has stateful configuration, that is, if you have configured any items in a stateful policy or in per-instance configs. The group might report that it has no stateful config even when there is still some preserved state on a managed instance, for example, if you have deleted all PICs but not yet applied those deletions. This field is deprecated in favor of has_stateful_config.
             */
            isStateful?: pulumi.Input<boolean>;
            /**
             * [Output Only] Status of per-instance configs on the instance.
             */
            perInstanceConfigs?: pulumi.Input<inputs.compute.alpha.InstanceGroupManagerStatusStatefulPerInstanceConfigs>;
        }
        interface InstanceGroupManagerStatusStatefulPerInstanceConfigs {
            /**
             * A bit indicating if all of the group's per-instance configs (listed in the output of a listPerInstanceConfigs API call) have status EFFECTIVE or there are no per-instance-configs.
             */
            allEffective?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerStatusVersionTarget {
            /**
             * [Output Only] A bit indicating whether version target has been reached in this managed instance group, i.e. all instances are in their target version. Instances' target version are specified by version field on Instance Group Manager.
             */
            isReached?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerUpdatePolicy {
            /**
             * The  instance redistribution policy for regional managed instance groups. Valid values are:
             * - PROACTIVE (default): The group attempts to maintain an even distribution of VM instances across zones in the region.
             * - NONE: For non-autoscaled groups, proactive redistribution is disabled.
             */
            instanceRedistributionType?: pulumi.Input<string>;
            /**
             * The maximum number of instances that can be created above the specified targetSize during the update process. This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxSurge is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxSurge.
             */
            maxSurge?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
            /**
             * The maximum number of instances that can be unavailable during the update process. An instance is considered available if all of the following conditions are satisfied:
             *
             *
             * - The instance's status is RUNNING.
             * - If there is a health check on the instance group, the instance's health check status must be HEALTHY at least once. If there is no health check on the group, then the instance only needs to have a status of RUNNING to be considered available.  This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxUnavailable is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxUnavailable.
             */
            maxUnavailable?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
            /**
             * Minimum number of seconds to wait for after a newly created instance becomes available. This value must be from range [0, 3600].
             */
            minReadySec?: pulumi.Input<number>;
            /**
             * Minimal action to be taken on an instance. You can specify either RESTART to restart existing instances or REPLACE to delete and create new instances from the target template. If you specify a RESTART, the Updater will attempt to perform that action only. However, if the Updater determines that the minimal action you specify is not enough to perform the update, it might perform a more disruptive action.
             */
            minimalAction?: pulumi.Input<string>;
            /**
             * Most disruptive action that is allowed to be taken on an instance. You can specify either NONE to forbid any actions, REFRESH to allow actions that do not need instance restart, RESTART to allow actions that can be applied without instance replacing or REPLACE to allow all possible actions. If the Updater determines that the minimal update action needed is more disruptive than most disruptive allowed action you specify it will not perform the update at all.
             */
            mostDisruptiveAllowedAction?: pulumi.Input<string>;
            /**
             * What action should be used to replace instances. See minimal_action.REPLACE
             */
            replacementMethod?: pulumi.Input<string>;
            /**
             * The type of update process. You can specify either PROACTIVE so that the instance group manager proactively executes actions in order to bring instances to their target versions or OPPORTUNISTIC so that no action is proactively executed but the update will be performed as part of other actions (for example, resizes or recreateInstances calls).
             */
            type?: pulumi.Input<string>;
        }
        interface InstanceGroupManagerVersion {
            /**
             * The URL of the instance template that is specified for this managed instance group. The group uses this template to create new instances in the managed instance group until the `targetSize` for this version is reached. The templates for existing instances in the group do not change unless you run recreateInstances, run applyUpdatesToInstances, or set the group's updatePolicy.type to PROACTIVE; in those cases, existing instances are updated until the `targetSize` for this version is reached.
             */
            instanceTemplate?: pulumi.Input<string>;
            /**
             * Name of the version. Unique among all versions in the scope of this managed instance group.
             */
            name?: pulumi.Input<string>;
            /**
             * Tag describing the version. Used to trigger rollout of a target version even if instance_template remains unchanged. Deprecated in favor of 'name'.
             */
            tag?: pulumi.Input<string>;
            /**
             * Specifies the intended number of instances to be created from the instanceTemplate. The final number of instances created from the template will be equal to:
             * - If expressed as a fixed number, the minimum of either targetSize.fixed or instanceGroupManager.targetSize is used.
             * - if expressed as a percent, the targetSize would be (targetSize.percent/100 * InstanceGroupManager.targetSize) If there is a remainder, the number is rounded up.  If unset, this version will update any remaining instances not updated by another version. Read Starting a canary update for more information.
             */
            targetSize?: pulumi.Input<inputs.compute.alpha.FixedOrPercent>;
        }
        interface InstanceProperties {
            /**
             * Controls for advanced machine-related behavior features.
             */
            advancedMachineFeatures?: pulumi.Input<inputs.compute.alpha.AdvancedMachineFeatures>;
            /**
             * Enables instances created based on these properties to send packets with source IP addresses other than their own and receive packets with destination IP addresses other than their own. If these instances will be used as an IP gateway or it will be set as the next-hop in a Route resource, specify true. If unsure, leave this set to false. See the Enable IP forwarding documentation for more information.
             */
            canIpForward?: pulumi.Input<boolean>;
            /**
             * Specifies the Confidential Instance options.
             */
            confidentialInstanceConfig?: pulumi.Input<inputs.compute.alpha.ConfidentialInstanceConfig>;
            /**
             * An optional text description for the instances that are created from these properties.
             */
            description?: pulumi.Input<string>;
            /**
             * An array of disks that are associated with the instances that are created from these properties.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AttachedDisk>[]>;
            /**
             * Display Device properties to enable support for remote display products like: Teradici, VNC and TeamViewer
             */
            displayDevice?: pulumi.Input<inputs.compute.alpha.DisplayDevice>;
            /**
             * A list of guest accelerator cards' type and count to use for instances created from these properties.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AcceleratorConfig>[]>;
            /**
             * Labels to apply to instances that are created from these properties.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The machine type to use for instances that are created from these properties.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs to assign to instances that are created from these properties. These pairs can consist of custom metadata or predefined keys. See Project and instance metadata for more information.
             */
            metadata?: pulumi.Input<inputs.compute.alpha.Metadata>;
            /**
             * Minimum cpu/platform to be used by instances. The instance may be scheduled on the specified or newer cpu/platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: "Intel Haswell" or minCpuPlatform: "Intel Sandy Bridge". For more information, read Specifying a Minimum CPU Platform.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * An array of network access configurations for this interface.
             */
            networkInterfaces?: pulumi.Input<pulumi.Input<inputs.compute.alpha.NetworkInterface>[]>;
            networkPerformanceConfig?: pulumi.Input<inputs.compute.alpha.NetworkPerformanceConfig>;
            /**
             * PostKeyRevocationActionType of the instance.
             */
            postKeyRevocationActionType?: pulumi.Input<string>;
            /**
             * The private IPv6 google access type for VMs. If not specified, use  INHERIT_FROM_SUBNETWORK as default.
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * Specifies the reservations that instances can consume from.
             */
            reservationAffinity?: pulumi.Input<inputs.compute.alpha.ReservationAffinity>;
            /**
             * Resource policies (names, not ULRs) applied to instances created from these properties.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the scheduling options for the instances that are created from these properties.
             */
            scheduling?: pulumi.Input<inputs.compute.alpha.Scheduling>;
            /**
             * A list of service accounts with specified scopes. Access tokens for these service accounts are available to the instances that are created from these properties. Use metadata queries to obtain the access tokens for these instances.
             */
            serviceAccounts?: pulumi.Input<pulumi.Input<inputs.compute.alpha.ServiceAccount>[]>;
            shieldedInstanceConfig?: pulumi.Input<inputs.compute.alpha.ShieldedInstanceConfig>;
            /**
             * Specifies the Shielded VM options for the instances that are created from these properties.
             */
            shieldedVmConfig?: pulumi.Input<inputs.compute.alpha.ShieldedVmConfig>;
            /**
             * A list of tags to apply to the instances that are created from these properties. The tags identify valid sources or targets for network firewalls. The setTags method can modify this list of tags. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<inputs.compute.alpha.Tags>;
        }
        /**
         * HttpRouteRuleMatch criteria for field values that must stay within the specified integer range.
         */
        interface Int64RangeMatch {
            /**
             * The end of the range (exclusive) in signed long integer format.
             */
            rangeEnd?: pulumi.Input<string>;
            /**
             * The start of the range (inclusive) in signed long integer format.
             */
            rangeStart?: pulumi.Input<string>;
        }
        /**
         * Informational metadata about Partner attachments from Partners to display to customers. These fields are propagated from PARTNER_PROVIDER attachments to their corresponding PARTNER attachments.
         */
        interface InterconnectAttachmentPartnerMetadata {
            /**
             * Plain text name of the Interconnect this attachment is connected to, as displayed in the Partner's portal. For instance "Chicago 1". This value may be validated to match approved Partner values.
             */
            interconnectName?: pulumi.Input<string>;
            /**
             * Plain text name of the Partner providing this attachment. This value may be validated to match approved Partner values.
             */
            partnerName?: pulumi.Input<string>;
            /**
             * URL of the Partner's portal for this Attachment. Partners may customise this to be a deep link to the specific resource on the Partner portal. This value may be validated to match approved Partner values.
             */
            portalUrl?: pulumi.Input<string>;
        }
        /**
         * Information for an interconnect attachment when this belongs to an interconnect of type DEDICATED.
         */
        interface InterconnectAttachmentPrivateInfo {
            /**
             * [Output Only] 802.1q encapsulation tag to be used for traffic between Google and the customer, going to and from this network and region.
             */
            tag8021q?: pulumi.Input<number>;
        }
        /**
         * Describes a single physical circuit between the Customer and Google. CircuitInfo objects are created by Google, so all fields are output only.
         */
        interface InterconnectCircuitInfo {
            /**
             * Customer-side demarc ID for this circuit.
             */
            customerDemarcId?: pulumi.Input<string>;
            /**
             * Google-assigned unique ID for this circuit. Assigned at circuit turn-up.
             */
            googleCircuitId?: pulumi.Input<string>;
            /**
             * Google-side demarc ID for this circuit. Assigned at circuit turn-up and provided by Google to the customer in the LOA.
             */
            googleDemarcId?: pulumi.Input<string>;
        }
        /**
         * Description of a planned outage on this Interconnect.
         */
        interface InterconnectOutageNotification {
            /**
             * If issue_type is IT_PARTIAL_OUTAGE, a list of the Google-side circuit IDs that will be affected.
             */
            affectedCircuits?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A description about the purpose of the outage.
             */
            description?: pulumi.Input<string>;
            /**
             * Scheduled end time for the outage (milliseconds since Unix epoch).
             */
            endTime?: pulumi.Input<string>;
            /**
             * Form this outage is expected to take, which can take one of the following values:
             * - OUTAGE: The Interconnect may be completely out of service for some or all of the specified window.
             * - PARTIAL_OUTAGE: Some circuits comprising the Interconnect as a whole should remain up, but with reduced bandwidth. Note that the versions of this enum prefixed with "IT_" have been deprecated in favor of the unprefixed values.
             */
            issueType?: pulumi.Input<string>;
            /**
             * Unique identifier for this outage notification.
             */
            name?: pulumi.Input<string>;
            /**
             * The party that generated this notification, which can take the following value:
             * - GOOGLE: this notification as generated by Google. Note that the value of NSRC_GOOGLE has been deprecated in favor of GOOGLE.
             */
            source?: pulumi.Input<string>;
            /**
             * Scheduled start time for the outage (milliseconds since Unix epoch).
             */
            startTime?: pulumi.Input<string>;
            /**
             * State of this notification, which can take one of the following values:
             * - ACTIVE: This outage notification is active. The event could be in the past, present, or future. See start_time and end_time for scheduling.
             * - CANCELLED: The outage associated with this notification was cancelled before the outage was due to start. Note that the versions of this enum prefixed with "NS_" have been deprecated in favor of the unprefixed values.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] JWT configuration for origin authentication. JWT configuration for origin authentication.
         */
        interface Jwt {
            /**
             * A JWT containing any of these audiences will be accepted. The service name will be accepted if audiences is empty. Examples: bookstore_android.apps.googleusercontent.com, bookstore_web.apps.googleusercontent.com
             */
            audiences?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Identifies the issuer that issued the JWT, which is usually a URL or an email address. Examples: https://securetoken.google.com, 1234567-compute@developer.gserviceaccount.com
             */
            issuer?: pulumi.Input<string>;
            /**
             * The provider's public key set to validate the signature of the JWT.
             */
            jwksPublicKeys?: pulumi.Input<string>;
            /**
             * jwt_headers and jwt_params define where to extract the JWT from an HTTP request. If no explicit location is specified, the following default locations are tried in order:
             *
             * 1. The Authorization header using the Bearer schema. See `here `_. Example:
             *
             * Authorization: Bearer .
             *
             * 2. `access_token` query parameter. See `this `_
             *
             * Multiple JWTs can be verified for a request. Each JWT has to be extracted from the locations its issuer specified or from the default locations.
             *
             * This field is set if JWT is sent in a request header. This field specifies the header name. For example, if `header=x-goog-iap-jwt-assertion`, the header format will be x-goog-iap-jwt-assertion: .
             */
            jwtHeaders?: pulumi.Input<pulumi.Input<inputs.compute.alpha.JwtHeader>[]>;
            /**
             * This field is set if JWT is sent in a query parameter. This field specifies the query parameter name. For example, if jwt_params[0] is jwt_token, the JWT format in the query parameter is /path?jwt_token=.
             */
            jwtParams?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Deprecated] This message specifies a header location to extract JWT token. This message specifies a header location to extract JWT token.
         */
        interface JwtHeader {
            /**
             * The HTTP header name.
             */
            name?: pulumi.Input<string>;
            /**
             * The value prefix. The value format is "value_prefix" For example, for "Authorization: Bearer ", value_prefix="Bearer " with a space at the end.
             */
            valuePrefix?: pulumi.Input<string>;
        }
        /**
         * Commitment for a particular license resource.
         */
        interface LicenseResourceCommitment {
            /**
             * The number of licenses purchased.
             */
            amount?: pulumi.Input<string>;
            /**
             * Specifies the core range of the instance for which this license applies.
             */
            coresPerLicense?: pulumi.Input<string>;
            /**
             * Any applicable license URI.
             */
            license?: pulumi.Input<string>;
        }
        interface LicenseResourceRequirements {
            /**
             * Minimum number of guest cpus required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minGuestCpuCount?: pulumi.Input<number>;
            /**
             * Minimum memory required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minMemoryMb?: pulumi.Input<number>;
        }
        interface LocalDisk {
            /**
             * Specifies the number of such disks.
             */
            diskCount?: pulumi.Input<number>;
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Specifies the desired disk type on the node. This disk type must be a local storage type (e.g.: local-ssd). Note that for nodeTemplates, this should be the name of the disk type and not its URL.
             */
            diskType?: pulumi.Input<string>;
        }
        /**
         * Specifies what kind of log the caller must write
         */
        interface LogConfig {
            /**
             * Cloud audit options.
             */
            cloudAudit?: pulumi.Input<inputs.compute.alpha.LogConfigCloudAuditOptions>;
            /**
             * Counter options.
             */
            counter?: pulumi.Input<inputs.compute.alpha.LogConfigCounterOptions>;
            /**
             * Data access options.
             */
            dataAccess?: pulumi.Input<inputs.compute.alpha.LogConfigDataAccessOptions>;
        }
        /**
         * Write a Cloud Audit log
         */
        interface LogConfigCloudAuditOptions {
            /**
             * Information used by the Cloud Audit Logging pipeline.
             */
            authorizationLoggingOptions?: pulumi.Input<inputs.compute.alpha.AuthorizationLoggingOptions>;
            /**
             * The log_name to populate in the Cloud Audit Record.
             */
            logName?: pulumi.Input<string>;
        }
        /**
         * Increment a streamz counter with the specified metric and field names.
         *
         * Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended.
         *
         * Field names correspond to IAM request parameters and field values are their respective values.
         *
         * Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields.
         *
         * Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/debug_access_count {iam_principal=[value of IAMContext.principal]}
         */
        interface LogConfigCounterOptions {
            /**
             * Custom fields.
             */
            customFields?: pulumi.Input<pulumi.Input<inputs.compute.alpha.LogConfigCounterOptionsCustomField>[]>;
            /**
             * The field value to attribute.
             */
            field?: pulumi.Input<string>;
            /**
             * The metric to update.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Custom fields. These can be used to create a counter with arbitrary field/value pairs. See: go/rpcsp-custom-fields.
         */
        interface LogConfigCounterOptionsCustomField {
            /**
             * Name is the field name.
             */
            name?: pulumi.Input<string>;
            /**
             * Value is the field value. It is important that in contrast to the CounterOptions.field, the value here is a constant that is not derived from the IAMContext.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Write a Data Access (Gin) log
         */
        interface LogConfigDataAccessOptions {
            logMode?: pulumi.Input<string>;
        }
        /**
         * A metadata key/value entry.
         */
        interface Metadata {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet.
             *
             * To see the latest fingerprint, make a get() request to retrieve the resource.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * Array of key/value pairs. The total size of all keys and values must be less than 512 KB.
             */
            items?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] Type of the resource. Always compute#metadata for metadata.
             */
            kind?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] Custom authenticator credentials. Custom authenticator credentials.
         */
        interface MetadataCredentialsFromPlugin {
            /**
             * Plugin name.
             */
            name?: pulumi.Input<string>;
            /**
             * A text proto that conforms to a Struct type definition interpreted by the plugin.
             */
            structConfig?: pulumi.Input<string>;
        }
        /**
         * Opaque filter criteria used by loadbalancers to restrict routing configuration to a limited set of loadbalancing proxies. Proxies and sidecars involved in loadbalancing would typically present metadata to the loadbalancers which need to match criteria specified here. If a match takes place, the relevant configuration is made available to those proxies.
         * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata.
         * An example for using metadataFilters would be: if loadbalancing involves  Envoys, they will only receive routing configuration when values in metadataFilters match values supplied in <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/core/base.proto#envoy-api-msg-core-node" Node metadata of their XDS requests to loadbalancers.
         */
        interface MetadataFilter {
            /**
             * The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria
             * This list must not be empty and can have at the most 64 entries.
             */
            filterLabels?: pulumi.Input<pulumi.Input<inputs.compute.alpha.MetadataFilterLabelMatch>[]>;
            /**
             * Specifies how individual filterLabel matches within the list of filterLabels contribute towards the overall metadataFilter match.
             * Supported values are:
             * - MATCH_ANY: At least one of the filterLabels must have a matching label in the provided metadata.
             * - MATCH_ALL: All filterLabels must have matching labels in the provided metadata.
             */
            filterMatchCriteria?: pulumi.Input<string>;
        }
        /**
         * MetadataFilter label name value pairs that are expected to match corresponding labels presented as metadata to the loadbalancer.
         */
        interface MetadataFilterLabelMatch {
            /**
             * Name of metadata label.
             * The name can have a maximum length of 1024 characters and must be at least 1 character long.
             */
            name?: pulumi.Input<string>;
            /**
             * The value of the label must match the specified value.
             * value can have a maximum length of 1024 characters.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] Configuration for the mutual Tls mode for peer authentication. Configuration for the mutual Tls mode for peer authentication.
         */
        interface MutualTls {
            /**
             * Specifies if the server TLS is configured to be strict or permissive. This field can be set to one of the following: STRICT: Client certificate must be presented, connection is in TLS. PERMISSIVE: Client certificate can be omitted, connection can be either plaintext or TLS.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * The named port. For example: .
         */
        interface NamedPort {
            /**
             * The name for this named port. The name must be 1-63 characters long, and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * The port number, which can be a value between 1 and 65535.
             */
            port?: pulumi.Input<number>;
        }
        /**
         * Configuration for an App Engine network endpoint group (NEG). The service is optional, may be provided explicitly or in the URL mask. The version is optional and can only be provided explicitly or in the URL mask when service is present.
         *
         * Note: App Engine service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupAppEngine {
            /**
             * Optional serving service.
             *
             * The service name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "default", "my-service".
             */
            service?: pulumi.Input<string>;
            /**
             * A template to parse service and version fields from a request URL. URL mask allows for routing to multiple App Engine services without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, the request URLs "foo1-dot-appname.appspot.com/v1" and "foo1-dot-appname.appspot.com/v2" can be backed by the same Serverless NEG with URL mask "-dot-appname.appspot.com/". The URL mask will parse them to { service = "foo1", version = "v1" } and { service = "foo1", version = "v2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
            /**
             * Optional serving version.
             *
             * The version name is case-sensitive and must be 1-100 characters long.
             *
             * Example value: "v1", "v2".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Function network endpoint group (NEG). The function must be provided explicitly or in the URL mask.
         *
         * Note: Cloud Function must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudFunction {
            /**
             * A user-defined name of the Cloud Function.
             *
             * The function name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "func1".
             */
            function?: pulumi.Input<string>;
            /**
             * A template to parse function field from a request URL. URL mask allows for routing to multiple Cloud Functions without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2" can be backed by the same Serverless NEG with URL mask "/". The URL mask will parse them to { function = "function1" } and { function = "function2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Run network endpoint group (NEG). The service must be provided explicitly or in the URL mask. The tag is optional, may be provided explicitly or in the URL mask.
         *
         * Note: Cloud Run service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudRun {
            /**
             * Cloud Run service is the main resource of Cloud Run.
             *
             * The service must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "run-service".
             */
            service?: pulumi.Input<string>;
            /**
             * Optional Cloud Run tag represents the "named-revision" to provide additional fine-grained traffic routing information.
             *
             * The tag must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "revision-0010".
             */
            tag?: pulumi.Input<string>;
            /**
             * A template to parse service and tag fields from a request URL. URL mask allows for routing to multiple Run services without having to create multiple network endpoint groups and backend services.
             *
             * For example, request URLs "foo1.domain.com/bar1" and "foo1.domain.com/bar2" can be backed by the same Serverless Network Endpoint Group (NEG) with URL mask ".domain.com/". The URL mask will parse them to { service="bar1", tag="foo1" } and { service="bar2", tag="foo2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * Load balancing specific fields for network endpoint group.
         */
        interface NetworkEndpointGroupLbNetworkEndpointGroup {
            /**
             * The default port used if the port number is not specified in the network endpoint. [Deprecated] This field is deprecated.
             */
            defaultPort?: pulumi.Input<number>;
            /**
             * The URL of the network to which all network endpoints in the NEG belong. Uses "default" project network if unspecified. [Deprecated] This field is deprecated.
             */
            network?: pulumi.Input<string>;
            /**
             * Optional URL of the subnetwork to which all network endpoints in the NEG belong. [Deprecated] This field is deprecated.
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * [Output Only] The URL of the zone where the network endpoint group is located. [Deprecated] This field is deprecated.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Serverless Deployment network endpoint group (NEG). The platform must be provided.
         *
         * Note: The target backend service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupServerlessDeployment {
            /**
             * The platform of the backend target(s) of this NEG. Possible values include:
             *
             *
             * - apigateway.googleapis.com
             * - appengine.googleapies.com
             * - cloudfunctions.googleapis.com
             * - run.googleapis.com
             */
            platform?: pulumi.Input<string>;
            /**
             * The user-defined name of the workload/instance. This value must be provided explicitly or in the urlMask. The resource identified by this value is platform-specific and is as follows:
             *
             *
             * - API Gateway: The gateway id
             * - AppEngine: The service name
             * - Cloud Functions: The function name
             * - Cloud Run: The service name
             */
            resource?: pulumi.Input<string>;
            /**
             * A template to parse platform-specific fields from a request URL. URL mask allows for routing to multiple services on the same serverless platform without having to create multiple Network Endpoint Groups and backend services. The fields parsed by this template is platform-specific and are as follows:
             *
             *
             * - API Gateway: The gateway id
             * - AppEngine: The service and version
             * - Cloud Functions: The function
             * - Cloud Run: The service and tag
             */
            urlMask?: pulumi.Input<string>;
            /**
             * The optional resource version. The version identified by this value is as platform-specific and is follows:
             *
             *
             * - API Gateway: Unused
             * - AppEngine: The service version
             * - Cloud Functions: Unused
             * - Cloud Run: The service tag
             */
            version?: pulumi.Input<string>;
        }
        /**
         * A network interface resource attached to an instance.
         */
        interface NetworkInterface {
            /**
             * An array of configurations for this interface. Currently, only one access config, ONE_TO_ONE_NAT, is supported. If there are no accessConfigs specified, then this instance will have no external internet access.
             */
            accessConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AccessConfig>[]>;
            /**
             * An array of alias IP ranges for this network interface. You can only specify this field for network interfaces in VPC networks.
             */
            aliasIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AliasIpRange>[]>;
            /**
             * Fingerprint hash of contents stored in this network interface. This field will be ignored when inserting an Instance or adding a NetworkInterface. An up-to-date fingerprint must be provided in order to update the NetworkInterface. The request will fail with error 400 Bad Request if the fingerprint is not provided, or 412 Precondition Failed if the fingerprint is out of date.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * [Output Only] The prefix length of the primary internal IPv6 range.
             */
            internalIpv6PrefixLength?: pulumi.Input<number>;
            /**
             * An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access.
             */
            ipv6AccessConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AccessConfig>[]>;
            /**
             * [Output Only] One of EXTERNAL, INTERNAL to indicate whether the IP can be accessed from the Internet. This field is always inherited from its subnetwork.
             *
             * Valid only if stackType is IPV4_IPV6.
             */
            ipv6AccessType?: pulumi.Input<string>;
            /**
             * [Output Only] An IPv6 internal network address for this network interface.
             */
            ipv6Address?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#networkInterface for network interfaces.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] The name of the network interface, which is generated by the server. For network devices, these are eth0, eth1, etc.
             */
            name?: pulumi.Input<string>;
            /**
             * URL of the network resource for this instance. When creating an instance, if neither the network nor the subnetwork is specified, the default network global/networks/default is used; if the network is not specified but the subnetwork is specified, the network is inferred.
             *
             * If you specify this property, you can specify the network as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/global/networks/network
             * - projects/project/global/networks/network
             * - global/networks/default
             */
            network?: pulumi.Input<string>;
            /**
             * An IPv4 internal IP address to assign to the instance for this network interface. If not specified by the user, an unused internal IP is assigned by the system.
             */
            networkIP?: pulumi.Input<string>;
            /**
             * The type of vNIC to be used on this interface. This may be gVNIC or VirtioNet.
             */
            nicType?: pulumi.Input<string>;
            /**
             * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It'll be empty if not specified by the users.
             */
            queueCount?: pulumi.Input<number>;
            /**
             * The stack type for this network interface to identify whether the IPv6 feature is enabled or not. If not specified, IPV4_ONLY will be used.
             *
             * This field can be both set at instance creation and update network interface operations.
             */
            stackType?: pulumi.Input<string>;
            /**
             * SubInterfaces help enable L2 communication for the instance over subnetworks that support L2. Every network interface will get a default untagged (vlan not specified) subinterface. Users can specify additional tagged subinterfaces which are sub-fields to the Network Interface.
             */
            subinterfaces?: pulumi.Input<pulumi.Input<inputs.compute.alpha.NetworkInterfaceSubInterface>[]>;
            /**
             * The URL of the Subnetwork resource for this instance. If the network resource is in legacy mode, do not specify this field. If the network is in auto subnet mode, specifying the subnetwork is optional. If the network is in custom subnet mode, specifying the subnetwork is required. If you specify this field, you can specify the subnetwork as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/regions/region/subnetworks/subnetwork
             * - regions/region/subnetworks/subnetwork
             */
            subnetwork?: pulumi.Input<string>;
        }
        interface NetworkInterfaceSubInterface {
            /**
             * An IPv4 internal IP address to assign to the instance for this subinterface.
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * If specified, this subnetwork must belong to the same network as that of the network interface. If not specified the subnet of network interface will be used. If you specify this property, you can specify the subnetwork as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/regions/region/subnetworks/subnetwork
             * - regions/region/subnetworks/subnetwork
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * VLAN tag. Should match the VLAN(s) supported by the subnetwork to which this subinterface is connecting.
             */
            vlan?: pulumi.Input<number>;
        }
        /**
         * A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
         */
        interface NetworkPeering {
            /**
             * Whether Cloud Routers in this network can automatically advertise subnets from the peer network.
             */
            advertisePeerSubnetsViaRouters?: pulumi.Input<boolean>;
            /**
             * This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            autoCreateRoutes?: pulumi.Input<boolean>;
            /**
             * Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            exchangeSubnetRoutes?: pulumi.Input<boolean>;
            /**
             * Whether to export the custom routes to peer network.
             */
            exportCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
             */
            exportSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Whether to import the custom routes from peer network.
             */
            importCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
             */
            importSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
             */
            network?: pulumi.Input<string>;
            /**
             * Maximum Transmission Unit in bytes.
             */
            peerMtu?: pulumi.Input<number>;
            /**
             * [Output Only] State for the peering, either `ACTIVE` or `INACTIVE`. The peering is `ACTIVE` when there's a matching configuration in the peer network.
             */
            state?: pulumi.Input<string>;
            /**
             * [Output Only] Details about the current state of the peering.
             */
            stateDetails?: pulumi.Input<string>;
        }
        interface NetworkPerformanceConfig {
            externalIpEgressBandwidthTier?: pulumi.Input<string>;
            totalEgressBandwidthTier?: pulumi.Input<string>;
        }
        /**
         * A routing configuration attached to a network resource. The message includes the list of routers associated with the network, and a flag indicating the type of routing behavior to enforce network-wide.
         */
        interface NetworkRoutingConfig {
            /**
             * The network-wide routing mode to use. If set to REGIONAL, this network's Cloud Routers will only advertise routes with subnets of this network in the same region as the router. If set to GLOBAL, this network's Cloud Routers will advertise routes with all subnets of this network, across regions.
             */
            routingMode?: pulumi.Input<string>;
        }
        interface NodeGroupAutoscalingPolicy {
            /**
             * The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             */
            maxNodes?: pulumi.Input<number>;
            /**
             * The minimum number of nodes that the group should have.
             */
            minNodes?: pulumi.Input<number>;
            /**
             * The autoscaling mode. Set to one of: ON, OFF, or ONLY_SCALE_OUT. For more information, see  Autoscaler modes.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily maintenance operations. GCE's internal maintenance will be performed within this window.
         */
        interface NodeGroupMaintenanceWindow {
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            maintenanceDuration?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        interface NodeTemplateNodeTypeFlexibility {
            cpus?: pulumi.Input<string>;
            localSsd?: pulumi.Input<string>;
            memory?: pulumi.Input<string>;
        }
        /**
         * Represents a gRPC setting that describes one gRPC notification endpoint and the retry duration attempting to send notification to this endpoint.
         */
        interface NotificationEndpointGrpcSettings {
            /**
             * Optional. If specified, this field is used to set the authority header by the sender of notifications. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
             */
            authority?: pulumi.Input<string>;
            /**
             * Endpoint to which gRPC notifications are sent. This must be a valid gRPCLB DNS name.
             */
            endpoint?: pulumi.Input<string>;
            /**
             * Optional. If specified, this field is used to populate the "name" field in gRPC requests.
             */
            payloadName?: pulumi.Input<string>;
            /**
             * Optional. This field is used to configure how often to send a full update of all non-healthy backends. If unspecified, full updates are not sent. If specified, must be in the range between 600 seconds to 3600 seconds. Nanos are disallowed.
             */
            resendInterval?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * How much time (in seconds) is spent attempting notification retries until a successful response is received. Default is 30s. Limit is 20m (1200s). Must be a positive number.
             */
            retryDurationSec?: pulumi.Input<number>;
        }
        /**
         * [Deprecated] Configuration for the origin authentication method. Configuration for the origin authentication method.
         */
        interface OriginAuthenticationMethod {
            jwt?: pulumi.Input<inputs.compute.alpha.Jwt>;
        }
        /**
         * Settings controlling the eviction of unhealthy hosts from the load balancing pool for the backend service.
         */
        interface OutlierDetection {
            /**
             * The base time that a host is ejected for. The real ejection time is equal to the base ejection time multiplied by the number of times the host has been ejected. Defaults to 30000ms or 30s.
             */
            baseEjectionTime?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * Number of errors before a host is ejected from the connection pool. When the backend host is accessed over HTTP, a 5xx return code qualifies as an error. Defaults to 5.
             */
            consecutiveErrors?: pulumi.Input<number>;
            /**
             * The number of consecutive gateway failures (502, 503, 504 status or connection errors that are mapped to one of those status codes) before a consecutive gateway failure ejection occurs. Defaults to 3.
             */
            consecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0.
             */
            enforcingConsecutiveErrors?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive gateway failures. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingConsecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through success rate statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingSuccessRate?: pulumi.Input<number>;
            /**
             * Time interval between ejection analysis sweeps. This can result in both new ejections as well as hosts being returned to service. Defaults to 1 second.
             */
            interval?: pulumi.Input<inputs.compute.alpha.Duration>;
            /**
             * Maximum percentage of hosts in the load balancing pool for the backend service that can be ejected. Defaults to 50%.
             */
            maxEjectionPercent?: pulumi.Input<number>;
            /**
             * The number of hosts in a cluster that must have enough request volume to detect success rate outliers. If the number of hosts is less than this setting, outlier detection via success rate statistics is not performed for any host in the cluster. Defaults to 5.
             */
            successRateMinimumHosts?: pulumi.Input<number>;
            /**
             * The minimum number of total requests that must be collected in one interval (as defined by the interval duration above) to include this host in success rate based outlier detection. If the volume is lower than this setting, outlier detection via success rate statistics is not performed for that host. Defaults to 100.
             */
            successRateRequestVolume?: pulumi.Input<number>;
            /**
             * This factor is used to determine the ejection threshold for success rate outlier ejection. The ejection threshold is the difference between the mean success rate, and the product of this factor and the standard deviation of the mean success rate: mean - (stdev * success_rate_stdev_factor). This factor is divided by a thousand to get a double. That is, if the desired factor is 1.9, the runtime value should be 1900. Defaults to 1900.
             */
            successRateStdevFactor?: pulumi.Input<number>;
        }
        interface PacketMirroringFilter {
            /**
             * Protocols that apply as filter on mirrored traffic. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            IPProtocols?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * IP CIDR ranges that apply as filter on the source (ingress) or destination (egress) IP in the IP header. Only IPv4 is supported. If no ranges are specified, all traffic that matches the specified IPProtocols is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            cidrRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Direction of traffic to mirror, either INGRESS, EGRESS, or BOTH. The default is BOTH.
             */
            direction?: pulumi.Input<string>;
        }
        interface PacketMirroringForwardingRuleInfo {
            /**
             * [Output Only] Unique identifier for the forwarding rule; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the forwarding rule representing the ILB configured as destination of the mirrored traffic.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfo {
            /**
             * A set of virtual machine instances that are being mirrored. They must live in zones contained in the same region as this packetMirroring.
             *
             * Note that this config will apply only to those network interfaces of the Instances that belong to the network specified in this packetMirroring.
             *
             * You may specify a maximum of 50 Instances.
             */
            instances?: pulumi.Input<pulumi.Input<inputs.compute.alpha.PacketMirroringMirroredResourceInfoInstanceInfo>[]>;
            /**
             * A set of subnetworks for which traffic from/to all VM instances will be mirrored. They must live in the same region as this packetMirroring.
             *
             * You may specify a maximum of 5 subnetworks.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.PacketMirroringMirroredResourceInfoSubnetInfo>[]>;
            /**
             * A set of mirrored tags. Traffic from/to all VM instances that have one or more of these tags will be mirrored.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface PacketMirroringMirroredResourceInfoInstanceInfo {
            /**
             * [Output Only] Unique identifier for the instance; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the virtual machine instance which is being mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfoSubnetInfo {
            /**
             * [Output Only] Unique identifier for the subnetwork; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the subnetwork for which traffic from/to all VM instances will be mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringNetworkInfo {
            /**
             * [Output Only] Unique identifier for the network; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * URL of the network resource.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * A matcher for the path portion of the URL. The BackendService from the longest-matched rule will serve the URL. If no rule was matched, the default service will be used.
         */
        interface PathMatcher {
            /**
             * defaultRouteAction takes effect when none of the  pathRules or routeRules match. The load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If defaultRouteAction specifies any weightedBackendServices, defaultService must not be set. Conversely if defaultService is set, defaultRouteAction cannot contain any  weightedBackendServices.
             * Only one of defaultRouteAction or defaultUrlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathMatcher's defaultRouteAction.
             */
            defaultRouteAction?: pulumi.Input<inputs.compute.alpha.HttpRouteAction>;
            /**
             * The full or partial URL to the BackendService resource. This will be used if none of the pathRules or routeRules defined by this PathMatcher are matched. For example, the following are all valid URLs to a BackendService resource:
             * - https://www.googleapis.com/compute/v1/projects/project/global/backendServices/backendService
             * - compute/v1/projects/project/global/backendServices/backendService
             * - global/backendServices/backendService  If defaultRouteAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if defaultService is specified, defaultRouteAction cannot contain any weightedBackendServices. Conversely, if defaultRouteAction specifies any weightedBackendServices, defaultService must not be specified.
             * Only one of defaultService, defaultUrlRedirect  or defaultRouteAction.weightedBackendService must be set.
             * Authorization requires one or more of the following Google IAM permissions on the specified resource default_service:
             * - compute.backendBuckets.use
             * - compute.backendServices.use
             */
            defaultService?: pulumi.Input<string>;
            /**
             * When none of the specified pathRules or routeRules match, the request is redirected to a URL specified by defaultUrlRedirect.
             * If defaultUrlRedirect is specified, defaultService or defaultRouteAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            defaultUrlRedirect?: pulumi.Input<inputs.compute.alpha.HttpRedirectAction>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * HeaderAction specified here are applied after the matching HttpRouteRule HeaderAction and before the HeaderAction in the UrlMap
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.alpha.HttpHeaderAction>;
            /**
             * The name to which this PathMatcher is referred by the HostRule.
             */
            name?: pulumi.Input<string>;
            /**
             * The list of path rules. Use this list instead of routeRules when routing based on simple path matching is all that's required. The order by which path rules are specified does not matter. Matches are always done on the longest-path-first basis.
             * For example: a pathRule with a path /a/b/c/* will match before /a/b/* irrespective of the order in which those paths appear in this list.
             * Within a given pathMatcher, only one of pathRules or routeRules must be set.
             */
            pathRules?: pulumi.Input<pulumi.Input<inputs.compute.alpha.PathRule>[]>;
            /**
             * The list of HTTP route rules. Use this list instead of pathRules when advanced route matching and routing actions are desired. routeRules are evaluated in order of priority, from the lowest to highest number.
             * Within a given pathMatcher, you can set only one of pathRules or routeRules.
             */
            routeRules?: pulumi.Input<pulumi.Input<inputs.compute.alpha.HttpRouteRule>[]>;
        }
        /**
         * A path-matching rule for a URL. If matched, will use the specified BackendService to handle the traffic arriving at this URL.
         */
        interface PathRule {
            /**
             * The list of path patterns to match. Each must start with / and the only place a * is allowed is at the end following a /. The string fed to the path matcher does not include any text after the first ? or #, and those chars are not allowed here.
             */
            paths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * In response to a matching path, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of routeAction or urlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.alpha.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When a path pattern is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.alpha.HttpRedirectAction>;
        }
        /**
         * [Deprecated] Configuration for the peer authentication method. Configuration for the peer authentication method.
         */
        interface PeerAuthenticationMethod {
            /**
             * Set if mTLS is used for peer authentication.
             */
            mtls?: pulumi.Input<inputs.compute.alpha.MutualTls>;
        }
        /**
         * [Deprecated] All fields defined in a permission are ANDed.
         */
        interface Permission {
            /**
             * Extra custom constraints. The constraints are ANDed together.
             */
            constraints?: pulumi.Input<pulumi.Input<inputs.compute.alpha.PermissionConstraint>[]>;
            /**
             * Used in Ingress or Egress Gateway cases to specify hosts that the policy applies to. Exact match, prefix match, and suffix match are supported.
             */
            hosts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * HTTP method.
             */
            methods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of hosts. Specifies exclusions.
             */
            notHosts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of methods. Specifies exclusions.
             */
            notMethods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of paths. Specifies exclusions.
             */
            notPaths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of ports. Specifies exclusions.
             */
            notPorts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * HTTP request paths or gRPC methods. Exact match, prefix match, and suffix match are supported.
             */
            paths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Port names or numbers.
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Custom constraint that specifies a key and a list of allowed values for Istio attributes.
         */
        interface PermissionConstraint {
            /**
             * Key of the constraint.
             */
            key?: pulumi.Input<string>;
            /**
             * A list of allowed values.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Deprecated] All fields defined in a principal are ANDed.
         */
        interface Principal {
            /**
             * An expression to specify custom condition.
             */
            condition?: pulumi.Input<string>;
            /**
             * The groups the principal belongs to. Exact match, prefix match, and suffix match are supported.
             */
            groups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * IPv4 or IPv6 address or range (In CIDR format)
             */
            ips?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The namespaces. Exact match, prefix match, and suffix match are supported.
             */
            namespaces?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of groups. Specifies exclusions.
             */
            notGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of IPs. Specifies exclusions.
             */
            notIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of namespaces. Specifies exclusions.
             */
            notNamespaces?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Negate of users. Specifies exclusions.
             */
            notUsers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A map of Istio attribute to expected values. Exact match, prefix match, and suffix match are supported for values. For example, `request.headers[version]: "v1"`. The properties are ANDed together.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The user names/IDs or service accounts. Exact match, prefix match, and suffix match are supported.
             */
            users?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a CIDR range which can be used to assign addresses.
         */
        interface PublicAdvertisedPrefixPublicDelegatedPrefix {
            /**
             * The IP address range of the public delegated prefix
             */
            ipRange?: pulumi.Input<string>;
            /**
             * The name of the public delegated prefix
             */
            name?: pulumi.Input<string>;
            /**
             * The project number of the public delegated prefix
             */
            project?: pulumi.Input<string>;
            /**
             * The region of the public delegated prefix if it is regional. If absent, the prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * The status of the public delegated prefix. Possible values are: INITIALIZING: The public delegated prefix is being initialized and addresses cannot be created yet. ANNOUNCED: The public delegated prefix is active.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Represents a sub PublicDelegatedPrefix.
         */
        interface PublicDelegatedPrefixPublicDelegatedSubPrefix {
            /**
             * Name of the project scoping this PublicDelegatedSubPrefix.
             */
            delegateeProject?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The IPv4 address range, in CIDR format, represented by this sub public delegated prefix.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * Whether the sub prefix is delegated to create Address resources in the delegatee project.
             */
            isAddress?: pulumi.Input<boolean>;
            /**
             * The name of the sub public delegated prefix.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The region of the sub public delegated prefix if it is regional. If absent, the sub prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the sub public delegated prefix.
             */
            status?: pulumi.Input<string>;
        }
        interface RbacPolicy {
            /**
             * Name of the RbacPolicy.
             */
            name?: pulumi.Input<string>;
            /**
             * The list of permissions.
             */
            permissions?: pulumi.Input<pulumi.Input<inputs.compute.alpha.Permission>[]>;
            /**
             * The list of principals.
             */
            principals?: pulumi.Input<pulumi.Input<inputs.compute.alpha.Principal>[]>;
        }
        /**
         * A policy that specifies how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
         */
        interface RequestMirrorPolicy {
            /**
             * The full or partial URL to the BackendService resource being mirrored to.
             */
            backendService?: pulumi.Input<string>;
        }
        /**
         * Represents a reservation resource. A reservation ensures that capacity is held in a specific zone even if the reserved VMs are not running. For more information, read  Reserving zonal resources. (== resource_for {$api_version}.reservations ==)
         */
        interface Reservation {
            /**
             * [Output Only] Full or partial URL to a parent commitment. This field displays for reservations that are tied to a commitment.
             */
            commitment?: pulumi.Input<string>;
            /**
             * [Output Only] Creation timestamp in RFC3339 text format.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The unique identifier for the resource. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#reservations for reservations.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of the resource, provided by the client when initially creating the resource. The resource name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] Reserved for future use.
             */
            satisfiesPzs?: pulumi.Input<boolean>;
            /**
             * [Output Only] Server-defined fully-qualified URL for this resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output Only] Server-defined URL for this resource with the resource id.
             */
            selfLinkWithId?: pulumi.Input<string>;
            /**
             * Share-settings for shared-reservation
             */
            shareSettings?: pulumi.Input<inputs.compute.alpha.AllocationShareSettings>;
            /**
             * Reservation for instances with specific machine shapes.
             */
            specificReservation?: pulumi.Input<inputs.compute.alpha.AllocationSpecificSKUReservation>;
            /**
             * Indicates whether the reservation can be consumed by VMs with affinity for "any" reservation. If the field is set, then only VMs that target the reservation by name can consume from this reservation.
             */
            specificReservationRequired?: pulumi.Input<boolean>;
            /**
             * [Output Only] The status of the reservation.
             */
            status?: pulumi.Input<string>;
            /**
             * Zone in which the reservation resides. A zone must be provided if the reservation is created within a commitment.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Specifies the reservations that this instance can consume from.
         */
        interface ReservationAffinity {
            /**
             * Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See  Consuming reserved instances for examples.
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify googleapis.com/reservation-name as the key and specify the name of your reservation as its value.
             */
            key?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of a reservation resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Commitment for a particular resource (a Commitment is composed of one or more of these).
         */
        interface ResourceCommitment {
            /**
             * Name of the accelerator type resource. Applicable only when the type is ACCELERATOR.
             */
            acceleratorType?: pulumi.Input<string>;
            /**
             * The amount of the resource purchased (in a type-dependent unit, such as bytes). For vCPUs, this can just be an integer. For memory, this must be provided in MB. Memory must be a multiple of 256 MB, with up to 6.5GB of memory per every vCPU.
             */
            amount?: pulumi.Input<string>;
            /**
             * Type of resource for which this commitment applies. Possible values are VCPU and MEMORY
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily operations.
         */
        interface ResourcePolicyDailyCycle {
            /**
             * Defines a schedule with units measured in months. The value determines how many months pass between the start of each cycle.
             */
            daysInCycle?: pulumi.Input<number>;
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * A GroupPlacementPolicy specifies resource placement configuration. It specifies the failure bucket separation as well as network locality
         */
        interface ResourcePolicyGroupPlacementPolicy {
            /**
             * The number of availability domains instances will be spread across. If two instances are in different availability domain, they will not be put in the same low latency network
             */
            availabilityDomainCount?: pulumi.Input<number>;
            /**
             * Specifies network collocation
             */
            collocation?: pulumi.Input<string>;
            /**
             * Specifies network locality
             */
            locality?: pulumi.Input<string>;
            /**
             * Scope specifies the availability domain to which the VMs should be spread.
             */
            scope?: pulumi.Input<string>;
            /**
             * Specifies instances to hosts placement relationship
             */
            style?: pulumi.Input<string>;
            /**
             * Number of vms in this placement group
             */
            vmCount?: pulumi.Input<number>;
        }
        /**
         * Time window specified for hourly operations.
         */
        interface ResourcePolicyHourlyCycle {
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Defines a schedule with units measured in hours. The value determines how many hours pass between the start of each cycle.
             */
            hoursInCycle?: pulumi.Input<number>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * An InstanceSchedulePolicy specifies when and how frequent certain operations are performed on the instance.
         */
        interface ResourcePolicyInstanceSchedulePolicy {
            /**
             * The expiration time of the schedule. The timestamp is an RFC3339 string.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * The start time of the schedule. The timestamp is an RFC3339 string.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Specifies the time zone to be used in interpreting Schedule.schedule. The value of this field must be a time zone name from the tz database: http://en.wikipedia.org/wiki/Tz_database.
             */
            timeZone?: pulumi.Input<string>;
            /**
             * Specifies the schedule for starting instances.
             */
            vmStartSchedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicyInstanceSchedulePolicySchedule>;
            /**
             * Specifies the schedule for stopping instances.
             */
            vmStopSchedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicyInstanceSchedulePolicySchedule>;
        }
        /**
         * Schedule for an instance operation.
         */
        interface ResourcePolicyInstanceSchedulePolicySchedule {
            /**
             * Specifies the frequency for the operation, using the unix-cron format.
             */
            schedule?: pulumi.Input<string>;
        }
        /**
         * Contains output only fields. Use this sub-message for all output fields set on ResourcePolicy. The internal structure of this "status" field should mimic the structure of ResourcePolicy proto specification.
         */
        interface ResourcePolicyResourceStatus {
            /**
             * [Output Only] Specifies a set of output values reffering to the instance_schedule_policy system status. This field should have the same name as corresponding policy field.
             */
            instanceSchedulePolicy?: pulumi.Input<inputs.compute.alpha.ResourcePolicyResourceStatusInstanceSchedulePolicyStatus>;
        }
        interface ResourcePolicyResourceStatusInstanceSchedulePolicyStatus {
            /**
             * [Output Only] The last time the schedule successfully ran. The timestamp is an RFC3339 string.
             */
            lastRunStartTime?: pulumi.Input<string>;
            /**
             * [Output Only] The next time the schedule is planned to run. The actual time might be slightly different. The timestamp is an RFC3339 string.
             */
            nextRunStartTime?: pulumi.Input<string>;
        }
        /**
         * A snapshot schedule policy specifies when and how frequently snapshots are to be created for the target disk. Also specifies how many and how long these scheduled snapshots should be retained.
         */
        interface ResourcePolicySnapshotSchedulePolicy {
            /**
             * Retention policy applied to snapshots created by this resource policy.
             */
            retentionPolicy?: pulumi.Input<inputs.compute.alpha.ResourcePolicySnapshotSchedulePolicyRetentionPolicy>;
            /**
             * A Vm Maintenance Policy specifies what kind of infrastructure maintenance we are allowed to perform on this VM and when. Schedule that is applied to disks covered by this policy.
             */
            schedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicySnapshotSchedulePolicySchedule>;
            /**
             * Properties with which snapshots are created such as labels, encryption keys.
             */
            snapshotProperties?: pulumi.Input<inputs.compute.alpha.ResourcePolicySnapshotSchedulePolicySnapshotProperties>;
        }
        /**
         * Policy for retention of scheduled snapshots.
         */
        interface ResourcePolicySnapshotSchedulePolicyRetentionPolicy {
            /**
             * Maximum age of the snapshot that is allowed to be kept.
             */
            maxRetentionDays?: pulumi.Input<number>;
            /**
             * TODO(b/165626794): Remove this field Specifies the behavior to apply to existing, scheduled snapshots snapshots if the policy is changed.
             */
            onPolicySwitch?: pulumi.Input<string>;
            /**
             * Specifies the behavior to apply to scheduled snapshots when the source disk is deleted.
             */
            onSourceDiskDelete?: pulumi.Input<string>;
        }
        /**
         * A schedule for disks where the schedueled operations are performed.
         */
        interface ResourcePolicySnapshotSchedulePolicySchedule {
            dailySchedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicyDailyCycle>;
            hourlySchedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicyHourlyCycle>;
            weeklySchedule?: pulumi.Input<inputs.compute.alpha.ResourcePolicyWeeklyCycle>;
        }
        /**
         * Specified snapshot properties for scheduled snapshots created by this policy.
         */
        interface ResourcePolicySnapshotSchedulePolicySnapshotProperties {
            /**
             * Chain name that the snapshot is created in.
             */
            chainName?: pulumi.Input<string>;
            /**
             * Indication to perform a 'guest aware' snapshot.
             */
            guestFlush?: pulumi.Input<boolean>;
            /**
             * Labels to apply to scheduled snapshots. These can be later modified by the setLabels method. Label values may be empty.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Cloud Storage bucket storage location of the auto snapshot (regional or multi-regional).
             */
            storageLocations?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface ResourcePolicyVmMaintenancePolicy {
            concurrencyControlGroup?: pulumi.Input<inputs.compute.alpha.ResourcePolicyVmMaintenancePolicyConcurrencyControl>;
            /**
             * Maintenance windows that are applied to VMs covered by this policy.
             */
            maintenanceWindow?: pulumi.Input<inputs.compute.alpha.ResourcePolicyVmMaintenancePolicyMaintenanceWindow>;
        }
        /**
         * A concurrency control configuration. Defines a group config that, when attached to an instance, recognizes that instance as part of a group of instances where only up the concurrency_limit of instances in that group can undergo simultaneous maintenance. For more information: go/concurrency-control-design-doc
         */
        interface ResourcePolicyVmMaintenancePolicyConcurrencyControl {
            concurrencyLimit?: pulumi.Input<number>;
        }
        /**
         * A maintenance window for VMs. When set, we restrict our maintenance operations to this window.
         */
        interface ResourcePolicyVmMaintenancePolicyMaintenanceWindow {
            dailyMaintenanceWindow?: pulumi.Input<inputs.compute.alpha.ResourcePolicyDailyCycle>;
        }
        /**
         * Time window specified for weekly operations.
         */
        interface ResourcePolicyWeeklyCycle {
            /**
             * Up to 7 intervals/windows, one for each day of the week.
             */
            dayOfWeeks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.ResourcePolicyWeeklyCycleDayOfWeek>[]>;
        }
        interface ResourcePolicyWeeklyCycleDayOfWeek {
            /**
             * Defines a schedule that runs on specific days of the week. Specify one or more days. The following options are available: MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, SUNDAY.
             */
            day?: pulumi.Input<string>;
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Contains output only fields. Use this sub-message for actual values set on Instance attributes as compared to the value requested by the user (intent) in their instance CRUD calls.
         */
        interface ResourceStatus {
            scheduling?: pulumi.Input<inputs.compute.alpha.ResourceStatusScheduling>;
        }
        interface ResourceStatusScheduling {
            /**
             * Specifies the availability domain (AD), which this instance should be scheduled on. The AD belongs to the spread GroupPlacementPolicy resource policy that has been assigned to the instance. Specify a value between 1-max count of availability domains in your GroupPlacementPolicy. See go/placement-policy-extension for more details.
             */
            availabilityDomain?: pulumi.Input<number>;
        }
        /**
         * A rollout policy configuration.
         */
        interface RolloutPolicy {
            /**
             * An optional RFC3339 timestamp on or after which the update is considered rolled out to any zone that is not explicitly stated.
             */
            defaultRolloutTime?: pulumi.Input<string>;
            /**
             * Location based rollout policies to apply to the resource.
             *
             * Currently only zone names are supported and must be represented as valid URLs, like: zones/us-central1-a.
             *
             * The value expects an RFC3339 timestamp on or after which the update is considered rolled out to the specified location.
             */
            locationRolloutPolicies?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Description-tagged IP ranges for the router to advertise.
         */
        interface RouterAdvertisedIpRange {
            /**
             * User-specified description for the IP range.
             */
            description?: pulumi.Input<string>;
            /**
             * The IP range to advertise. The value must be a CIDR-formatted string.
             */
            range?: pulumi.Input<string>;
        }
        interface RouterBgp {
            /**
             * User-specified flag to indicate which mode to use for advertisement. The options are DEFAULT or CUSTOM.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These groups will be advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These IP ranges will be advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.alpha.RouterAdvertisedIpRange>[]>;
            /**
             * Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. All VPN tunnels that link to this router will have the same local ASN.
             */
            asn?: pulumi.Input<number>;
            /**
             * The interval in seconds between BGP keepalive messages that are sent to the peer.
             * Not currently available publicly.
             * Hold time is three times the interval at which keepalive messages are sent, and the hold time is the maximum number of seconds allowed to elapse between successive keepalive messages that BGP receives from a peer.
             * BGP will use the smaller of either the local hold time value or the peer's hold time value as the hold time for the BGP connection between the two peers.
             * If set, this value must be between 20 and 60. The default is 20.
             */
            keepaliveInterval?: pulumi.Input<number>;
        }
        interface RouterBgpPeer {
            /**
             * User-specified flag to indicate which mode to use for advertisement.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode, which can take one of the following options:
             * - ALL_SUBNETS: Advertises all available subnets, including peer VPC subnets.
             * - ALL_VPC_SUBNETS: Advertises the router's own VPC subnets. Note that this field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These groups are advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These IP ranges are advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.alpha.RouterAdvertisedIpRange>[]>;
            /**
             * The priority of routes advertised to this BGP peer. Where there is more than one matching route of maximum length, the routes with the lowest priority value win.
             */
            advertisedRoutePriority?: pulumi.Input<number>;
            /**
             * BFD configuration for the BGP peering.
             * Not currently available publicly.
             */
            bfd?: pulumi.Input<inputs.compute.alpha.RouterBgpPeerBfd>;
            /**
             * The status of the BGP peer connection.
             * Not currently available publicly.
             * If set to FALSE, any active session with the peer is terminated and all associated routing information is removed. If set to TRUE, the peer connection can be established with routing information. The default is TRUE.
             */
            enable?: pulumi.Input<string>;
            /**
             * Name of the interface the BGP peer is associated with.
             */
            interfaceName?: pulumi.Input<string>;
            /**
             * IP address of the interface inside Google Cloud Platform. Only IPv4 is supported.
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this BGP peer.
             * - MANAGED_BY_USER is the default value and can be managed by you or other users
             * - MANAGED_BY_ATTACHMENT is a BGP peer that is configured and managed by Cloud Interconnect, specifically by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of BGP peer when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this BGP peer. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * Peer BGP Autonomous System Number (ASN). Each BGP interface may use a different value.
             */
            peerAsn?: pulumi.Input<number>;
            /**
             * IP address of the BGP interface outside Google Cloud Platform. Only IPv4 is supported.
             */
            peerIpAddress?: pulumi.Input<string>;
            /**
             * URI of the VM instance that is used as third-party router appliances such as Next Gen Firewalls, Virtual Routers, or Router Appliances. The VM instance must be located in zones contained in the same region as this Cloud Router. The VM instance is the peer side of the BGP session.
             */
            routerApplianceInstance?: pulumi.Input<string>;
        }
        interface RouterBgpPeerBfd {
            /**
             * The minimum interval, in milliseconds, between BFD control packets received from the peer router. The actual value is negotiated between the two routers and is equal to the greater of this value and the transmit interval of the other router.
             * Not currently available publicly.
             * If set, this value must be between 100 and 30000.
             * The default is 300.
             */
            minReceiveInterval?: pulumi.Input<number>;
            /**
             * The minimum interval, in milliseconds, between BFD control packets transmitted to the peer router. The actual value is negotiated between the two routers and is equal to the greater of this value and the corresponding receive interval of the other router.
             * Not currently available publicly.
             * If set, this value must be between 100 and 30000.
             * The default is 300.
             */
            minTransmitInterval?: pulumi.Input<number>;
            /**
             * The BFD session initialization mode for this BGP peer. If set to ACTIVE, the Cloud Router will initiate the BFD session for this BGP peer. If set to PASSIVE, the Cloud Router will wait for the peer router to initiate the BFD session for this BGP peer. If set to DISABLED, BFD is disabled for this BGP peer. The default is PASSIVE.
             */
            mode?: pulumi.Input<string>;
            /**
             * The number of consecutive BFD packets that must be missed before BFD declares that a peer is unavailable.
             * Not currently available publicly.
             * If set, the value must be a value between 2 and 16.
             * The default is 3.
             */
            multiplier?: pulumi.Input<number>;
            /**
             * The BFD packet mode for this BGP peer. If set to CONTROL_AND_ECHO, BFD echo mode is enabled for this BGP peer. In this mode, if the peer router also has BFD echo mode enabled, BFD echo packets will be sent to the other router. If the peer router does not have BFD echo mode enabled, only control packets will be sent. If set to CONTROL_ONLY, BFD echo mode is disabled for this BGP peer. If this router and the peer router have a multihop connection, this should be set to CONTROL_ONLY as BFD echo mode is only supported on singlehop connections. The default is CONTROL_AND_ECHO.
             */
            packetMode?: pulumi.Input<string>;
            /**
             * The BFD session initialization mode for this BGP peer.
             * Not currently available publicly.
             * If set to ACTIVE, the Cloud Router will initiate the BFD session for this BGP peer. If set to PASSIVE, the Cloud Router will wait for the peer router to initiate the BFD session for this BGP peer. If set to DISABLED, BFD is disabled for this BGP peer. The default is PASSIVE.
             */
            sessionInitializationMode?: pulumi.Input<string>;
            /**
             * The minimum interval, in milliseconds, between BFD control packets transmitted to and received from the peer router when BFD echo mode is enabled on both routers. The actual transmit and receive intervals are negotiated between the two routers and are equal to the greater of this value and the corresponding interval on the other router. If set, this value must be between 1000 and 30000. The default is 5000.
             */
            slowTimerInterval?: pulumi.Input<number>;
        }
        interface RouterInterface {
            /**
             * IP address and range of the interface. The IP range must be in the RFC3927 link-local IP address space. The value must be a CIDR-formatted string, for example: 169.254.0.1/30. NOTE: Do not truncate the address as it represents the IP address of the interface.
             */
            ipRange?: pulumi.Input<string>;
            /**
             * URI of the linked Interconnect attachment. It must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedInterconnectAttachment?: pulumi.Input<string>;
            /**
             * URI of the linked VPN tunnel, which must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedVpnTunnel?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this interface.
             * - MANAGED_BY_USER is the default value and can be managed directly by users.
             * - MANAGED_BY_ATTACHMENT is an interface that is configured and managed by Cloud Interconnect, specifically, by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of interface when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this interface entry. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * The regional private internal IP address that is used to establish BGP sessions to a VM instance acting as a third-party Router Appliance, such as a Next Gen Firewall, a Virtual Router, or an SD-WAN VM.
             */
            privateIpAddress?: pulumi.Input<string>;
            /**
             * Name of the interface that will be redundant with the current interface you are creating. The redundantInterface must belong to the same Cloud Router as the interface here. To establish the BGP session to a Router Appliance VM, you must create two BGP peers. The two BGP peers must be attached to two separate interfaces that are redundant with each other. The redundant_interface must be 1-63 characters long, and comply with RFC1035. Specifically, the redundant_interface must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            redundantInterface?: pulumi.Input<string>;
            /**
             * The URL of the subnetwork resource that this interface belongs to, which must be in the same region as the Cloud Router. When you establish a BGP session to a VM instance using this interface, the VM instance must belong to the same subnetwork as the subnetwork specified here.
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * Represents a Nat resource. It enables the VMs within the specified subnetworks to access Internet without external IP addresses. It specifies a list of subnetworks (and the ranges within) that want to use NAT. Customers can also provide the external IPs that would be used for NAT. GCP would auto-allocate ephemeral IPs if no external IPs are provided.
         */
        interface RouterNat {
            /**
             * A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT only.
             */
            drainNatIps?: pulumi.Input<pulumi.Input<string>[]>;
            enableEndpointIndependentMapping?: pulumi.Input<boolean>;
            /**
             * Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.
             */
            icmpIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Configure logging on this NAT.
             */
            logConfig?: pulumi.Input<inputs.compute.alpha.RouterNatLogConfig>;
            /**
             * Minimum number of ports allocated to a VM from this NAT config. If not set, a default number of ports is allocated to a VM. This is rounded up to the nearest power of 2. For example, if the value of this field is 50, at least 64 ports are allocated to a VM.
             */
            minPortsPerVm?: pulumi.Input<number>;
            /**
             * Unique name of this Nat service. The name must be 1-63 characters long and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * Specify the NatIpAllocateOption, which can take one of the following values:
             * - MANUAL_ONLY: Uses only Nat IP addresses provided by customers. When there are not enough specified Nat IPs, the Nat service fails for new VMs.
             * - AUTO_ONLY: Nat IPs are allocated by Google Cloud Platform; customers can't specify any Nat IPs. When choosing AUTO_ONLY, then nat_ip should be empty.
             */
            natIpAllocateOption?: pulumi.Input<string>;
            /**
             * A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
             */
            natIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of rules associated with this NAT.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.compute.alpha.RouterNatRule>[]>;
            /**
             * Specify the Nat option, which can take one of the following values:
             * - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat.
             * - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat.
             * - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
             */
            sourceSubnetworkIpRangesToNat?: pulumi.Input<string>;
            /**
             * A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.RouterNatSubnetworkToNat>[]>;
            /**
             * Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
             */
            tcpEstablishedIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
             */
            tcpTimeWaitTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
             */
            tcpTransitoryIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
             */
            udpIdleTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * Configuration of logging on a NAT.
         */
        interface RouterNatLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Specify the desired filtering of logs on this NAT. If unspecified, logs are exported for all connections handled by this NAT. This option can take one of the following values:
             * - ERRORS_ONLY: Export logs only for connection failures.
             * - TRANSLATIONS_ONLY: Export logs only for successful connections.
             * - ALL: Export logs for all connections, successful and unsuccessful.
             */
            filter?: pulumi.Input<string>;
        }
        interface RouterNatRule {
            /**
             * The action to be enforced for traffic that matches this rule.
             */
            action?: pulumi.Input<inputs.compute.alpha.RouterNatRuleAction>;
            /**
             * An optional description of this rule.
             */
            description?: pulumi.Input<string>;
            /**
             * CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding ?action? is enforced.
             *
             * The following examples are valid match expressions:
             *
             * "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')"
             *
             * "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'"
             */
            match?: pulumi.Input<string>;
            /**
             * An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
             */
            ruleNumber?: pulumi.Input<number>;
        }
        interface RouterNatRuleAction {
            /**
             * A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project.
             */
            sourceNatActiveIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only.
             */
            sourceNatDrainIps?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Defines the IP ranges that want to use NAT for a subnetwork.
         */
        interface RouterNatSubnetworkToNat {
            /**
             * URL for the subnetwork resource that will use NAT.
             */
            name?: pulumi.Input<string>;
            /**
             * A list of the secondary ranges of the Subnetwork that are allowed to use NAT. This can be populated only if "LIST_OF_SECONDARY_IP_RANGES" is one of the values in source_ip_ranges_to_nat.
             */
            secondaryIpRangeNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specify the options for NAT ranges in the Subnetwork. All options of a single value are valid except NAT_IP_RANGE_OPTION_UNSPECIFIED. The only valid option with multiple values is: ["PRIMARY_IP_RANGE", "LIST_OF_SECONDARY_IP_RANGES"] Default: [ALL_IP_RANGES]
             */
            sourceIpRangesToNat?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A rule to be applied in a Policy.
         */
        interface Rule {
            /**
             * Required
             */
            action?: pulumi.Input<string>;
            /**
             * Additional restrictions that must be met. All conditions must pass for the rule to match.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.compute.alpha.Condition>[]>;
            /**
             * Human-readable description of the rule.
             */
            description?: pulumi.Input<string>;
            /**
             * If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
             */
            ins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
             */
            logConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.LogConfig>[]>;
            /**
             * If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
             */
            notIns?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
             */
            permissions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SSLHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, SSL health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the SSL connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * An instance-attached disk resource.
         */
        interface SavedAttachedDisk {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             */
            boot?: pulumi.Input<boolean>;
            /**
             * Specifies the name of the disk attached to the source instance.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * The encryption key for the disk.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.alpha.CustomerEncryptionKey>;
            /**
             * The size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * [Output Only] URL of the disk type resource. For example: projects/project/zones/zone/diskTypes/pd-standard or pd-ssd
             */
            diskType?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.alpha.GuestOsFeature>[]>;
            /**
             * Specifies zero-based index of the disk that is attached to the source instance.
             */
            index?: pulumi.Input<number>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME.
             */
            interface?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#attachedDisk for attached disks.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Any valid publicly visible licenses.
             */
            licenses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The mode in which this disk is attached to the source instance, either READ_WRITE or READ_ONLY.
             */
            mode?: pulumi.Input<string>;
            /**
             * Specifies a URL of the disk attached to the source instance.
             */
            source?: pulumi.Input<string>;
            /**
             * [Output Only] A size of the storage used by the disk's snapshot by this machine image.
             */
            storageBytes?: pulumi.Input<string>;
            /**
             * [Output Only] An indicator whether storageBytes is in a stable state or it is being adjusted as a result of shared storage reallocation. This status can either be UPDATING, meaning the size of the snapshot is being updated, or UP_TO_DATE, meaning the size of the snapshot is up-to-date.
             */
            storageBytesStatus?: pulumi.Input<string>;
            /**
             * Specifies the type of the attached disk, either SCRATCH or PERSISTENT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Sets the scheduling options for an Instance. NextID: 20
         */
        interface Scheduling {
            /**
             * Specifies whether the instance should be automatically restarted if it is terminated by Compute Engine (not terminated by a user). You can only set the automatic restart option for standard instances. Preemptible instances cannot be automatically restarted.
             *
             * By default, this is set to true so an instance is automatically restarted if it is terminated by Compute Engine.
             */
            automaticRestart?: pulumi.Input<boolean>;
            /**
             * Specifies the availability domain (AD), which this instance should be scheduled on. The AD belongs to the spread GroupPlacementPolicy resource policy that has been assigned to the instance. Specify a value between 1-max count of availability domains in your GroupPlacementPolicy. See go/placement-policy-extension for more details.
             */
            availabilityDomain?: pulumi.Input<number>;
            /**
             * Defines whether the instance is tolerant of higher cpu latency. This can only be set during instance creation, or when the instance is not currently running. It must not be set if the preemptible option is also set.
             */
            latencyTolerant?: pulumi.Input<boolean>;
            /**
             * An opaque location hint used to place the instance close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * Specifies the number of hours after instance creation where the instance won't be scheduled for maintenance.
             */
            maintenanceFreezeDurationHours?: pulumi.Input<number>;
            /**
             * Specifies whether this VM may be a stable fleet VM. Setting this to "Periodic" designates this VM as a Stable Fleet VM.
             *
             * See go/stable-fleet-ug for more details.
             */
            maintenanceInterval?: pulumi.Input<string>;
            /**
             * The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node.
             */
            minNodeCpus?: pulumi.Input<number>;
            /**
             * A set of node affinity and anti-affinity configurations. Refer to Configuring node affinity for more information. Overrides reservationAffinity.
             */
            nodeAffinities?: pulumi.Input<pulumi.Input<inputs.compute.alpha.SchedulingNodeAffinity>[]>;
            /**
             * Defines the maintenance behavior for this instance. For standard instances, the default behavior is MIGRATE. For preemptible instances, the default and only possible behavior is TERMINATE. For more information, see Setting Instance Scheduling Options.
             */
            onHostMaintenance?: pulumi.Input<string>;
            /**
             * Defines whether the instance is preemptible. This can only be set during instance creation or while the instance is stopped and therefore, in a `TERMINATED` state. See Instance Life Cycle for more information on the possible instance states.
             */
            preemptible?: pulumi.Input<boolean>;
        }
        /**
         * Node Affinity: the configuration of desired nodes onto which this Instance could be scheduled.
         */
        interface SchedulingNodeAffinity {
            /**
             * Corresponds to the label key of Node resource.
             */
            key?: pulumi.Input<string>;
            /**
             * Defines the operation of node selection. Valid operators are IN for affinity and NOT_IN for anti-affinity.
             */
            operator?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of Node resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Deprecated] The configuration to access the SDS server. The configuration to access the SDS server.
         */
        interface SdsConfig {
            /**
             * The configuration to access the SDS server over GRPC.
             */
            grpcServiceConfig?: pulumi.Input<inputs.compute.alpha.GrpcServiceConfig>;
        }
        /**
         * Configuration options for Cloud Armor Adaptive Protection (CAAP).
         */
        interface SecurityPolicyAdaptiveProtectionConfig {
            /**
             * If set to true, enables Cloud Armor Machine Learning.
             */
            layer7DdosDefenseConfig?: pulumi.Input<inputs.compute.alpha.SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfig>;
        }
        /**
         * Configuration options for L7 DDoS detection.
         */
        interface SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfig {
            /**
             * If set to true, enables CAAP for L7 DDoS detection.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Rule visibility can be one of the following: STANDARD - opaque rules. (default) PREMIUM - transparent rules.
             */
            ruleVisibility?: pulumi.Input<string>;
        }
        interface SecurityPolicyAssociation {
            /**
             * The resource that the security policy is attached to.
             */
            attachmentId?: pulumi.Input<string>;
            /**
             * [Output Only] The display name of the security policy of the association.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The name for an association.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The security policy ID of the association.
             */
            securityPolicyId?: pulumi.Input<string>;
        }
        /**
         * Configuration options for Cloud Armor.
         */
        interface SecurityPolicyCloudArmorConfig {
            /**
             * If set to true, enables Cloud Armor Machine Learning.
             */
            enableMl?: pulumi.Input<boolean>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface SecurityPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The direction in which this rule applies. This field may only be specified when versioned_expr is set to FIREWALL.
             */
            direction?: pulumi.Input<string>;
            /**
             * Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
             *
             * This field may only be specified when the versioned_expr is set to FIREWALL.
             */
            enableLogging?: pulumi.Input<boolean>;
            /**
             * Optional, additional actions that are performed on headers.
             */
            headerAction?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleHttpHeaderAction>;
            /**
             * [Output only] Type of the resource. Always compute#securityPolicyRule for security policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleMatcher>;
            /**
             * If set to true, the specified action is not enforced.
             */
            preview?: pulumi.Input<boolean>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
             */
            priority?: pulumi.Input<number>;
            /**
             * Must be specified if the action is "rate_based_ban" or "throttle". Cannot be specified for any other actions.
             */
            rateLimitOptions?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleRateLimitOptions>;
            /**
             * This must be specified for redirect actions. Cannot be specified for any other actions.
             */
            redirectTarget?: pulumi.Input<string>;
            /**
             * Identifier for the rule. This is only unique within the given security policy. This can only be set during rule creation, if rule number is not specified it will be generated by the server.
             */
            ruleNumber?: pulumi.Input<string>;
            /**
             * [Output Only] Calculation of the complexity of a single firewall security policy rule.
             */
            ruleTupleCount?: pulumi.Input<number>;
            /**
             * A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            targetResources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of service accounts indicating the sets of instances that are applied with this rule.
             */
            targetServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SecurityPolicyRuleHttpHeaderAction {
            /**
             * The list of request headers to add or overwrite if they?re already present.
             */
            requestHeadersToAdds?: pulumi.Input<pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleHttpHeaderActionHttpHeaderOption>[]>;
        }
        interface SecurityPolicyRuleHttpHeaderActionHttpHeaderOption {
            /**
             * The name of the header to set.
             */
            headerName?: pulumi.Input<string>;
            /**
             * The value to set the named header to.
             */
            headerValue?: pulumi.Input<string>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface SecurityPolicyRuleMatcher {
            /**
             * The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified.
             */
            config?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleMatcherConfig>;
            /**
             * User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
             */
            expr?: pulumi.Input<inputs.compute.alpha.Expr>;
            /**
             * Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding src_ip_range field in config.
             */
            versionedExpr?: pulumi.Input<string>;
        }
        interface SecurityPolicyRuleMatcherConfig {
            /**
             * CIDR IP address range.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            destIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            destPorts?: pulumi.Input<pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleMatcherConfigDestinationPort>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            layer4Configs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleMatcherConfigLayer4Config>[]>;
            /**
             * CIDR IP address range. Maximum number of src_ip_ranges allowed is 10.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SecurityPolicyRuleMatcherConfigDestinationPort {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SecurityPolicyRuleMatcherConfigLayer4Config {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SecurityPolicyRuleRateLimitOptions {
            /**
             * Can only be specified if the action for the rule is "rate_based_ban". If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
             */
            banDurationSec?: pulumi.Input<number>;
            /**
             * Can only be specified if the action for the rule is "rate_based_ban". If specified, the key will be banned for the configured 'ban_duration_sec' when the number of requests that exceed the 'rate_limit_threshold' also exceed this 'ban_threshold'.
             */
            banThreshold?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleRateLimitOptionsThreshold>;
            /**
             * Action to take when requests are under the given threshold. When requests are throttled, this is also the action for all requests which are not dropped. Valid options are "allow", "fairshare", and "drop_overload".
             */
            conformAction?: pulumi.Input<string>;
            /**
             * Determines the key to enforce the threshold_rps limit on. If key is "IP", each IP has this limit enforced separately, whereas "ALL_IPs" means a single limit is applied to all requests matching this rule.
             */
            enforceOnKey?: pulumi.Input<string>;
            /**
             * When a request is denied, returns the HTTP response code specified. Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
             */
            exceedAction?: pulumi.Input<string>;
            /**
             * Threshold at which to begin ratelimiting.
             */
            rateLimitThreshold?: pulumi.Input<inputs.compute.alpha.SecurityPolicyRuleRateLimitOptionsThreshold>;
        }
        interface SecurityPolicyRuleRateLimitOptionsThreshold {
            /**
             * Number of HTTP(S) requests for calculating the threshold.
             */
            count?: pulumi.Input<number>;
            /**
             * Interval over which the threshold is computed.
             */
            intervalSec?: pulumi.Input<number>;
        }
        /**
         * The authentication and authorization settings for a BackendService.
         */
        interface SecuritySettings {
            /**
             * [Deprecated] Use clientTlsPolicy instead.
             */
            authentication?: pulumi.Input<string>;
            /**
             * [Deprecated] Authentication policy defines what authentication methods can be accepted on backends, and if authenticated, which method/certificate will set the request principal. request principal.
             */
            authenticationPolicy?: pulumi.Input<inputs.compute.alpha.AuthenticationPolicy>;
            /**
             * [Deprecated] Authorization config defines the Role Based Access Control (RBAC) config. Authorization config defines the Role Based Access Control (RBAC) config.
             */
            authorizationConfig?: pulumi.Input<inputs.compute.alpha.AuthorizationConfig>;
            /**
             * Optional. A URL referring to a networksecurity.ClientTlsPolicy resource that describes how clients should authenticate with this service's backends.
             * clientTlsPolicy only applies to a global BackendService with the loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * If left blank, communications are not encrypted.
             * Note: This field currently has no impact.
             */
            clientTlsPolicy?: pulumi.Input<string>;
            /**
             * [Deprecated] TLS Settings for the backend service.
             */
            clientTlsSettings?: pulumi.Input<inputs.compute.alpha.ClientTlsSettings>;
            /**
             * Optional. A list of Subject Alternative Names (SANs) that the client verifies during a mutual TLS handshake with an server/endpoint for this BackendService. When the server presents its X.509 certificate to the client, the client inspects the certificate's subjectAltName field. If the field contains one of the specified values, the communication continues. Otherwise, it fails. This additional check enables the client to verify that the server is authorized to run the requested service.
             * Note that the contents of the server certificate's subjectAltName field are configured by the Public Key Infrastructure which provisions server identities.
             * Only applies to a global BackendService with loadBalancingScheme set to INTERNAL_SELF_MANAGED. Only applies when BackendService has an attached clientTlsPolicy with clientCertificate (mTLS mode).
             * Note: This field currently has no impact.
             */
            subjectAltNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface ServerBinding {
            type?: pulumi.Input<string>;
        }
        /**
         * The TLS settings for the server.
         */
        interface ServerTlsSettings {
            /**
             * Configures the mechanism to obtain security certificates and identity information.
             */
            proxyTlsContext?: pulumi.Input<inputs.compute.alpha.TlsContext>;
            /**
             * A list of alternate names to verify the subject identity in the certificate presented by the client.
             */
            subjectAltNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Indicates whether connections should be secured using TLS. The value of this field determines how TLS is enforced. This field can be set to one of the following:
             * - SIMPLE Secure connections with standard TLS semantics.
             * - MUTUAL Secure connections to the backends using mutual TLS by presenting client certificates for authentication.
             */
            tlsMode?: pulumi.Input<string>;
        }
        /**
         * A service account.
         */
        interface ServiceAccount {
            /**
             * Email address of the service account.
             */
            email?: pulumi.Input<string>;
            /**
             * The list of scopes to be made available for this service account.
             */
            scopes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Output Only] A consumer forwarding rule connected to this service attachment.
         */
        interface ServiceAttachmentConsumerForwardingRule {
            /**
             * The url of a consumer forwarding rule.
             */
            forwardingRule?: pulumi.Input<string>;
            /**
             * The status of the forwarding rule.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enabled by default.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Disabled by default.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled. Enabled by default.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The policy describes the baseline against which Instance boot integrity is measured.
         */
        interface ShieldedInstanceIntegrityPolicy {
            /**
             * Updates the integrity policy baseline using the measurements from the VM instance's most recent boot.
             */
            updateAutoLearnPolicy?: pulumi.Input<boolean>;
        }
        /**
         * A set of Shielded VM options.
         */
        interface ShieldedVmConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The policy describes the baseline against which VM instance boot integrity is measured.
         */
        interface ShieldedVmIntegrityPolicy {
            /**
             * Updates the integrity policy baseline using the measurements from the VM instance's most recent boot.
             */
            updateAutoLearnPolicy?: pulumi.Input<boolean>;
        }
        interface SourceDiskEncryptionKey {
            /**
             * The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.alpha.CustomerEncryptionKey>;
            /**
             * URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values:
             * - https://www.googleapis.com/compute/v1/projects/project/zones/zone/disks/disk
             * - projects/project/zones/zone/disks/disk
             * - zones/zone/disks/disk
             */
            sourceDisk?: pulumi.Input<string>;
        }
        /**
         * A specification of the parameters to use when creating the instance template from a source instance.
         */
        interface SourceInstanceParams {
            /**
             * Attached disks configuration. If not provided, defaults are applied: For boot disk and any other R/W disks, new custom images will be created from each disk. For read-only disks, they will be attached in read-only mode. Local SSD disks will be created as blank volumes.
             */
            diskConfigs?: pulumi.Input<pulumi.Input<inputs.compute.alpha.DiskInstantiationConfig>[]>;
        }
        interface SourceInstanceProperties {
            /**
             * Enables instances created based on this machine image to send packets with source IP addresses other than their own and receive packets with destination IP addresses other than their own. If these instances will be used as an IP gateway or it will be set as the next-hop in a Route resource, specify true. If unsure, leave this set to false. See the Enable IP forwarding documentation for more information.
             */
            canIpForward?: pulumi.Input<boolean>;
            /**
             * Whether the instance created from this machine image should be protected against deletion.
             */
            deletionProtection?: pulumi.Input<boolean>;
            /**
             * An optional text description for the instances that are created from this machine image.
             */
            description?: pulumi.Input<string>;
            /**
             * An array of disks that are associated with the instances that are created from this machine image.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.compute.alpha.SavedAttachedDisk>[]>;
            /**
             * A list of guest accelerator cards' type and count to use for instances created from this machine image.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.alpha.AcceleratorConfig>[]>;
            /**
             * Labels to apply to instances that are created from this machine image.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The machine type to use for instances that are created from this machine image.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs to assign to instances that are created from this machine image. These pairs can consist of custom metadata or predefined keys. See Project and instance metadata for more information.
             */
            metadata?: pulumi.Input<inputs.compute.alpha.Metadata>;
            /**
             * Minimum cpu/platform to be used by instances created from this machine image. The instance may be scheduled on the specified or newer cpu/platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: "Intel Haswell" or minCpuPlatform: "Intel Sandy Bridge". For more information, read Specifying a Minimum CPU Platform.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * An array of network access configurations for this interface.
             */
            networkInterfaces?: pulumi.Input<pulumi.Input<inputs.compute.alpha.NetworkInterface>[]>;
            /**
             * PostKeyRevocationActionType of the instance.
             */
            postKeyRevocationActionType?: pulumi.Input<string>;
            /**
             * Specifies the scheduling options for the instances that are created from this machine image.
             */
            scheduling?: pulumi.Input<inputs.compute.alpha.Scheduling>;
            /**
             * A list of service accounts with specified scopes. Access tokens for these service accounts are available to the instances that are created from this machine image. Use metadata queries to obtain the access tokens for these instances.
             */
            serviceAccounts?: pulumi.Input<pulumi.Input<inputs.compute.alpha.ServiceAccount>[]>;
            /**
             * A list of tags to apply to the instances that are created from this machine image. The tags identify valid sources or targets for network firewalls. The setTags method can modify this list of tags. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<inputs.compute.alpha.Tags>;
        }
        /**
         * Configuration and status of a managed SSL certificate.
         */
        interface SslCertificateManagedSslCertificate {
            /**
             * [Output only] Detailed statuses of the domains specified for managed certificate resource.
             */
            domainStatus?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The domains for which a managed SSL certificate will be generated. Each Google-managed SSL certificate supports up to the [maximum number of domains per Google-managed SSL certificate](/load-balancing/docs/quotas#ssl_certificates).
             */
            domains?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Output only] Status of the managed certificate resource.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Configuration and status of a self-managed SSL certificate.
         */
        interface SslCertificateSelfManagedSslCertificate {
            /**
             * A local certificate file. The certificate must be in PEM format. The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert.
             */
            certificate?: pulumi.Input<string>;
            /**
             * A write-only private key in PEM format. Only insert requests will include this field.
             */
            privateKey?: pulumi.Input<string>;
        }
        interface StatefulPolicy {
            preservedState?: pulumi.Input<inputs.compute.alpha.StatefulPolicyPreservedState>;
        }
        /**
         * Configuration of preserved resources.
         */
        interface StatefulPolicyPreservedState {
            /**
             * Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
             */
            disks?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * External network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name.
             */
            externalIPs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Internal network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name.
             */
            internalIPs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * The available logging options for this subnetwork.
         */
        interface SubnetworkLogConfig {
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Default is an interval of 5 seconds per connection.
             */
            aggregationInterval?: pulumi.Input<string>;
            /**
             * Whether to enable flow logging for this subnetwork. If this field is not explicitly set, it will not appear in get listings. If not set the default behavior is to disable flow logging.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Export filter used to define which VPC flow logs should be logged.
             */
            filterExpr?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. The value of the field must be in [0, 1]. Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. Default is 0.5, which means half of all collected logs are reported.
             */
            flowSampling?: pulumi.Input<number>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Configures whether all, none or a subset of metadata fields should be added to the reported VPC flow logs. Default is EXCLUDE_ALL_METADATA.
             */
            metadata?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" was set to CUSTOM_METADATA.
             */
            metadataFields?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a secondary IP range of a subnetwork.
         */
        interface SubnetworkSecondaryRange {
            /**
             * The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported. The range can be any range listed in the Valid ranges list.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.
             */
            rangeName?: pulumi.Input<string>;
        }
        /**
         * Subsetting options to make L4 ILB support any number of backend instances
         */
        interface Subsetting {
            policy?: pulumi.Input<string>;
        }
        interface TCPHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, TCP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the TCP connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * A set of instance tags.
         */
        interface Tags {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the tags' contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update tags. You must always provide an up-to-date fingerprint hash in order to update or change tags.
             *
             * To see the latest fingerprint, make get() request to the instance.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * An array of tags. Each tag must be 1-63 characters long, and comply with RFC1035.
             */
            items?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Deprecated] Defines the mechanism to obtain the client or server certificate. Defines the mechanism to obtain the client or server certificate.
         */
        interface TlsCertificateContext {
            /**
             * Specifies the certificate and private key paths. This field is applicable only if tlsCertificateSource is set to USE_PATH.
             */
            certificatePaths?: pulumi.Input<inputs.compute.alpha.TlsCertificatePaths>;
            /**
             * Defines how TLS certificates are obtained.
             */
            certificateSource?: pulumi.Input<string>;
            /**
             * Specifies the config to retrieve certificates through SDS. This field is applicable only if tlsCertificateSource is set to USE_SDS.
             */
            sdsConfig?: pulumi.Input<inputs.compute.alpha.SdsConfig>;
        }
        /**
         * [Deprecated] The paths to the mounted TLS Certificates and private key. The paths to the mounted TLS Certificates and private key.
         */
        interface TlsCertificatePaths {
            /**
             * The path to the file holding the client or server TLS certificate to use.
             */
            certificatePath?: pulumi.Input<string>;
            /**
             * The path to the file holding the client or server private key.
             */
            privateKeyPath?: pulumi.Input<string>;
        }
        /**
         * [Deprecated] The TLS settings for the client or server. The TLS settings for the client or server.
         */
        interface TlsContext {
            /**
             * Defines the mechanism to obtain the client or server certificate.
             */
            certificateContext?: pulumi.Input<inputs.compute.alpha.TlsCertificateContext>;
            /**
             * Defines the mechanism to obtain the Certificate Authority certificate to validate the client/server certificate. If omitted, the proxy will not validate the server or client certificate.
             */
            validationContext?: pulumi.Input<inputs.compute.alpha.TlsValidationContext>;
        }
        /**
         * [Deprecated] Defines the mechanism to obtain the Certificate Authority certificate to validate the client/server certificate. validate the client/server certificate.
         */
        interface TlsValidationContext {
            /**
             * The path to the file holding the CA certificate to validate the client or server certificate.
             */
            certificatePath?: pulumi.Input<string>;
            /**
             * Specifies the config to retrieve certificates through SDS. This field is applicable only if tlsCertificateSource is set to USE_SDS.
             */
            sdsConfig?: pulumi.Input<inputs.compute.alpha.SdsConfig>;
            /**
             * Defines how TLS certificates are obtained.
             */
            validationSource?: pulumi.Input<string>;
        }
        interface UDPHealthCheck {
            /**
             * The UDP port number for the health check request. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Raw data of request to send in payload of UDP packet. It is an error if this is empty. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. It is an error if this is empty. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * Upcoming Maintenance notification information.
         */
        interface UpcomingMaintenance {
            /**
             * [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
             */
            date?: pulumi.Input<string>;
            /**
             * [Output Only] The start time window of the maintenance disruption.
             */
            startTimeWindow?: pulumi.Input<inputs.compute.alpha.UpcomingMaintenanceTimeWindow>;
            /**
             * [Output Only] The time when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
             */
            time?: pulumi.Input<string>;
            /**
             * Defines the type of maintenance.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format.
         */
        interface UpcomingMaintenanceTimeWindow {
            earliest?: pulumi.Input<string>;
            latest?: pulumi.Input<string>;
        }
        /**
         * Message for the expected URL mappings.
         */
        interface UrlMapTest {
            /**
             * The weight to use for the supplied host and path when using advanced routing rules that involve traffic splitting.
             */
            backendServiceWeight?: pulumi.Input<number>;
            /**
             * Description of this test case.
             */
            description?: pulumi.Input<string>;
            /**
             * The expected output URL evaluated by load balancer containing the scheme, host, path and query parameters.
             * For rules that forward requests to backends, the test passes only when expectedOutputUrl matches the request forwarded by load balancer to backends. For rules with urlRewrite, the test verifies that the forwarded request matches hostRewrite and pathPrefixRewrite in the urlRewrite action. When service is specified, expectedOutputUrl`s scheme is ignored.
             * For rules with urlRedirect, the test passes only if expectedOutputUrl matches the URL in the load balancer's redirect response. If urlRedirect specifies https_redirect, the test passes only if the scheme in expectedOutputUrl is also set to https. If urlRedirect specifies strip_query, the test passes only if expectedOutputUrl does not contain any query parameters.
             * expectedOutputUrl is optional when service is specified.
             */
            expectedOutputUrl?: pulumi.Input<string>;
            /**
             * For rules with urlRedirect, the test passes only if expectedRedirectResponseCode matches the HTTP status code in load balancer's redirect response.
             * expectedRedirectResponseCode cannot be set when service is set.
             */
            expectedRedirectResponseCode?: pulumi.Input<number>;
            /**
             * The expected URL that should be redirected to for the host and path being tested. [Deprecated] This field is deprecated. Use expected_output_url instead.
             */
            expectedUrlRedirect?: pulumi.Input<string>;
            /**
             * HTTP headers for this request. If headers contains a host header, then host must also match the header value.
             */
            headers?: pulumi.Input<pulumi.Input<inputs.compute.alpha.UrlMapTestHeader>[]>;
            /**
             * Host portion of the URL. If headers contains a host header, then host must also match the header value.
             */
            host?: pulumi.Input<string>;
            /**
             * Path portion of the URL.
             */
            path?: pulumi.Input<string>;
            /**
             * Expected BackendService or BackendBucket resource the given URL should be mapped to.
             * service cannot be set if expectedRedirectResponseCode is set.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * HTTP headers used in UrlMapTests.
         */
        interface UrlMapTestHeader {
            /**
             * Header name.
             */
            name?: pulumi.Input<string>;
            /**
             * Header value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The spec for modifying the path before sending the request to the matched backend service.
         */
        interface UrlRewrite {
            /**
             * Prior to forwarding the request to the selected service, the request's host header is replaced with contents of hostRewrite.
             * The value must be between 1 and 255 characters.
             */
            hostRewrite?: pulumi.Input<string>;
            /**
             * Prior to forwarding the request to the selected backend service, the matching portion of the request's path is replaced by pathPrefixRewrite.
             * The value must be between 1 and 1024 characters.
             */
            pathPrefixRewrite?: pulumi.Input<string>;
        }
        /**
         * A VPN gateway interface.
         */
        interface VpnGatewayVpnGatewayInterface {
            /**
             * The numeric ID of this VPN gateway interface.
             */
            id?: pulumi.Input<number>;
            /**
             * URL of the interconnect attachment resource. When the value of this field is present, the VPN Gateway will be used for IPsec-encrypted Cloud Interconnect; all Egress or Ingress traffic for this VPN Gateway interface will go through the specified interconnect attachment resource.
             * Not currently available in all Interconnect locations.
             */
            interconnectAttachment?: pulumi.Input<string>;
            /**
             * [Output Only] The external IP address for this VPN gateway interface.
             */
            ipAddress?: pulumi.Input<string>;
        }
        /**
         * In contrast to a single BackendService in  HttpRouteAction to which all matching traffic is directed to, WeightedBackendService allows traffic to be split across multiple BackendServices. The volume of traffic for each BackendService is proportional to the weight specified in each WeightedBackendService
         */
        interface WeightedBackendService {
            /**
             * The full or partial URL to the default BackendService resource. Before forwarding the request to backendService, the loadbalancer applies any relevant headerActions specified as part of this backendServiceWeight.
             */
            backendService?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * headerAction specified here take effect before headerAction in the enclosing HttpRouteRule, PathMatcher and UrlMap.
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.alpha.HttpHeaderAction>;
            /**
             * Specifies the fraction of traffic sent to backendService, computed as weight / (sum of all weightedBackendService weights in routeAction) .
             * The selection of a backend service is determined only for new traffic. Once a user's request has been directed to a backendService, subsequent requests will be sent to the same backendService as determined by the BackendService's session affinity policy.
             * The value must be between 0 and 1000
             */
            weight?: pulumi.Input<number>;
        }
    }
    namespace beta {
        /**
         * A specification of the type and number of accelerator cards attached to the instance.
         */
        interface AcceleratorConfig {
            /**
             * The number of the guest accelerator cards exposed to this instance.
             */
            acceleratorCount?: pulumi.Input<number>;
            /**
             * Full or partial URL of the accelerator type resource to attach to this instance. For example: projects/my-project/zones/us-central1-c/acceleratorTypes/nvidia-tesla-p100 If you are creating an instance template, specify only the accelerator name. See GPUs on Compute Engine for a full list of accelerator types.
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * An access configuration attached to an instance's network interface. Only one access config per instance is supported.
         */
        interface AccessConfig {
            /**
             * [Output Only] Type of the resource. Always compute#accessConfig for access configs.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of this access configuration. The default and recommended name is External NAT, but you can use any arbitrary string, such as My external IP or Network Access.
             */
            name?: pulumi.Input<string>;
            /**
             * An external IP address associated with this instance. Specify an unused static external IP address available to the project or leave this field undefined to use an IP from a shared ephemeral IP address pool. If you specify a static external IP address, it must live in the same region as the zone of the instance.
             */
            natIP?: pulumi.Input<string>;
            /**
             * This signifies the networking tier used for configuring this access configuration and can only take the following values: PREMIUM, STANDARD.
             *
             * If an AccessConfig is specified without a valid external IP address, an ephemeral IP will be created with this networkTier.
             *
             * If an AccessConfig with a valid external IP address is specified, it must match that of the networkTier associated with the Address resource owning that IP.
             */
            networkTier?: pulumi.Input<string>;
            /**
             * The DNS domain name for the public PTR record. You can set this field only if the `setPublicPtr` field is enabled.
             */
            publicPtrDomainName?: pulumi.Input<string>;
            /**
             * Specifies whether a public DNS 'PTR' record should be created to map the external IP address of the instance to a DNS domain name.
             */
            setPublicPtr?: pulumi.Input<boolean>;
            /**
             * The type of configuration. The default and only option is ONE_TO_ONE_NAT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled).
         */
        interface AdvancedMachineFeatures {
            /**
             * Whether to enable nested virtualization or not (default is false).
             */
            enableNestedVirtualization?: pulumi.Input<boolean>;
        }
        /**
         * An alias IP range attached to an instance's network interface.
         */
        interface AliasIpRange {
            /**
             * The IP alias ranges to allocate for this interface. This IP CIDR range must belong to the specified subnetwork and cannot contain IP addresses reserved by system or used by other network interfaces. This range may be a single IP address (such as 10.2.3.4), a netmask (such as /24) or a CIDR-formatted string (such as 10.1.2.0/24).
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name of a subnetwork secondary IP range from which to allocate an IP alias range. If not specified, the primary range of the subnetwork is used.
             */
            subnetworkRangeName?: pulumi.Input<string>;
        }
        interface AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk {
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
        }
        /**
         * Properties of the SKU instances being reserved. Next ID: 9
         */
        interface AllocationSpecificSKUAllocationReservedInstanceProperties {
            /**
             * Specifies accelerator type and count.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.beta.AcceleratorConfig>[]>;
            /**
             * Specifies amount of local ssd to reserve with each instance. The type of disk is local-ssd.
             */
            localSsds?: pulumi.Input<pulumi.Input<inputs.compute.beta.AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk>[]>;
            /**
             * An opaque location hint used to place the allocation close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * Specifies type of machine (name only) which has fixed number of vCPUs and fixed amount of memory. This also includes specifying custom machine type following custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY pattern.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Minimum cpu platform the reservation.
             */
            minCpuPlatform?: pulumi.Input<string>;
        }
        /**
         * This reservation type allows to pre allocate specific instance configuration.
         */
        interface AllocationSpecificSKUReservation {
            /**
             * Specifies the number of resources that are allocated.
             */
            count?: pulumi.Input<string>;
            /**
             * [Output Only] Indicates how many instances are in use.
             */
            inUseCount?: pulumi.Input<string>;
            /**
             * The instance properties for the reservation.
             */
            instanceProperties?: pulumi.Input<inputs.compute.beta.AllocationSpecificSKUAllocationReservedInstanceProperties>;
        }
        /**
         * An instance-attached disk resource.
         */
        interface AttachedDisk {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             */
            boot?: pulumi.Input<boolean>;
            /**
             * Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance.
             *
             * If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Encrypts or decrypts a disk using a customer-supplied encryption key.
             *
             * If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key.
             *
             * If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance.
             *
             * If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.beta.CustomerEncryptionKey>;
            /**
             * The size of the disk in GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.beta.GuestOsFeature>[]>;
            /**
             * [Output Only] A zero-based index to this disk, where 0 is reserved for the boot disk. If you have many disks attached to an instance, each disk would have a unique index number.
             */
            index?: pulumi.Input<number>;
            /**
             * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
             *
             * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
             */
            initializeParams?: pulumi.Input<inputs.compute.beta.AttachedDiskInitializeParams>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. Persistent disks must always use SCSI and the request will fail if you attempt to attach a persistent disk in any other format than SCSI. Local SSDs can use either NVME or SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#attachedDisk for attached disks.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Any valid publicly visible licenses.
             */
            licenses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If not specified, the default is to attach the disk in READ_WRITE mode.
             */
            mode?: pulumi.Input<string>;
            /**
             * [Output Only] shielded vm initial state stored on disk
             */
            shieldedInstanceInitialState?: pulumi.Input<inputs.compute.beta.InitialStateConfig>;
            /**
             * Specifies a valid partial or full URL to an existing Persistent Disk resource. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * If desired, you can also attach existing non-root persistent disks using this property. This field is only applicable for persistent disks.
             *
             * Note that for InstanceTemplate, specify the disk name, not the URL for the disk.
             */
            source?: pulumi.Input<string>;
            /**
             * Specifies the type of the disk, either SCRATCH or PERSISTENT. If not specified, the default is PERSISTENT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
         *
         * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
         */
        interface AttachedDiskInitializeParams {
            /**
             * An optional description. Provide this property when creating the disk.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies the disk name. If not specified, the default is to use the name of the instance. If a disk with the same name already exists in the given region, the existing disk is attached to the new instance and the new disk is not created.
             */
            diskName?: pulumi.Input<string>;
            /**
             * Specifies the size of the disk in base-2 GB. The size must be at least 10 GB. If you specify a sourceImage, which is required for boot disks, the default size is the size of the sourceImage. If you do not specify a sourceImage, the default disk size is 500 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk type to use to create the instance. If not specified, the default is pd-standard, specified using the full URL. For example:
             * https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/pd-standard
             *
             *
             * Other values include pd-ssd and local-ssd. If you define this field, you can provide either the full or partial URL. For example, the following are valid values:
             * - https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/diskType
             * - projects/project/zones/zone/diskTypes/diskType
             * - zones/zone/diskTypes/diskType  Note that for InstanceTemplate, this is the name of the disk type, not URL.
             */
            diskType?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             *
             * Guest OS features are applied by merging initializeParams.guestOsFeatures and disks.guestOsFeatures
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.beta.GuestOsFeature>[]>;
            /**
             * Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Indicates whether or not the disk can be read/write attached to more than one instance.
             */
            multiWriter?: pulumi.Input<boolean>;
            /**
             * Specifies which action to take on instance update with this disk. Default is to use the existing disk.
             */
            onUpdateAction?: pulumi.Input<string>;
            /**
             * Indicates how many IOPS must be provisioned for the disk.
             */
            provisionedIops?: pulumi.Input<string>;
            /**
             * Resource policies applied to this disk for automatic snapshot creations. Specified using the full or partial URL. For instance template, specify only the resource policy name.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image:
             * projects/debian-cloud/global/images/family/debian-9
             *
             *
             * Alternatively, use a specific version of a public operating system image:
             * projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD
             *
             *
             * To create a disk with a custom image that you created, specify the image name in the following format:
             * global/images/my-custom-image
             *
             *
             * You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name:
             * global/images/family/my-image-family
             *
             *
             * If the source image is deleted later, this field will not be set.
             */
            sourceImage?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
             */
            sourceImageEncryptionKey?: pulumi.Input<inputs.compute.beta.CustomerEncryptionKey>;
            /**
             * The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD.
             *
             * To create a disk with a snapshot that you created, specify the snapshot name in the following format:
             * global/snapshots/my-backup
             *
             *
             * If the source snapshot is deleted later, this field will not be set.
             */
            sourceSnapshot?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source snapshot.
             */
            sourceSnapshotEncryptionKey?: pulumi.Input<inputs.compute.beta.CustomerEncryptionKey>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.
         *
         * If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.
         *
         * Example Policy with multiple AuditConfigs:
         *
         * { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] }
         *
         * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.compute.beta.AuditLogConfig>[]>;
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example:
         *
         * { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] }
         *
         * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of [Binding.members][].
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            ignoreChildExemptions?: pulumi.Input<boolean>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authorization-related information used by Cloud Audit Logging.
         */
        interface AuthorizationLoggingOptions {
            /**
             * The type of the permission that was checked.
             */
            permissionType?: pulumi.Input<string>;
        }
        interface AutoscalerStatusDetails {
            /**
             * The status message.
             */
            message?: pulumi.Input<string>;
            /**
             * The type of error, warning, or notice returned. Current set of possible values:
             * - ALL_INSTANCES_UNHEALTHY (WARNING): All instances in the instance group are unhealthy (not in RUNNING state).
             * - BACKEND_SERVICE_DOES_NOT_EXIST (ERROR): There is no backend service attached to the instance group.
             * - CAPPED_AT_MAX_NUM_REPLICAS (WARNING): Autoscaler recommends a size greater than maxNumReplicas.
             * - CUSTOM_METRIC_DATA_POINTS_TOO_SPARSE (WARNING): The custom metric samples are not exported often enough to be a credible base for autoscaling.
             * - CUSTOM_METRIC_INVALID (ERROR): The custom metric that was specified does not exist or does not have the necessary labels.
             * - MIN_EQUALS_MAX (WARNING): The minNumReplicas is equal to maxNumReplicas. This means the autoscaler cannot add or remove instances from the instance group.
             * - MISSING_CUSTOM_METRIC_DATA_POINTS (WARNING): The autoscaler did not receive any data from the custom metric configured for autoscaling.
             * - MISSING_LOAD_BALANCING_DATA_POINTS (WARNING): The autoscaler is configured to scale based on a load balancing signal but the instance group has not received any requests from the load balancer.
             * - MODE_OFF (WARNING): Autoscaling is turned off. The number of instances in the group won't change automatically. The autoscaling configuration is preserved.
             * - MODE_ONLY_UP (WARNING): Autoscaling is in the "Autoscale only out" mode. The autoscaler can add instances but not remove any.
             * - MORE_THAN_ONE_BACKEND_SERVICE (ERROR): The instance group cannot be autoscaled because it has more than one backend service attached to it.
             * - NOT_ENOUGH_QUOTA_AVAILABLE (ERROR): There is insufficient quota for the necessary resources, such as CPU or number of instances.
             * - REGION_RESOURCE_STOCKOUT (ERROR): Shown only for regional autoscalers: there is a resource stockout in the chosen region.
             * - SCALING_TARGET_DOES_NOT_EXIST (ERROR): The target to be scaled does not exist.
             * - UNSUPPORTED_MAX_RATE_LOAD_BALANCING_CONFIGURATION (ERROR): Autoscaling does not work with an HTTP/S load balancer that has been configured for maxRate.
             * - ZONE_RESOURCE_STOCKOUT (ERROR): For zonal autoscalers: there is a resource stockout in the chosen zone. For regional autoscalers: in at least one of the zones you're using there is a resource stockout.  New values might be added in the future. Some of the values might not be available in all API versions.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Cloud Autoscaler policy.
         */
        interface AutoscalingPolicy {
            /**
             * The number of seconds that the autoscaler waits before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. The default time autoscaler waits is 60 seconds.
             *
             * Virtual machine initialization times might vary because of numerous factors. We recommend that you test how long an instance may take to initialize. To do this, create an instance and time the startup process.
             */
            coolDownPeriodSec?: pulumi.Input<number>;
            /**
             * Defines the CPU utilization policy that allows the autoscaler to scale based on the average CPU utilization of a managed instance group.
             */
            cpuUtilization?: pulumi.Input<inputs.compute.beta.AutoscalingPolicyCpuUtilization>;
            /**
             * Configuration parameters of autoscaling based on a custom metric.
             */
            customMetricUtilizations?: pulumi.Input<pulumi.Input<inputs.compute.beta.AutoscalingPolicyCustomMetricUtilization>[]>;
            /**
             * Configuration parameters of autoscaling based on load balancer.
             */
            loadBalancingUtilization?: pulumi.Input<inputs.compute.beta.AutoscalingPolicyLoadBalancingUtilization>;
            /**
             * The maximum number of instances that the autoscaler can scale out to. This is required when creating or updating an autoscaler. The maximum number of replicas must not be lower than minimal number of replicas.
             */
            maxNumReplicas?: pulumi.Input<number>;
            /**
             * The minimum number of replicas that the autoscaler can scale in to. This cannot be less than 0. If not provided, autoscaler chooses a default value depending on maximum number of instances allowed.
             */
            minNumReplicas?: pulumi.Input<number>;
            /**
             * Defines operating mode for this policy.
             */
            mode?: pulumi.Input<string>;
            scaleDownControl?: pulumi.Input<inputs.compute.beta.AutoscalingPolicyScaleDownControl>;
            scaleInControl?: pulumi.Input<inputs.compute.beta.AutoscalingPolicyScaleInControl>;
            /**
             * Scaling schedules defined for an autoscaler. Multiple schedules can be set on an autoscaler, and they can overlap. During overlapping periods the greatest min_required_replicas of all scaling schedules is applied. Up to 128 scaling schedules are allowed.
             */
            scalingSchedules?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * CPU utilization policy.
         */
        interface AutoscalingPolicyCpuUtilization {
            /**
             * Indicates whether predictive autoscaling based on CPU metric is enabled. Valid values are:
             *
             * * NONE (default). No predictive method is used. The autoscaler scales the group to meet current demand based on real-time metrics. * OPTIMIZE_AVAILABILITY. Predictive autoscaling improves availability by monitoring daily and weekly load patterns and scaling out ahead of anticipated demand.
             */
            predictiveMethod?: pulumi.Input<string>;
            /**
             * The target CPU utilization that the autoscaler maintains. Must be a float value in the range (0, 1]. If not specified, the default is 0.6.
             *
             * If the CPU level is below the target utilization, the autoscaler scales in the number of instances until it reaches the minimum number of instances you specified or until the average CPU of your instances reaches the target utilization.
             *
             * If the average CPU is above the target utilization, the autoscaler scales out until it reaches the maximum number of instances you specified or until the average utilization reaches the target utilization.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Custom utilization metric policy.
         */
        interface AutoscalingPolicyCustomMetricUtilization {
            /**
             * A filter string, compatible with a Stackdriver Monitoring filter string for TimeSeries.list API call. This filter is used to select a specific TimeSeries for the purpose of autoscaling and to determine whether the metric is exporting per-instance or per-group data.
             *
             * For the filter to be valid for autoscaling purposes, the following rules apply:
             * - You can only use the AND operator for joining selectors.
             * - You can only use direct equality comparison operator (=) without any functions for each selector.
             * - You can specify the metric in both the filter string and in the metric field. However, if specified in both places, the metric must be identical.
             * - The monitored resource type determines what kind of values are expected for the metric. If it is a gce_instance, the autoscaler expects the metric to include a separate TimeSeries for each instance in a group. In such a case, you cannot filter on resource labels.
             * If the resource type is any other value, the autoscaler expects this metric to contain values that apply to the entire autoscaled instance group and resource label filtering can be performed to point autoscaler at the correct TimeSeries to scale upon. This is called a per-group metric for the purpose of autoscaling.
             *
             * If not specified, the type defaults to gce_instance.
             *
             * Try to provide a filter that is selective enough to pick just one TimeSeries for the autoscaled group or for each of the instances (if you are using gce_instance resource type). If multiple TimeSeries are returned upon the query execution, the autoscaler will sum their respective values to obtain its scaling value.
             */
            filter?: pulumi.Input<string>;
            /**
             * The identifier (type) of the Stackdriver Monitoring metric. The metric cannot have negative values.
             *
             * The metric must have a value type of INT64 or DOUBLE.
             */
            metric?: pulumi.Input<string>;
            /**
             * If scaling is based on a per-group metric value that represents the total amount of work to be done or resource usage, set this value to an amount assigned for a single instance of the scaled group. Autoscaler keeps the number of instances proportional to the value of this metric. The metric itself does not change value due to group resizing.
             *
             * A good metric to use with the target is for example pubsub.googleapis.com/subscription/num_undelivered_messages or a custom metric exporting the total number of requests coming to your instances.
             *
             * A bad example would be a metric exporting an average or median latency, since this value can't include a chunk assignable to a single instance, it could be better used with utilization_target instead.
             */
            singleInstanceAssignment?: pulumi.Input<number>;
            /**
             * The target value of the metric that autoscaler maintains. This must be a positive value. A utilization metric scales number of virtual machines handling requests to increase or decrease proportionally to the metric.
             *
             * For example, a good metric to use as a utilization_target is https://www.googleapis.com/compute/v1/instance/network/received_bytes_count. The autoscaler works to keep this value constant for each of the instances.
             */
            utilizationTarget?: pulumi.Input<number>;
            /**
             * Defines how target utilization value is expressed for a Stackdriver Monitoring metric. Either GAUGE, DELTA_PER_SECOND, or DELTA_PER_MINUTE.
             */
            utilizationTargetType?: pulumi.Input<string>;
        }
        /**
         * Configuration parameters of autoscaling based on load balancing.
         */
        interface AutoscalingPolicyLoadBalancingUtilization {
            /**
             * Fraction of backend capacity utilization (set in HTTP(S) load balancing configuration) that the autoscaler maintains. Must be a positive float value. If not defined, the default is 0.8.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Configuration that allows for slower scale in so that even if Autoscaler recommends an abrupt scale in of a MIG, it will be throttled as specified by the parameters below.
         */
        interface AutoscalingPolicyScaleDownControl {
            /**
             * Maximum allowed number (or %) of VMs that can be deducted from the peak recommendation during the window autoscaler looks at when computing recommendations. Possibly all these VMs can be deleted at once so user service needs to be prepared to lose that many VMs in one step.
             */
            maxScaledDownReplicas?: pulumi.Input<inputs.compute.beta.FixedOrPercent>;
            /**
             * How far back autoscaling looks when computing recommendations to include directives regarding slower scale in, as described above.
             */
            timeWindowSec?: pulumi.Input<number>;
        }
        /**
         * Configuration that allows for slower scale in so that even if Autoscaler recommends an abrupt scale in of a MIG, it will be throttled as specified by the parameters below.
         */
        interface AutoscalingPolicyScaleInControl {
            /**
             * Maximum allowed number (or %) of VMs that can be deducted from the peak recommendation during the window autoscaler looks at when computing recommendations. Possibly all these VMs can be deleted at once so user service needs to be prepared to lose that many VMs in one step.
             */
            maxScaledInReplicas?: pulumi.Input<inputs.compute.beta.FixedOrPercent>;
            /**
             * How far back autoscaling looks when computing recommendations to include directives regarding slower scale in, as described above.
             */
            timeWindowSec?: pulumi.Input<number>;
        }
        /**
         * Message containing information of one individual backend.
         */
        interface Backend {
            /**
             * Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see  Connection balancing mode.
             */
            balancingMode?: pulumi.Input<string>;
            /**
             * A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
             *
             * Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            capacityScaler?: pulumi.Input<number>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
             */
            failover?: pulumi.Input<boolean>;
            /**
             * The fully-qualified URL of an instance group or network endpoint group (NEG) resource. The type of backend that a backend service supports depends on the backend service's loadBalancingScheme.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL (except Network Load Balancing),  INTERNAL_SELF_MANAGED, or INTERNAL_MANAGED , the backend can be either an instance group or a NEG. The backends on the backend service must be either all instance groups or all NEGs. You cannot mix instance group and NEG backends on the same backend service.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL for Network Load Balancing or INTERNAL for Internal TCP/UDP Load Balancing, the backend must be an instance group. NEGs are not supported.
             *
             * For regional services, the backend must be in the same region as the backend service.
             *
             * You must use the fully-qualified URL (starting with https://www.googleapis.com/) to specify the instance group or NEG. Partial URLs are not supported.
             */
            group?: pulumi.Input<string>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerInstance?: pulumi.Input<number>;
            /**
             * Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRate?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerInstance?: pulumi.Input<number>;
            maxUtilization?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend bucket.
         */
        interface BackendBucketCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.beta.BackendBucketCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.beta.BackendBucketCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendBucketCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendBucketCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend service.
         */
        interface BackendServiceCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.beta.BackendServiceCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * The CacheKeyPolicy for this CdnPolicy.
             */
            cacheKeyPolicy?: pulumi.Input<inputs.compute.beta.CacheKeyPolicy>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.beta.BackendServiceCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendServiceCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendServiceCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Connection Tracking configuration for this BackendService.
         */
        interface BackendServiceConnectionTrackingPolicy {
            /**
             * Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL.
             *
             * If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP.
             *
             * If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy).
             *
             * If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
             */
            connectionPersistenceOnUnhealthyBackends?: pulumi.Input<string>;
            /**
             * Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds).
             *
             * For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours.
             *
             * For NLB the minimum(default) is 60 seconds and the maximum is 16 hours.
             *
             * This field will be supported only if the Connection Tracking key is less than 5-tuple.
             */
            idleTimeoutSec?: pulumi.Input<number>;
            /**
             * Specifies the key used for connection tracking. There are two options:
             *
             * PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol.
             *
             * PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
             */
            trackingMode?: pulumi.Input<string>;
        }
        /**
         * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. On failover or failback, this field indicates whether connection draining will be honored. GCP has a fixed connection draining timeout of 10 minutes. A setting of true terminates existing TCP connections to the active pool during failover and failback, immediately draining traffic. A setting of false allows existing TCP connections to persist, even on VMs no longer in the active pool, for up to the duration of the connection draining timeout (10 minutes).
         */
        interface BackendServiceFailoverPolicy {
            /**
             * This can be set to true only if the protocol is TCP.
             *
             * The default is false.
             */
            disableConnectionDrainOnFailover?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing, If set to true, connections to the load balancer are dropped when all primary and all backup backend VMs are unhealthy.If set to false, connections are distributed among all primary VMs when all primary and all backup backend VMs are unhealthy. The default is false.
             */
            dropTrafficIfUnhealthy?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. The value of the field must be in the range [0, 1]. If the value is 0, the load balancer performs a failover when the number of healthy primary VMs equals zero. For all other values, the load balancer performs a failover when the total number of healthy primary VMs is less than this ratio.
             */
            failoverRatio?: pulumi.Input<number>;
        }
        /**
         * Identity-Aware Proxy
         */
        interface BackendServiceIAP {
            /**
             * Whether the serving infrastructure will authenticate and authorize all incoming requests. If true, the oauth2ClientId and oauth2ClientSecret fields must be non-empty.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * OAuth2 client ID to use for the authentication flow.
             */
            oauth2ClientId?: pulumi.Input<string>;
            /**
             * OAuth2 client secret to use for the authentication flow. For security reasons, this value cannot be retrieved via the API. Instead, the SHA-256 hash of the value is returned in the oauth2ClientSecretSha256 field.
             */
            oauth2ClientSecret?: pulumi.Input<string>;
            /**
             * [Output Only] SHA256 hash value for the field oauth2_client_secret above.
             */
            oauth2ClientSecretSha256?: pulumi.Input<string>;
        }
        /**
         * The available logging options for the load balancer traffic served by this backend service.
         */
        interface BackendServiceLogConfig {
            /**
             * This field denotes whether to enable logging for the load balancer traffic served by this backend service.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified if logging is enabled for this backend service. The value of the field must be in [0, 1]. This configures the sampling rate of requests to the load balancer where 1.0 means all logged requests are reported and 0.0 means no logged requests are reported. The default value is 1.0.
             */
            sampleRate?: pulumi.Input<number>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            bindingId?: pulumi.Input<string>;
            /**
             * The condition that is associated with this binding.
             *
             * If the condition evaluates to `true`, then this binding applies to the current request.
             *
             * If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.
             *
             * To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.compute.beta.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
             *
             * * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
             *
             * * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
             *
             * * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` .
             *
             *
             *
             * * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
             *
             * * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
             *
             * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding.
             *
             * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding.
             *
             * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
             *
             *
             *
             * * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Message containing what to include in the cache key for a request for Cloud CDN.
         */
        interface CacheKeyPolicy {
            /**
             * If true, requests to different hosts will be cached separately.
             */
            includeHost?: pulumi.Input<boolean>;
            /**
             * If true, http and https requests will be cached separately.
             */
            includeProtocol?: pulumi.Input<boolean>;
            /**
             * If true, include query string parameters in the cache key according to query_string_whitelist and query_string_blacklist. If neither is set, the entire query string will be included. If false, the query string will be excluded from the cache key entirely.
             */
            includeQueryString?: pulumi.Input<boolean>;
            /**
             * Names of query string parameters to exclude in cache keys. All other parameters will be included. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringBlacklist?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Names of query string parameters to include in cache keys. All other parameters will be excluded. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringWhitelist?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings controlling the volume of connections to a backend service.
         */
        interface CircuitBreakers {
            /**
             * The timeout for new network connections to hosts.
             */
            connectTimeout?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * The maximum number of connections to the backend service. If not specified, there is no limit.
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * The maximum number of pending requests allowed to the backend service. If not specified, there is no limit.
             */
            maxPendingRequests?: pulumi.Input<number>;
            /**
             * The maximum number of parallel requests that allowed to the backend service. If not specified, there is no limit.
             */
            maxRequests?: pulumi.Input<number>;
            /**
             * Maximum requests for a single connection to the backend service. This parameter is respected by both the HTTP/1.1 and HTTP/2 implementations. If not specified, there is no limit. Setting this parameter to 1 will effectively disable keep alive.
             */
            maxRequestsPerConnection?: pulumi.Input<number>;
            /**
             * The maximum number of parallel retries allowed to the backend cluster. If not specified, the default is 1.
             */
            maxRetries?: pulumi.Input<number>;
        }
        /**
         * A condition to be met.
         */
        interface Condition {
            /**
             * Trusted attributes supplied by the IAM system.
             */
            iam?: pulumi.Input<string>;
            /**
             * An operator to apply the subject with.
             */
            op?: pulumi.Input<string>;
            /**
             * Trusted attributes discharged by the service.
             */
            svc?: pulumi.Input<string>;
            /**
             * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
             */
            sys?: pulumi.Input<string>;
            /**
             * The objects of the condition.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A set of Confidential Instance options.
         */
        interface ConfidentialInstanceConfig {
            /**
             * Defines whether the instance should have confidential compute enabled.
             */
            enableConfidentialCompute?: pulumi.Input<boolean>;
        }
        /**
         * Message containing connection draining configuration.
         */
        interface ConnectionDraining {
            /**
             * Configures a duration timeout for existing requests on a removed backend instance. For supported load balancers and protocols, as described in Enabling connection draining.
             */
            drainingTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * This message defines settings for a consistent hash style load balancer.
         */
        interface ConsistentHashLoadBalancerSettings {
            /**
             * Hash is based on HTTP Cookie. This field describes a HTTP cookie that will be used as the hash key for the consistent hash load balancer. If the cookie is not present, it will be generated. This field is applicable if the sessionAffinity is set to HTTP_COOKIE.
             */
            httpCookie?: pulumi.Input<inputs.compute.beta.ConsistentHashLoadBalancerSettingsHttpCookie>;
            /**
             * The hash based on the value of the specified header field. This field is applicable if the sessionAffinity is set to HEADER_FIELD.
             */
            httpHeaderName?: pulumi.Input<string>;
            /**
             * The minimum number of virtual nodes to use for the hash ring. Defaults to 1024. Larger ring sizes result in more granular load distributions. If the number of hosts in the load balancing pool is larger than the ring size, each host will be assigned a single virtual node.
             */
            minimumRingSize?: pulumi.Input<string>;
        }
        /**
         * The information about the HTTP Cookie on which the hash function is based for load balancing policies that use a consistent hash.
         */
        interface ConsistentHashLoadBalancerSettingsHttpCookie {
            /**
             * Name of the cookie.
             */
            name?: pulumi.Input<string>;
            /**
             * Path to set for the cookie.
             */
            path?: pulumi.Input<string>;
            /**
             * Lifetime of the cookie.
             */
            ttl?: pulumi.Input<inputs.compute.beta.Duration>;
        }
        /**
         * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
         */
        interface CorsPolicy {
            /**
             * In response to a preflight request, setting this to true indicates that the actual request can include user credentials. This translates to the Access-Control-Allow-Credentials header.
             * Default is false.
             */
            allowCredentials?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Allow-Headers header.
             */
            allowHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the content for the Access-Control-Allow-Methods header.
             */
            allowMethods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the regualar expression patterns that match allowed origins. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOriginRegexes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the list of origins that will be allowed to do CORS requests.
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOrigins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If true, specifies the CORS policy is disabled. The default value of false, which indicates that the CORS policy is in effect.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Expose-Headers header.
             */
            exposeHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies how long results of a preflight request can be cached in seconds. This translates to the Access-Control-Max-Age header.
             */
            maxAge?: pulumi.Input<number>;
        }
        interface CustomerEncryptionKey {
            /**
             * The name of the encryption key that is stored in Google Cloud KMS.
             */
            kmsKeyName?: pulumi.Input<string>;
            /**
             * The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             */
            kmsKeyServiceAccount?: pulumi.Input<string>;
            /**
             * Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
             */
            rawKey?: pulumi.Input<string>;
            /**
             * Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource.
             *
             * The key must meet the following requirements before you can provide it to Compute Engine:
             * - The key is wrapped using a RSA public key certificate provided by Google.
             * - After being wrapped, the key must be encoded in RFC 4648 base64 encoding.  Gets the RSA public key certificate provided by Google at:
             * https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             */
            rsaEncryptedKey?: pulumi.Input<string>;
            /**
             * [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             */
            sha256?: pulumi.Input<string>;
        }
        /**
         * Deprecation status for a public resource.
         */
        interface DeprecationStatus {
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DELETED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deleted?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DEPRECATED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deprecated?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to OBSOLETE. This is only informational and the status will not change unless the client explicitly changes it.
             */
            obsolete?: pulumi.Input<string>;
            /**
             * The URL of the suggested replacement for a deprecated resource. The suggested replacement resource must be the same kind of resource as the deprecated resource.
             */
            replacement?: pulumi.Input<string>;
            /**
             * The deprecation state of this resource. This can be ACTIVE, DEPRECATED, OBSOLETE, or DELETED. Operations which communicate the end of life date for an image, can use ACTIVE. Operations which create a new resource using a DEPRECATED resource will return successfully, but with a warning indicating the deprecated resource and recommending its replacement. Operations which use OBSOLETE or DELETED resources will be rejected and result in an error.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * A specification of the desired way to instantiate a disk in the instance template when its created from a source instance.
         */
        interface DiskInstantiationConfig {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * The custom source image to be used to restore this disk when instantiating this instance template.
             */
            customImage?: pulumi.Input<string>;
            /**
             * Specifies the device name of the disk to which the configurations apply to.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Specifies whether to include the disk and what image to use. Possible values are:
             * - source-image: to use the same image that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - source-image-family: to use the same image family that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - custom-image: to use a user-provided image url for disk creation. Applicable to the boot disk and additional read-write disks.
             * - attach-read-only: to attach a read-only disk. Applicable to read-only disks.
             * - do-not-include: to exclude a disk from the template. Applicable to additional read-write disks, local SSDs, and read-only disks.
             */
            instantiateFrom?: pulumi.Input<string>;
        }
        /**
         * A set of Display Device options
         */
        interface DisplayDevice {
            /**
             * Defines whether the instance has Display enabled.
             */
            enableDisplay?: pulumi.Input<boolean>;
        }
        interface DistributionPolicy {
            /**
             * The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             */
            targetShape?: pulumi.Input<string>;
            /**
             * Zones where the regional managed instance group will create and manage its instances.
             */
            zones?: pulumi.Input<pulumi.Input<inputs.compute.beta.DistributionPolicyZoneConfiguration>[]>;
        }
        interface DistributionPolicyZoneConfiguration {
            /**
             * The URL of the zone. The zone must exist in the region where the managed instance group is located.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A Duration represents a fixed-length span of time represented as a count of seconds and fractions of seconds at nanosecond resolution. It is independent of any calendar and concepts like "day" or "month". Range is approximately 10,000 years.
         */
        interface Duration {
            /**
             * Span of time that's a fraction of a second at nanosecond resolution. Durations less than one second are represented with a 0 `seconds` field and a positive `nanos` field. Must be from 0 to 999,999,999 inclusive.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Span of time at a resolution of a second. Must be from 0 to 315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
             */
            seconds?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.
         *
         * Example (Comparison):
         *
         * title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100"
         *
         * Example (Equality):
         *
         * title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email"
         *
         * Example (Logic):
         *
         * title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'"
         *
         * Example (Data Manipulation):
         *
         * title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)"
         *
         * The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The interface for the external VPN gateway.
         */
        interface ExternalVpnGatewayInterface {
            /**
             * The numeric ID of this interface. The allowed input values for this id for different redundancy types of external VPN gateway: SINGLE_IP_INTERNALLY_REDUNDANT - 0 TWO_IPS_REDUNDANCY - 0, 1 FOUR_IPS_REDUNDANCY - 0, 1, 2, 3
             */
            id?: pulumi.Input<number>;
            /**
             * IP address of the interface in the external VPN gateway. Only IPv4 is supported. This IP address can be either from your on-premise gateway or another Cloud provider's VPN gateway, it cannot be an IP address from Google Compute Engine.
             */
            ipAddress?: pulumi.Input<string>;
        }
        interface FileContentBuffer {
            /**
             * The raw content in the secure keys file.
             */
            content?: pulumi.Input<string>;
            /**
             * The file type of source file.
             */
            fileType?: pulumi.Input<string>;
        }
        /**
         * The available logging options for a firewall rule.
         */
        interface FirewallLogConfig {
            /**
             * This field denotes whether to enable logging for a particular firewall rule.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
             */
            metadata?: pulumi.Input<string>;
        }
        interface FirewallPolicyAssociation {
            /**
             * The target that the firewall policy is attached to.
             */
            attachmentTarget?: pulumi.Input<string>;
            /**
             * [Output Only] Deprecated, please use short name instead. The display name of the firewall policy of the association.
             */
            displayName?: pulumi.Input<string>;
            /**
             * [Output Only] The firewall policy ID of the association.
             */
            firewallPolicyId?: pulumi.Input<string>;
            /**
             * The name for an association.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The short name of the firewall policy of the association.
             */
            shortName?: pulumi.Input<string>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface FirewallPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description for this resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The direction in which this rule applies.
             */
            direction?: pulumi.Input<string>;
            /**
             * Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
             */
            enableLogging?: pulumi.Input<boolean>;
            /**
             * [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.beta.FirewallPolicyRuleMatcher>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.
             */
            priority?: pulumi.Input<number>;
            /**
             * [Output Only] Calculation of the complexity of a single firewall policy rule.
             */
            ruleTupleCount?: pulumi.Input<number>;
            /**
             * A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
             */
            targetResources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of secure labels that controls which instances the firewall rule applies to. If targetSecureLabel are specified, then the firewall rule applies only to instances in the VPC network that have one of those secure labels. targetSecureLabel may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureLabel are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label values allowed is 256.
             */
            targetSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of service accounts indicating the sets of instances that are applied with this rule.
             */
            targetServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface FirewallPolicyRuleMatcher {
            /**
             * CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
             */
            destIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             */
            layer4Configs?: pulumi.Input<pulumi.Input<inputs.compute.beta.FirewallPolicyRuleMatcherLayer4Config>[]>;
            /**
             * CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of firewall label values, which should be matched at the source of the traffic. Maximum number of source label values allowed is 256.
             */
            srcSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface FirewallPolicyRuleMatcherLayer4Config {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Encapsulates numeric value that can be either absolute or relative.
         */
        interface FixedOrPercent {
            /**
             * [Output Only] Absolute value of VM instances calculated based on the specific mode.
             *
             *
             * - If the value is fixed, then the calculated value is equal to the fixed value.
             * - If the value is a percent, then the calculated value is percent/100 * targetSize. For example, the calculated value of a 80% of a managed instance group with 150 instances would be (80/100 * 150) = 120 VM instances. If there is a remainder, the number is rounded up.
             */
            calculated?: pulumi.Input<number>;
            /**
             * Specifies a fixed number of VM instances. This must be a positive integer.
             */
            fixed?: pulumi.Input<number>;
            /**
             * Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * Describes the auto-registration of the Forwarding Rule to Service Directory. The region and project of the Service Directory resource generated from this registration will be the same as this Forwarding Rule.
         */
        interface ForwardingRuleServiceDirectoryRegistration {
            /**
             * Service Directory namespace to register the forwarding rule under.
             */
            namespace?: pulumi.Input<string>;
            /**
             * Service Directory service to register the forwarding rule under.
             */
            service?: pulumi.Input<string>;
            /**
             * [Optional] Service Directory region to register this global forwarding rule under. Default to "us-central1". Only used for PSC for Google APIs. All PSC for Google APIs Forwarding Rules on the same network should use the same Service Directory region.
             */
            serviceDirectoryRegion?: pulumi.Input<string>;
        }
        interface GRPCHealthCheck {
            /**
             * The gRPC service name for the health check. This field is optional. The value of grpc_service_name has the following meanings by convention:
             * - Empty service_name means the overall status of all services at the backend.
             * - Non-empty service_name means the health of that gRPC service, as defined by the owner of the service.
             * The grpc_service_name can only be ASCII.
             */
            grpcServiceName?: pulumi.Input<string>;
            /**
             * The port number for the health check request. Must be specified if port_name and port_specification are not set or if port_specification is USE_FIXED_PORT. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence. The port_name should conform to RFC1035.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, gRPC health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
        }
        /**
         * Guest OS features.
         */
        interface GuestOsFeature {
            /**
             * The ID of a supported feature. Read  Enabling guest operating system features to see a list of available options.
             */
            type?: pulumi.Input<string>;
        }
        interface HTTP2HealthCheck {
            /**
             * The value of the host header in the HTTP/2 health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP2 health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP/2 health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        interface HTTPHealthCheck {
            /**
             * The value of the host header in the HTTP health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        interface HTTPSHealthCheck {
            /**
             * The value of the host header in the HTTPS health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTPS health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTPS health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * Configuration of logging on a health check. If logging is enabled, logs will be exported to Stackdriver.
         */
        interface HealthCheckLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default, which means no health check logging will be done.
             */
            enable?: pulumi.Input<boolean>;
        }
        /**
         * UrlMaps A host-matching rule for a URL. If matched, will use the named PathMatcher to select the BackendService.
         */
        interface HostRule {
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The list of host patterns to match. They must be valid hostnames with optional port numbers in the format host:port. * matches any string of ([a-z0-9-.]*). In that case, * must be the first character and must be followed in the pattern by either - or ..
             * * based matching is not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            hosts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the PathMatcher to use to match the path portion of the URL if the hostRule matches the URL's host portion.
             */
            pathMatcher?: pulumi.Input<string>;
        }
        /**
         * Specification for how requests are aborted as part of fault injection.
         */
        interface HttpFaultAbort {
            /**
             * The HTTP status code used to abort the request.
             * The value must be between 200 and 599 inclusive.
             */
            httpStatus?: pulumi.Input<number>;
            /**
             * The percentage of traffic (connections/operations/requests) which will be aborted as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * Specifies the delay introduced by Loadbalancer before forwarding the request to the backend service as part of fault injection.
         */
        interface HttpFaultDelay {
            /**
             * Specifies the value of the fixed delay interval.
             */
            fixedDelay?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * The percentage of traffic (connections/operations/requests) on which delay will be introduced as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
         */
        interface HttpFaultInjection {
            /**
             * The specification for how client requests are aborted as part of fault injection.
             */
            abort?: pulumi.Input<inputs.compute.beta.HttpFaultAbort>;
            /**
             * The specification for how client requests are delayed as part of fault injection, before being sent to a backend service.
             */
            delay?: pulumi.Input<inputs.compute.beta.HttpFaultDelay>;
        }
        /**
         * HttpFilterConfiguration supplies additional contextual settings for networkservices.HttpFilter resources enabled by Traffic Director.
         */
        interface HttpFilterConfig {
            /**
             * The configuration needed to enable the networkservices.HttpFilter resource. The configuration must be YAML formatted and only contain fields defined in the protobuf identified in configTypeUrl
             */
            config?: pulumi.Input<string>;
            /**
             * The fully qualified versioned proto3 type url of the protobuf that the filter expects for its contextual settings, for example: type.googleapis.com/google.protobuf.Struct
             */
            configTypeUrl?: pulumi.Input<string>;
            /**
             * Name of the networkservices.HttpFilter resource this configuration belongs to. This name must be known to the xDS client. Example: envoy.wasm
             */
            filterName?: pulumi.Input<string>;
        }
        /**
         * The request and response header transformations that take effect before the request is passed along to the selected backendService.
         */
        interface HttpHeaderAction {
            /**
             * Headers to add to a matching request prior to forwarding the request to the backendService.
             */
            requestHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the request prior to forwarding the request to the backendService.
             */
            requestHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Headers to add the response prior to sending the response back to the client.
             */
            responseHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the response prior to sending the response back to the client.
             */
            responseHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * matchRule criteria for request header matches.
         */
        interface HttpHeaderMatch {
            /**
             * The value should exactly match contents of exactMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the HTTP header to match.
             * For matching against the HTTP request's authority, use a headerMatch with the header name ":authority".
             * For matching a request's method, use the headerName ":method".
             * When the URL map is bound to target gRPC proxy that has validateForProxyless field set to true, only non-binary user-specified custom metadata and the `content-type` header are supported. The following transport-level headers cannot be used in header matching rules: `:authority`, `:method`, `:path`, `:scheme`, `user-agent`, `accept-encoding`, `content-encoding`, `grpc-accept-encoding`, `grpc-encoding`, `grpc-previous-rpc-attempts`, `grpc-tags-bin`, `grpc-timeout` and `grpc-trace-bin.
             */
            headerName?: pulumi.Input<string>;
            /**
             * If set to false, the headerMatch is considered a match if the match criteria above are met. If set to true, the headerMatch is considered a match if the match criteria above are NOT met.
             * The default setting is false.
             */
            invertMatch?: pulumi.Input<boolean>;
            /**
             * The value of the header must start with the contents of prefixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * A header with the contents of headerName must exist. The match takes place whether or not the request's header has a value.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The header value must be an integer and its value must be in the range specified in rangeMatch. If the header does not contain an integer, number or is empty, the match fails.
             * For example for a range [-5, 0]
             * - -3 will match.
             * - 0 will not match.
             * - 0.25 will not match.
             * - -3someString will not match.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that rangeMatch is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             */
            rangeMatch?: pulumi.Input<inputs.compute.beta.Int64RangeMatch>;
            /**
             * The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see:  github.com/google/re2/wiki/Syntax
             * For matching against a port specified in the HTTP request, use a headerMatch with headerName set to PORT and a regular expression that satisfies the RFC2616 Host header's port specifier.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
            /**
             * The value of the header must end with the contents of suffixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            suffixMatch?: pulumi.Input<string>;
        }
        /**
         * Specification determining how headers are added to requests or responses.
         */
        interface HttpHeaderOption {
            /**
             * The name of the header.
             */
            headerName?: pulumi.Input<string>;
            /**
             * The value of the header to add.
             */
            headerValue?: pulumi.Input<string>;
            /**
             * If false, headerValue is appended to any values that already exist for the header. If true, headerValue is set for the header, discarding any values that were set for that header.
             * The default value is false.
             */
            replace?: pulumi.Input<boolean>;
        }
        /**
         * HttpRouteRuleMatch criteria for a request's query parameter.
         */
        interface HttpQueryParameterMatch {
            /**
             * The queryParameterMatch matches if the value of the parameter exactly matches the contents of exactMatch.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the query parameter to match. The query parameter must exist in the request, in the absence of which the request match fails.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies that the queryParameterMatch matches if the request contains the query parameter, irrespective of whether the parameter has a value or not.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The queryParameterMatch matches if the value of the parameter matches the regular expression specified by regexMatch. For the regular expression grammar, please see github.com/google/re2/wiki/Syntax
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             * Note that regexMatch only applies when the loadBalancingScheme is set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Specifies settings for an HTTP redirect.
         */
        interface HttpRedirectAction {
            /**
             * The host that will be used in the redirect response instead of the one that was supplied in the request.
             * The value must be between 1 and 255 characters.
             */
            hostRedirect?: pulumi.Input<string>;
            /**
             * If set to true, the URL scheme in the redirected request is set to https. If set to false, the URL scheme of the redirected request will remain the same as that of the request.
             * This must only be set for UrlMaps used in TargetHttpProxys. Setting this true for TargetHttpsProxy is not permitted.
             * The default is set to false.
             */
            httpsRedirect?: pulumi.Input<boolean>;
            /**
             * The path that will be used in the redirect response instead of the one that was supplied in the request.
             * pathRedirect cannot be supplied together with prefixRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            pathRedirect?: pulumi.Input<string>;
            /**
             * The prefix that replaces the prefixMatch specified in the HttpRouteRuleMatch, retaining the remaining portion of the URL before redirecting the request.
             * prefixRedirect cannot be supplied together with pathRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            prefixRedirect?: pulumi.Input<string>;
            /**
             * The HTTP Status code to use for this RedirectAction.
             * Supported values are:
             * - MOVED_PERMANENTLY_DEFAULT, which is the default value and corresponds to 301.
             * - FOUND, which corresponds to 302.
             * - SEE_OTHER which corresponds to 303.
             * - TEMPORARY_REDIRECT, which corresponds to 307. In this case, the request method will be retained.
             * - PERMANENT_REDIRECT, which corresponds to 308. In this case, the request method will be retained.
             */
            redirectResponseCode?: pulumi.Input<string>;
            /**
             * If set to true, any accompanying query portion of the original URL is removed prior to redirecting the request. If set to false, the query portion of the original URL is retained.
             * The default is set to false.
             */
            stripQuery?: pulumi.Input<boolean>;
        }
        /**
         * The retry policy associates with HttpRouteRule
         */
        interface HttpRetryPolicy {
            /**
             * Specifies the allowed number retries. This number must be > 0. If not specified, defaults to 1.
             */
            numRetries?: pulumi.Input<number>;
            /**
             * Specifies a non-zero timeout per retry attempt.
             * If not specified, will use the timeout set in HttpRouteAction. If timeout in HttpRouteAction is not set, will use the largest timeout among all backend services associated with the route.
             */
            perTryTimeout?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * Specfies one or more conditions when this retry rule applies. Valid values are:
             * - 5xx: Loadbalancer will attempt a retry if the backend service responds with any 5xx response code, or if the backend service does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.
             * - gateway-error: Similar to 5xx, but only applies to response codes 502, 503 or 504.
             * -
             * - connect-failure: Loadbalancer will retry on failures connecting to backend services, for example due to connection timeouts.
             * - retriable-4xx: Loadbalancer will retry for retriable 4xx response codes. Currently the only retriable error supported is 409.
             * - refused-stream:Loadbalancer will retry if the backend service resets the stream with a REFUSED_STREAM error code. This reset type indicates that it is safe to retry.
             * - cancelledLoadbalancer will retry if the gRPC status code in the response header is set to cancelled
             * - deadline-exceeded: Loadbalancer will retry if the gRPC status code in the response header is set to deadline-exceeded
             * - resource-exhausted: Loadbalancer will retry if the gRPC status code in the response header is set to resource-exhausted
             * - unavailable: Loadbalancer will retry if the gRPC status code in the response header is set to unavailable
             */
            retryConditions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface HttpRouteAction {
            /**
             * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            corsPolicy?: pulumi.Input<inputs.compute.beta.CorsPolicy>;
            /**
             * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
             * timeout and retry_policy will be ignored by clients that are configured with a fault_injection_policy.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            faultInjectionPolicy?: pulumi.Input<inputs.compute.beta.HttpFaultInjection>;
            /**
             * Specifies the maximum duration (timeout) for streams on the selected route. Unlike the timeout field where the timeout duration starts from the time the request has been fully processed (i.e. end-of-stream), the duration in this field is computed from the beginning of the stream until the response has been completely processed, including all retries. A stream that does not complete in this duration is closed.
             * If not specified, will use the largest maxStreamDuration among all backend services associated with the route.
             * This field is only allowed if the Url map is used with backend services with loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            maxStreamDuration?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * Specifies the policy on how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            requestMirrorPolicy?: pulumi.Input<inputs.compute.beta.RequestMirrorPolicy>;
            /**
             * Specifies the retry policy associated with this route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            retryPolicy?: pulumi.Input<inputs.compute.beta.HttpRetryPolicy>;
            /**
             * Specifies the timeout for the selected route. Timeout is computed from the time the request has been fully processed (i.e. end-of-stream) up until the response has been completely processed. Timeout includes all retries.
             * If not specified, will use the largest timeout among all backend services associated with the route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            timeout?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * The spec to modify the URL of the request, prior to forwarding the request to the matched service.
             * urlRewrite is the only action supported in UrlMaps for external HTTP(S) load balancers.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            urlRewrite?: pulumi.Input<inputs.compute.beta.UrlRewrite>;
            /**
             * A list of weighted backend services to send traffic to when a route match occurs. The weights determine the fraction of traffic that flows to their corresponding backend service. If all traffic needs to go to a single backend service, there must be one  weightedBackendService with weight set to a non-zero number.
             * Once a backendService is identified and before forwarding the request to the backend service, advanced routing actions such as URL rewrites and header transformations are applied depending on additional settings specified in this HttpRouteAction.
             */
            weightedBackendServices?: pulumi.Input<pulumi.Input<inputs.compute.beta.WeightedBackendService>[]>;
        }
        /**
         * An HttpRouteRule specifies how to match an HTTP request and the corresponding routing action that load balancing proxies will perform.
         */
        interface HttpRouteRule {
            /**
             * The short description conveying the intent of this routeRule.
             * The description can have a maximum length of 1024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * The headerAction specified here are applied before the matching pathMatchers[].headerAction and after pathMatchers[].routeRules[].routeAction.weightedBackendService.backendServiceWeightAction[].headerAction
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.beta.HttpHeaderAction>;
            /**
             * Outbound route specific configuration for networkservices.HttpFilter resources enabled by Traffic Director. httpFilterConfigs only applies for Loadbalancers with loadBalancingScheme set to INTERNAL_SELF_MANAGED. See ForwardingRule for more details.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            httpFilterConfigs?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpFilterConfig>[]>;
            /**
             * Outbound route specific metadata supplied to networkservices.HttpFilter resources enabled by Traffic Director. httpFilterMetadata only applies for Loadbalancers with loadBalancingScheme set to INTERNAL_SELF_MANAGED. See ForwardingRule for more details.
             * The only configTypeUrl supported is type.googleapis.com/google.protobuf.Struct
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            httpFilterMetadata?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpFilterConfig>[]>;
            /**
             * The list of criteria for matching attributes of a request to this routeRule. This list has OR semantics: the request matches this routeRule when any of the matchRules are satisfied. However predicates within a given matchRule have AND semantics. All predicates within a matchRule must match for the request to match the rule.
             */
            matchRules?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpRouteRuleMatch>[]>;
            /**
             * For routeRules within a given pathMatcher, priority determines the order in which load balancer will interpret routeRules. RouteRules are evaluated in order of priority, from the lowest to highest number. The priority of a rule decreases as its number increases (1, 2, 3, N+1). The first rule that matches the request is applied.
             * You cannot configure two or more routeRules with the same priority. Priority for each rule must be set to a number between 0 and 2147483647 inclusive.
             * Priority numbers can have gaps, which enable you to add or remove rules in the future without affecting the rest of the rules. For example, 1, 2, 3, 4, 5, 9, 12, 16 is a valid series of priority numbers to which you could add rules numbered from 6 to 8, 10 to 11, and 13 to 15 in the future without any impact on existing rules.
             */
            priority?: pulumi.Input<number>;
            /**
             * In response to a matching matchRule, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If  routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a routeRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.beta.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When this rule is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.beta.HttpRedirectAction>;
        }
        /**
         * HttpRouteRuleMatch specifies a set of criteria for matching requests to an HttpRouteRule. All specified criteria must be satisfied for a match to occur.
         */
        interface HttpRouteRuleMatch {
            /**
             * For satisfying the matchRule condition, the path of the request must exactly match the value specified in fullPathMatch after removing any query parameters and anchor that may be part of the original URL.
             * fullPathMatch must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            fullPathMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of header match criteria, all of which must match corresponding headers in the request.
             */
            headerMatches?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpHeaderMatch>[]>;
            /**
             * Specifies that prefixMatch and fullPathMatch matches are case sensitive.
             * The default value is false.
             * ignoreCase must not be used with regexMatch.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            ignoreCase?: pulumi.Input<boolean>;
            /**
             * Opaque filter criteria used by Loadbalancer to restrict routing configuration to a limited set of xDS compliant clients. In their xDS requests to Loadbalancer, xDS clients present node metadata. When there is a match, the relevant routing configuration is made available to those proxies.
             * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata. If multiple metadataFilters are specified, all of them need to be satisfied in order to be considered a match.
             * metadataFilters specified here will be applied after those specified in ForwardingRule that refers to the UrlMap this HttpRouteRuleMatch belongs to.
             * metadataFilters only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            metadataFilters?: pulumi.Input<pulumi.Input<inputs.compute.beta.MetadataFilter>[]>;
            /**
             * For satisfying the matchRule condition, the request's path must begin with the specified prefixMatch. prefixMatch must begin with a /.
             * The value must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of query parameter match criteria, all of which must match corresponding query parameters in the request.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            queryParameterMatches?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpQueryParameterMatch>[]>;
            /**
             * For satisfying the matchRule condition, the path of the request must satisfy the regular expression specified in regexMatch after removing any query parameters and anchor supplied with the original URL. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Initial State for shielded instance, these are public keys which are safe to store in public
         */
        interface InitialStateConfig {
            /**
             * The Key Database (db).
             */
            dbs?: pulumi.Input<pulumi.Input<inputs.compute.beta.FileContentBuffer>[]>;
            /**
             * The forbidden key database (dbx).
             */
            dbxs?: pulumi.Input<pulumi.Input<inputs.compute.beta.FileContentBuffer>[]>;
            /**
             * The Key Exchange Key (KEK).
             */
            keks?: pulumi.Input<pulumi.Input<inputs.compute.beta.FileContentBuffer>[]>;
            /**
             * The Platform Key (PK).
             */
            pk?: pulumi.Input<inputs.compute.beta.FileContentBuffer>;
        }
        interface InstanceGroupManagerActionsSummary {
            /**
             * [Output Only] The total number of instances in the managed instance group that are scheduled to be abandoned. Abandoning an instance removes it from the managed instance group without deleting it.
             */
            abandoning?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be created or are currently being created. If the group fails to create any of these instances, it tries again until it creates the instance successfully.
             *
             * If you have disabled creation retries, this field will not be populated; instead, the creatingWithoutRetries field will be populated.
             */
            creating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances that the managed instance group will attempt to create. The group attempts to create each instance only once. If the group fails to create any of these instances, it decreases the group's targetSize value accordingly.
             */
            creatingWithoutRetries?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be deleted or are currently being deleted.
             */
            deleting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are running and have no scheduled actions.
             */
            none?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be recreated or are currently being being recreated. Recreating an instance deletes the existing root persistent disk and creates a new disk from the image that is defined in the instance template.
             */
            recreating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being reconfigured with properties that do not require a restart or a recreate action. For example, setting or removing target pools for the instance.
             */
            refreshing?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
             */
            restarting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
             */
            verifying?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerAutoHealingPolicy {
            /**
             * The URL for the health check that signals autohealing.
             */
            healthCheck?: pulumi.Input<string>;
            /**
             * The number of seconds that the managed instance group waits before it applies autohealing policies to new instances or recently recreated instances. This initial delay allows instances to initialize and run their startup scripts before the instance group determines that they are UNHEALTHY. This prevents the managed instance group from recreating its instances prematurely. This value must be from range [0, 3600].
             */
            initialDelaySec?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerStatus {
            /**
             * [Output Only] The URL of the Autoscaler that targets this instance group manager.
             */
            autoscaler?: pulumi.Input<string>;
            /**
             * [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
             */
            isStable?: pulumi.Input<boolean>;
            /**
             * [Output Only] Stateful status of the given Instance Group Manager.
             */
            stateful?: pulumi.Input<inputs.compute.beta.InstanceGroupManagerStatusStateful>;
            /**
             * [Output Only] A status of consistency of Instances' versions with their target version specified by version field on Instance Group Manager.
             */
            versionTarget?: pulumi.Input<inputs.compute.beta.InstanceGroupManagerStatusVersionTarget>;
        }
        interface InstanceGroupManagerStatusStateful {
            /**
             * [Output Only] A bit indicating whether the managed instance group has stateful configuration, that is, if you have configured any items in a stateful policy or in per-instance configs. The group might report that it has no stateful config even when there is still some preserved state on a managed instance, for example, if you have deleted all PICs but not yet applied those deletions.
             */
            hasStatefulConfig?: pulumi.Input<boolean>;
            /**
             * [Output Only] A bit indicating whether the managed instance group has stateful configuration, that is, if you have configured any items in a stateful policy or in per-instance configs. The group might report that it has no stateful config even when there is still some preserved state on a managed instance, for example, if you have deleted all PICs but not yet applied those deletions. This field is deprecated in favor of has_stateful_config.
             */
            isStateful?: pulumi.Input<boolean>;
            /**
             * [Output Only] Status of per-instance configs on the instance.
             */
            perInstanceConfigs?: pulumi.Input<inputs.compute.beta.InstanceGroupManagerStatusStatefulPerInstanceConfigs>;
        }
        interface InstanceGroupManagerStatusStatefulPerInstanceConfigs {
            /**
             * A bit indicating if all of the group's per-instance configs (listed in the output of a listPerInstanceConfigs API call) have status EFFECTIVE or there are no per-instance-configs.
             */
            allEffective?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerStatusVersionTarget {
            /**
             * [Output Only] A bit indicating whether version target has been reached in this managed instance group, i.e. all instances are in their target version. Instances' target version are specified by version field on Instance Group Manager.
             */
            isReached?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerUpdatePolicy {
            /**
             * The  instance redistribution policy for regional managed instance groups. Valid values are:
             * - PROACTIVE (default): The group attempts to maintain an even distribution of VM instances across zones in the region.
             * - NONE: For non-autoscaled groups, proactive redistribution is disabled.
             */
            instanceRedistributionType?: pulumi.Input<string>;
            /**
             * The maximum number of instances that can be created above the specified targetSize during the update process. This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxSurge is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxSurge.
             */
            maxSurge?: pulumi.Input<inputs.compute.beta.FixedOrPercent>;
            /**
             * The maximum number of instances that can be unavailable during the update process. An instance is considered available if all of the following conditions are satisfied:
             *
             *
             * - The instance's status is RUNNING.
             * - If there is a health check on the instance group, the instance's health check status must be HEALTHY at least once. If there is no health check on the group, then the instance only needs to have a status of RUNNING to be considered available.  This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxUnavailable is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxUnavailable.
             */
            maxUnavailable?: pulumi.Input<inputs.compute.beta.FixedOrPercent>;
            /**
             * Minimum number of seconds to wait for after a newly created instance becomes available. This value must be from range [0, 3600].
             */
            minReadySec?: pulumi.Input<number>;
            /**
             * Minimal action to be taken on an instance. You can specify either RESTART to restart existing instances or REPLACE to delete and create new instances from the target template. If you specify a RESTART, the Updater will attempt to perform that action only. However, if the Updater determines that the minimal action you specify is not enough to perform the update, it might perform a more disruptive action.
             */
            minimalAction?: pulumi.Input<string>;
            /**
             * What action should be used to replace instances. See minimal_action.REPLACE
             */
            replacementMethod?: pulumi.Input<string>;
            /**
             * The type of update process. You can specify either PROACTIVE so that the instance group manager proactively executes actions in order to bring instances to their target versions or OPPORTUNISTIC so that no action is proactively executed but the update will be performed as part of other actions (for example, resizes or recreateInstances calls).
             */
            type?: pulumi.Input<string>;
        }
        interface InstanceGroupManagerVersion {
            /**
             * The URL of the instance template that is specified for this managed instance group. The group uses this template to create new instances in the managed instance group until the `targetSize` for this version is reached. The templates for existing instances in the group do not change unless you run recreateInstances, run applyUpdatesToInstances, or set the group's updatePolicy.type to PROACTIVE; in those cases, existing instances are updated until the `targetSize` for this version is reached.
             */
            instanceTemplate?: pulumi.Input<string>;
            /**
             * Name of the version. Unique among all versions in the scope of this managed instance group.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies the intended number of instances to be created from the instanceTemplate. The final number of instances created from the template will be equal to:
             * - If expressed as a fixed number, the minimum of either targetSize.fixed or instanceGroupManager.targetSize is used.
             * - if expressed as a percent, the targetSize would be (targetSize.percent/100 * InstanceGroupManager.targetSize) If there is a remainder, the number is rounded up.  If unset, this version will update any remaining instances not updated by another version. Read Starting a canary update for more information.
             */
            targetSize?: pulumi.Input<inputs.compute.beta.FixedOrPercent>;
        }
        interface InstanceProperties {
            /**
             * Controls for advanced machine-related behavior features.
             */
            advancedMachineFeatures?: pulumi.Input<inputs.compute.beta.AdvancedMachineFeatures>;
            /**
             * Enables instances created based on these properties to send packets with source IP addresses other than their own and receive packets with destination IP addresses other than their own. If these instances will be used as an IP gateway or it will be set as the next-hop in a Route resource, specify true. If unsure, leave this set to false. See the Enable IP forwarding documentation for more information.
             */
            canIpForward?: pulumi.Input<boolean>;
            /**
             * Specifies the Confidential Instance options.
             */
            confidentialInstanceConfig?: pulumi.Input<inputs.compute.beta.ConfidentialInstanceConfig>;
            /**
             * An optional text description for the instances that are created from these properties.
             */
            description?: pulumi.Input<string>;
            /**
             * An array of disks that are associated with the instances that are created from these properties.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.compute.beta.AttachedDisk>[]>;
            /**
             * Display Device properties to enable support for remote display products like: Teradici, VNC and TeamViewer
             */
            displayDevice?: pulumi.Input<inputs.compute.beta.DisplayDevice>;
            /**
             * A list of guest accelerator cards' type and count to use for instances created from these properties.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.beta.AcceleratorConfig>[]>;
            /**
             * Labels to apply to instances that are created from these properties.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The machine type to use for instances that are created from these properties.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs to assign to instances that are created from these properties. These pairs can consist of custom metadata or predefined keys. See Project and instance metadata for more information.
             */
            metadata?: pulumi.Input<inputs.compute.beta.Metadata>;
            /**
             * Minimum cpu/platform to be used by instances. The instance may be scheduled on the specified or newer cpu/platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: "Intel Haswell" or minCpuPlatform: "Intel Sandy Bridge". For more information, read Specifying a Minimum CPU Platform.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * An array of network access configurations for this interface.
             */
            networkInterfaces?: pulumi.Input<pulumi.Input<inputs.compute.beta.NetworkInterface>[]>;
            networkPerformanceConfig?: pulumi.Input<inputs.compute.beta.NetworkPerformanceConfig>;
            /**
             * PostKeyRevocationActionType of the instance.
             */
            postKeyRevocationActionType?: pulumi.Input<string>;
            /**
             * The private IPv6 google access type for VMs. If not specified, use  INHERIT_FROM_SUBNETWORK as default.
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * Specifies the reservations that instances can consume from.
             */
            reservationAffinity?: pulumi.Input<inputs.compute.beta.ReservationAffinity>;
            /**
             * Resource policies (names, not ULRs) applied to instances created from these properties.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the scheduling options for the instances that are created from these properties.
             */
            scheduling?: pulumi.Input<inputs.compute.beta.Scheduling>;
            /**
             * A list of service accounts with specified scopes. Access tokens for these service accounts are available to the instances that are created from these properties. Use metadata queries to obtain the access tokens for these instances.
             */
            serviceAccounts?: pulumi.Input<pulumi.Input<inputs.compute.beta.ServiceAccount>[]>;
            shieldedInstanceConfig?: pulumi.Input<inputs.compute.beta.ShieldedInstanceConfig>;
            /**
             * Specifies the Shielded VM options for the instances that are created from these properties.
             */
            shieldedVmConfig?: pulumi.Input<inputs.compute.beta.ShieldedVmConfig>;
            /**
             * A list of tags to apply to the instances that are created from these properties. The tags identify valid sources or targets for network firewalls. The setTags method can modify this list of tags. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<inputs.compute.beta.Tags>;
        }
        /**
         * HttpRouteRuleMatch criteria for field values that must stay within the specified integer range.
         */
        interface Int64RangeMatch {
            /**
             * The end of the range (exclusive) in signed long integer format.
             */
            rangeEnd?: pulumi.Input<string>;
            /**
             * The start of the range (inclusive) in signed long integer format.
             */
            rangeStart?: pulumi.Input<string>;
        }
        /**
         * Informational metadata about Partner attachments from Partners to display to customers. These fields are propagated from PARTNER_PROVIDER attachments to their corresponding PARTNER attachments.
         */
        interface InterconnectAttachmentPartnerMetadata {
            /**
             * Plain text name of the Interconnect this attachment is connected to, as displayed in the Partner's portal. For instance "Chicago 1". This value may be validated to match approved Partner values.
             */
            interconnectName?: pulumi.Input<string>;
            /**
             * Plain text name of the Partner providing this attachment. This value may be validated to match approved Partner values.
             */
            partnerName?: pulumi.Input<string>;
            /**
             * URL of the Partner's portal for this Attachment. Partners may customise this to be a deep link to the specific resource on the Partner portal. This value may be validated to match approved Partner values.
             */
            portalUrl?: pulumi.Input<string>;
        }
        /**
         * Information for an interconnect attachment when this belongs to an interconnect of type DEDICATED.
         */
        interface InterconnectAttachmentPrivateInfo {
            /**
             * [Output Only] 802.1q encapsulation tag to be used for traffic between Google and the customer, going to and from this network and region.
             */
            tag8021q?: pulumi.Input<number>;
        }
        /**
         * Describes a single physical circuit between the Customer and Google. CircuitInfo objects are created by Google, so all fields are output only.
         */
        interface InterconnectCircuitInfo {
            /**
             * Customer-side demarc ID for this circuit.
             */
            customerDemarcId?: pulumi.Input<string>;
            /**
             * Google-assigned unique ID for this circuit. Assigned at circuit turn-up.
             */
            googleCircuitId?: pulumi.Input<string>;
            /**
             * Google-side demarc ID for this circuit. Assigned at circuit turn-up and provided by Google to the customer in the LOA.
             */
            googleDemarcId?: pulumi.Input<string>;
        }
        /**
         * Description of a planned outage on this Interconnect.
         */
        interface InterconnectOutageNotification {
            /**
             * If issue_type is IT_PARTIAL_OUTAGE, a list of the Google-side circuit IDs that will be affected.
             */
            affectedCircuits?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A description about the purpose of the outage.
             */
            description?: pulumi.Input<string>;
            /**
             * Scheduled end time for the outage (milliseconds since Unix epoch).
             */
            endTime?: pulumi.Input<string>;
            /**
             * Form this outage is expected to take, which can take one of the following values:
             * - OUTAGE: The Interconnect may be completely out of service for some or all of the specified window.
             * - PARTIAL_OUTAGE: Some circuits comprising the Interconnect as a whole should remain up, but with reduced bandwidth. Note that the versions of this enum prefixed with "IT_" have been deprecated in favor of the unprefixed values.
             */
            issueType?: pulumi.Input<string>;
            /**
             * Unique identifier for this outage notification.
             */
            name?: pulumi.Input<string>;
            /**
             * The party that generated this notification, which can take the following value:
             * - GOOGLE: this notification as generated by Google. Note that the value of NSRC_GOOGLE has been deprecated in favor of GOOGLE.
             */
            source?: pulumi.Input<string>;
            /**
             * Scheduled start time for the outage (milliseconds since Unix epoch).
             */
            startTime?: pulumi.Input<string>;
            /**
             * State of this notification, which can take one of the following values:
             * - ACTIVE: This outage notification is active. The event could be in the past, present, or future. See start_time and end_time for scheduling.
             * - CANCELLED: The outage associated with this notification was cancelled before the outage was due to start. Note that the versions of this enum prefixed with "NS_" have been deprecated in favor of the unprefixed values.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Commitment for a particular license resource.
         */
        interface LicenseResourceCommitment {
            /**
             * The number of licenses purchased.
             */
            amount?: pulumi.Input<string>;
            /**
             * Specifies the core range of the instance for which this license applies.
             */
            coresPerLicense?: pulumi.Input<string>;
            /**
             * Any applicable license URI.
             */
            license?: pulumi.Input<string>;
        }
        interface LicenseResourceRequirements {
            /**
             * Minimum number of guest cpus required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minGuestCpuCount?: pulumi.Input<number>;
            /**
             * Minimum memory required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minMemoryMb?: pulumi.Input<number>;
        }
        interface LocalDisk {
            /**
             * Specifies the number of such disks.
             */
            diskCount?: pulumi.Input<number>;
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Specifies the desired disk type on the node. This disk type must be a local storage type (e.g.: local-ssd). Note that for nodeTemplates, this should be the name of the disk type and not its URL.
             */
            diskType?: pulumi.Input<string>;
        }
        /**
         * Specifies what kind of log the caller must write
         */
        interface LogConfig {
            /**
             * Cloud audit options.
             */
            cloudAudit?: pulumi.Input<inputs.compute.beta.LogConfigCloudAuditOptions>;
            /**
             * Counter options.
             */
            counter?: pulumi.Input<inputs.compute.beta.LogConfigCounterOptions>;
            /**
             * Data access options.
             */
            dataAccess?: pulumi.Input<inputs.compute.beta.LogConfigDataAccessOptions>;
        }
        /**
         * Write a Cloud Audit log
         */
        interface LogConfigCloudAuditOptions {
            /**
             * Information used by the Cloud Audit Logging pipeline.
             */
            authorizationLoggingOptions?: pulumi.Input<inputs.compute.beta.AuthorizationLoggingOptions>;
            /**
             * The log_name to populate in the Cloud Audit Record.
             */
            logName?: pulumi.Input<string>;
        }
        /**
         * Increment a streamz counter with the specified metric and field names.
         *
         * Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended.
         *
         * Field names correspond to IAM request parameters and field values are their respective values.
         *
         * Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields.
         *
         * Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/debug_access_count {iam_principal=[value of IAMContext.principal]}
         */
        interface LogConfigCounterOptions {
            /**
             * Custom fields.
             */
            customFields?: pulumi.Input<pulumi.Input<inputs.compute.beta.LogConfigCounterOptionsCustomField>[]>;
            /**
             * The field value to attribute.
             */
            field?: pulumi.Input<string>;
            /**
             * The metric to update.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Custom fields. These can be used to create a counter with arbitrary field/value pairs. See: go/rpcsp-custom-fields.
         */
        interface LogConfigCounterOptionsCustomField {
            /**
             * Name is the field name.
             */
            name?: pulumi.Input<string>;
            /**
             * Value is the field value. It is important that in contrast to the CounterOptions.field, the value here is a constant that is not derived from the IAMContext.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Write a Data Access (Gin) log
         */
        interface LogConfigDataAccessOptions {
            logMode?: pulumi.Input<string>;
        }
        /**
         * A metadata key/value entry.
         */
        interface Metadata {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet.
             *
             * To see the latest fingerprint, make a get() request to retrieve the resource.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * Array of key/value pairs. The total size of all keys and values must be less than 512 KB.
             */
            items?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] Type of the resource. Always compute#metadata for metadata.
             */
            kind?: pulumi.Input<string>;
        }
        /**
         * Opaque filter criteria used by loadbalancers to restrict routing configuration to a limited set of loadbalancing proxies. Proxies and sidecars involved in loadbalancing would typically present metadata to the loadbalancers which need to match criteria specified here. If a match takes place, the relevant configuration is made available to those proxies.
         * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata.
         * An example for using metadataFilters would be: if loadbalancing involves  Envoys, they will only receive routing configuration when values in metadataFilters match values supplied in <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/core/base.proto#envoy-api-msg-core-node" Node metadata of their XDS requests to loadbalancers.
         */
        interface MetadataFilter {
            /**
             * The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria
             * This list must not be empty and can have at the most 64 entries.
             */
            filterLabels?: pulumi.Input<pulumi.Input<inputs.compute.beta.MetadataFilterLabelMatch>[]>;
            /**
             * Specifies how individual filterLabel matches within the list of filterLabels contribute towards the overall metadataFilter match.
             * Supported values are:
             * - MATCH_ANY: At least one of the filterLabels must have a matching label in the provided metadata.
             * - MATCH_ALL: All filterLabels must have matching labels in the provided metadata.
             */
            filterMatchCriteria?: pulumi.Input<string>;
        }
        /**
         * MetadataFilter label name value pairs that are expected to match corresponding labels presented as metadata to the loadbalancer.
         */
        interface MetadataFilterLabelMatch {
            /**
             * Name of metadata label.
             * The name can have a maximum length of 1024 characters and must be at least 1 character long.
             */
            name?: pulumi.Input<string>;
            /**
             * The value of the label must match the specified value.
             * value can have a maximum length of 1024 characters.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The named port. For example: .
         */
        interface NamedPort {
            /**
             * The name for this named port. The name must be 1-63 characters long, and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * The port number, which can be a value between 1 and 65535.
             */
            port?: pulumi.Input<number>;
        }
        /**
         * Configuration for an App Engine network endpoint group (NEG). The service is optional, may be provided explicitly or in the URL mask. The version is optional and can only be provided explicitly or in the URL mask when service is present.
         *
         * Note: App Engine service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupAppEngine {
            /**
             * Optional serving service.
             *
             * The service name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "default", "my-service".
             */
            service?: pulumi.Input<string>;
            /**
             * A template to parse service and version fields from a request URL. URL mask allows for routing to multiple App Engine services without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, the request URLs "foo1-dot-appname.appspot.com/v1" and "foo1-dot-appname.appspot.com/v2" can be backed by the same Serverless NEG with URL mask "-dot-appname.appspot.com/". The URL mask will parse them to { service = "foo1", version = "v1" } and { service = "foo1", version = "v2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
            /**
             * Optional serving version.
             *
             * The version name is case-sensitive and must be 1-100 characters long.
             *
             * Example value: "v1", "v2".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Function network endpoint group (NEG). The function must be provided explicitly or in the URL mask.
         *
         * Note: Cloud Function must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudFunction {
            /**
             * A user-defined name of the Cloud Function.
             *
             * The function name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "func1".
             */
            function?: pulumi.Input<string>;
            /**
             * A template to parse function field from a request URL. URL mask allows for routing to multiple Cloud Functions without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2" can be backed by the same Serverless NEG with URL mask "/". The URL mask will parse them to { function = "function1" } and { function = "function2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Run network endpoint group (NEG). The service must be provided explicitly or in the URL mask. The tag is optional, may be provided explicitly or in the URL mask.
         *
         * Note: Cloud Run service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudRun {
            /**
             * Cloud Run service is the main resource of Cloud Run.
             *
             * The service must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "run-service".
             */
            service?: pulumi.Input<string>;
            /**
             * Optional Cloud Run tag represents the "named-revision" to provide additional fine-grained traffic routing information.
             *
             * The tag must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "revision-0010".
             */
            tag?: pulumi.Input<string>;
            /**
             * A template to parse service and tag fields from a request URL. URL mask allows for routing to multiple Run services without having to create multiple network endpoint groups and backend services.
             *
             * For example, request URLs "foo1.domain.com/bar1" and "foo1.domain.com/bar2" can be backed by the same Serverless Network Endpoint Group (NEG) with URL mask ".domain.com/". The URL mask will parse them to { service="bar1", tag="foo1" } and { service="bar2", tag="foo2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * Load balancing specific fields for network endpoint group.
         */
        interface NetworkEndpointGroupLbNetworkEndpointGroup {
            /**
             * The default port used if the port number is not specified in the network endpoint. [Deprecated] This field is deprecated.
             */
            defaultPort?: pulumi.Input<number>;
            /**
             * The URL of the network to which all network endpoints in the NEG belong. Uses "default" project network if unspecified. [Deprecated] This field is deprecated.
             */
            network?: pulumi.Input<string>;
            /**
             * Optional URL of the subnetwork to which all network endpoints in the NEG belong. [Deprecated] This field is deprecated.
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * [Output Only] The URL of the zone where the network endpoint group is located. [Deprecated] This field is deprecated.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A network interface resource attached to an instance.
         */
        interface NetworkInterface {
            /**
             * An array of configurations for this interface. Currently, only one access config, ONE_TO_ONE_NAT, is supported. If there are no accessConfigs specified, then this instance will have no external internet access.
             */
            accessConfigs?: pulumi.Input<pulumi.Input<inputs.compute.beta.AccessConfig>[]>;
            /**
             * An array of alias IP ranges for this network interface. You can only specify this field for network interfaces in VPC networks.
             */
            aliasIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.beta.AliasIpRange>[]>;
            /**
             * Fingerprint hash of contents stored in this network interface. This field will be ignored when inserting an Instance or adding a NetworkInterface. An up-to-date fingerprint must be provided in order to update the NetworkInterface. The request will fail with error 400 Bad Request if the fingerprint is not provided, or 412 Precondition Failed if the fingerprint is out of date.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * [Output Only] An IPv6 internal network address for this network interface.
             */
            ipv6Address?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#networkInterface for network interfaces.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] The name of the network interface, which is generated by the server. For network devices, these are eth0, eth1, etc.
             */
            name?: pulumi.Input<string>;
            /**
             * URL of the network resource for this instance. When creating an instance, if neither the network nor the subnetwork is specified, the default network global/networks/default is used; if the network is not specified but the subnetwork is specified, the network is inferred.
             *
             * If you specify this property, you can specify the network as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/global/networks/network
             * - projects/project/global/networks/network
             * - global/networks/default
             */
            network?: pulumi.Input<string>;
            /**
             * An IPv4 internal IP address to assign to the instance for this network interface. If not specified by the user, an unused internal IP is assigned by the system.
             */
            networkIP?: pulumi.Input<string>;
            /**
             * The type of vNIC to be used on this interface. This may be gVNIC or VirtioNet.
             */
            nicType?: pulumi.Input<string>;
            /**
             * The URL of the Subnetwork resource for this instance. If the network resource is in legacy mode, do not specify this field. If the network is in auto subnet mode, specifying the subnetwork is optional. If the network is in custom subnet mode, specifying the subnetwork is required. If you specify this field, you can specify the subnetwork as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/regions/region/subnetworks/subnetwork
             * - regions/region/subnetworks/subnetwork
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
         */
        interface NetworkPeering {
            /**
             * This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            autoCreateRoutes?: pulumi.Input<boolean>;
            /**
             * Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            exchangeSubnetRoutes?: pulumi.Input<boolean>;
            /**
             * Whether to export the custom routes to peer network.
             */
            exportCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
             */
            exportSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Whether to import the custom routes from peer network.
             */
            importCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
             */
            importSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
             */
            network?: pulumi.Input<string>;
            /**
             * Maximum Transmission Unit in bytes.
             */
            peerMtu?: pulumi.Input<number>;
            /**
             * [Output Only] State for the peering, either `ACTIVE` or `INACTIVE`. The peering is `ACTIVE` when there's a matching configuration in the peer network.
             */
            state?: pulumi.Input<string>;
            /**
             * [Output Only] Details about the current state of the peering.
             */
            stateDetails?: pulumi.Input<string>;
        }
        interface NetworkPerformanceConfig {
            totalEgressBandwidthTier?: pulumi.Input<string>;
        }
        /**
         * A routing configuration attached to a network resource. The message includes the list of routers associated with the network, and a flag indicating the type of routing behavior to enforce network-wide.
         */
        interface NetworkRoutingConfig {
            /**
             * The network-wide routing mode to use. If set to REGIONAL, this network's Cloud Routers will only advertise routes with subnets of this network in the same region as the router. If set to GLOBAL, this network's Cloud Routers will advertise routes with all subnets of this network, across regions.
             */
            routingMode?: pulumi.Input<string>;
        }
        interface NodeGroupAutoscalingPolicy {
            /**
             * The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             */
            maxNodes?: pulumi.Input<number>;
            /**
             * The minimum number of nodes that the group should have.
             */
            minNodes?: pulumi.Input<number>;
            /**
             * The autoscaling mode. Set to one of: ON, OFF, or ONLY_SCALE_OUT. For more information, see  Autoscaler modes.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily maintenance operations. GCE's internal maintenance will be performed within this window.
         */
        interface NodeGroupMaintenanceWindow {
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            maintenanceDuration?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        interface NodeTemplateNodeTypeFlexibility {
            cpus?: pulumi.Input<string>;
            localSsd?: pulumi.Input<string>;
            memory?: pulumi.Input<string>;
        }
        /**
         * Represents a gRPC setting that describes one gRPC notification endpoint and the retry duration attempting to send notification to this endpoint.
         */
        interface NotificationEndpointGrpcSettings {
            /**
             * Optional. If specified, this field is used to set the authority header by the sender of notifications. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
             */
            authority?: pulumi.Input<string>;
            /**
             * Endpoint to which gRPC notifications are sent. This must be a valid gRPCLB DNS name.
             */
            endpoint?: pulumi.Input<string>;
            /**
             * Optional. If specified, this field is used to populate the "name" field in gRPC requests.
             */
            payloadName?: pulumi.Input<string>;
            /**
             * Optional. This field is used to configure how often to send a full update of all non-healthy backends. If unspecified, full updates are not sent. If specified, must be in the range between 600 seconds to 3600 seconds. Nanos are disallowed.
             */
            resendInterval?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * How much time (in seconds) is spent attempting notification retries until a successful response is received. Default is 30s. Limit is 20m (1200s). Must be a positive number.
             */
            retryDurationSec?: pulumi.Input<number>;
        }
        /**
         * Settings controlling the eviction of unhealthy hosts from the load balancing pool for the backend service.
         */
        interface OutlierDetection {
            /**
             * The base time that a host is ejected for. The real ejection time is equal to the base ejection time multiplied by the number of times the host has been ejected. Defaults to 30000ms or 30s.
             */
            baseEjectionTime?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * Number of errors before a host is ejected from the connection pool. When the backend host is accessed over HTTP, a 5xx return code qualifies as an error. Defaults to 5.
             */
            consecutiveErrors?: pulumi.Input<number>;
            /**
             * The number of consecutive gateway failures (502, 503, 504 status or connection errors that are mapped to one of those status codes) before a consecutive gateway failure ejection occurs. Defaults to 3.
             */
            consecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0.
             */
            enforcingConsecutiveErrors?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive gateway failures. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingConsecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through success rate statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingSuccessRate?: pulumi.Input<number>;
            /**
             * Time interval between ejection analysis sweeps. This can result in both new ejections as well as hosts being returned to service. Defaults to 1 second.
             */
            interval?: pulumi.Input<inputs.compute.beta.Duration>;
            /**
             * Maximum percentage of hosts in the load balancing pool for the backend service that can be ejected. Defaults to 50%.
             */
            maxEjectionPercent?: pulumi.Input<number>;
            /**
             * The number of hosts in a cluster that must have enough request volume to detect success rate outliers. If the number of hosts is less than this setting, outlier detection via success rate statistics is not performed for any host in the cluster. Defaults to 5.
             */
            successRateMinimumHosts?: pulumi.Input<number>;
            /**
             * The minimum number of total requests that must be collected in one interval (as defined by the interval duration above) to include this host in success rate based outlier detection. If the volume is lower than this setting, outlier detection via success rate statistics is not performed for that host. Defaults to 100.
             */
            successRateRequestVolume?: pulumi.Input<number>;
            /**
             * This factor is used to determine the ejection threshold for success rate outlier ejection. The ejection threshold is the difference between the mean success rate, and the product of this factor and the standard deviation of the mean success rate: mean - (stdev * success_rate_stdev_factor). This factor is divided by a thousand to get a double. That is, if the desired factor is 1.9, the runtime value should be 1900. Defaults to 1900.
             */
            successRateStdevFactor?: pulumi.Input<number>;
        }
        interface PacketMirroringFilter {
            /**
             * Protocols that apply as filter on mirrored traffic. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            IPProtocols?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * IP CIDR ranges that apply as filter on the source (ingress) or destination (egress) IP in the IP header. Only IPv4 is supported. If no ranges are specified, all traffic that matches the specified IPProtocols is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            cidrRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Direction of traffic to mirror, either INGRESS, EGRESS, or BOTH. The default is BOTH.
             */
            direction?: pulumi.Input<string>;
        }
        interface PacketMirroringForwardingRuleInfo {
            /**
             * [Output Only] Unique identifier for the forwarding rule; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the forwarding rule representing the ILB configured as destination of the mirrored traffic.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfo {
            /**
             * A set of virtual machine instances that are being mirrored. They must live in zones contained in the same region as this packetMirroring.
             *
             * Note that this config will apply only to those network interfaces of the Instances that belong to the network specified in this packetMirroring.
             *
             * You may specify a maximum of 50 Instances.
             */
            instances?: pulumi.Input<pulumi.Input<inputs.compute.beta.PacketMirroringMirroredResourceInfoInstanceInfo>[]>;
            /**
             * A set of subnetworks for which traffic from/to all VM instances will be mirrored. They must live in the same region as this packetMirroring.
             *
             * You may specify a maximum of 5 subnetworks.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.beta.PacketMirroringMirroredResourceInfoSubnetInfo>[]>;
            /**
             * A set of mirrored tags. Traffic from/to all VM instances that have one or more of these tags will be mirrored.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface PacketMirroringMirroredResourceInfoInstanceInfo {
            /**
             * [Output Only] Unique identifier for the instance; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the virtual machine instance which is being mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfoSubnetInfo {
            /**
             * [Output Only] Unique identifier for the subnetwork; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the subnetwork for which traffic from/to all VM instances will be mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringNetworkInfo {
            /**
             * [Output Only] Unique identifier for the network; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * URL of the network resource.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * A matcher for the path portion of the URL. The BackendService from the longest-matched rule will serve the URL. If no rule was matched, the default service will be used.
         */
        interface PathMatcher {
            /**
             * defaultRouteAction takes effect when none of the  pathRules or routeRules match. The load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If defaultRouteAction specifies any weightedBackendServices, defaultService must not be set. Conversely if defaultService is set, defaultRouteAction cannot contain any  weightedBackendServices.
             * Only one of defaultRouteAction or defaultUrlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathMatcher's defaultRouteAction.
             */
            defaultRouteAction?: pulumi.Input<inputs.compute.beta.HttpRouteAction>;
            /**
             * The full or partial URL to the BackendService resource. This will be used if none of the pathRules or routeRules defined by this PathMatcher are matched. For example, the following are all valid URLs to a BackendService resource:
             * - https://www.googleapis.com/compute/v1/projects/project/global/backendServices/backendService
             * - compute/v1/projects/project/global/backendServices/backendService
             * - global/backendServices/backendService  If defaultRouteAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if defaultService is specified, defaultRouteAction cannot contain any weightedBackendServices. Conversely, if defaultRouteAction specifies any weightedBackendServices, defaultService must not be specified.
             * Only one of defaultService, defaultUrlRedirect  or defaultRouteAction.weightedBackendService must be set.
             * Authorization requires one or more of the following Google IAM permissions on the specified resource default_service:
             * - compute.backendBuckets.use
             * - compute.backendServices.use
             */
            defaultService?: pulumi.Input<string>;
            /**
             * When none of the specified pathRules or routeRules match, the request is redirected to a URL specified by defaultUrlRedirect.
             * If defaultUrlRedirect is specified, defaultService or defaultRouteAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            defaultUrlRedirect?: pulumi.Input<inputs.compute.beta.HttpRedirectAction>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * HeaderAction specified here are applied after the matching HttpRouteRule HeaderAction and before the HeaderAction in the UrlMap
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.beta.HttpHeaderAction>;
            /**
             * The name to which this PathMatcher is referred by the HostRule.
             */
            name?: pulumi.Input<string>;
            /**
             * The list of path rules. Use this list instead of routeRules when routing based on simple path matching is all that's required. The order by which path rules are specified does not matter. Matches are always done on the longest-path-first basis.
             * For example: a pathRule with a path /a/b/c/* will match before /a/b/* irrespective of the order in which those paths appear in this list.
             * Within a given pathMatcher, only one of pathRules or routeRules must be set.
             */
            pathRules?: pulumi.Input<pulumi.Input<inputs.compute.beta.PathRule>[]>;
            /**
             * The list of HTTP route rules. Use this list instead of pathRules when advanced route matching and routing actions are desired. routeRules are evaluated in order of priority, from the lowest to highest number.
             * Within a given pathMatcher, you can set only one of pathRules or routeRules.
             */
            routeRules?: pulumi.Input<pulumi.Input<inputs.compute.beta.HttpRouteRule>[]>;
        }
        /**
         * A path-matching rule for a URL. If matched, will use the specified BackendService to handle the traffic arriving at this URL.
         */
        interface PathRule {
            /**
             * The list of path patterns to match. Each must start with / and the only place a * is allowed is at the end following a /. The string fed to the path matcher does not include any text after the first ? or #, and those chars are not allowed here.
             */
            paths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * In response to a matching path, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of routeAction or urlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.beta.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When a path pattern is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.beta.HttpRedirectAction>;
        }
        /**
         * Represents a CIDR range which can be used to assign addresses.
         */
        interface PublicAdvertisedPrefixPublicDelegatedPrefix {
            /**
             * The IP address range of the public delegated prefix
             */
            ipRange?: pulumi.Input<string>;
            /**
             * The name of the public delegated prefix
             */
            name?: pulumi.Input<string>;
            /**
             * The project number of the public delegated prefix
             */
            project?: pulumi.Input<string>;
            /**
             * The region of the public delegated prefix if it is regional. If absent, the prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * The status of the public delegated prefix. Possible values are: INITIALIZING: The public delegated prefix is being initialized and addresses cannot be created yet. ANNOUNCED: The public delegated prefix is active.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Represents a sub PublicDelegatedPrefix.
         */
        interface PublicDelegatedPrefixPublicDelegatedSubPrefix {
            /**
             * Name of the project scoping this PublicDelegatedSubPrefix.
             */
            delegateeProject?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The IPv4 address range, in CIDR format, represented by this sub public delegated prefix.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * Whether the sub prefix is delegated to create Address resources in the delegatee project.
             */
            isAddress?: pulumi.Input<boolean>;
            /**
             * The name of the sub public delegated prefix.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The region of the sub public delegated prefix if it is regional. If absent, the sub prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the sub public delegated prefix.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A policy that specifies how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
         */
        interface RequestMirrorPolicy {
            /**
             * The full or partial URL to the BackendService resource being mirrored to.
             */
            backendService?: pulumi.Input<string>;
        }
        /**
         * Represents a reservation resource. A reservation ensures that capacity is held in a specific zone even if the reserved VMs are not running. For more information, read  Reserving zonal resources. (== resource_for {$api_version}.reservations ==)
         */
        interface Reservation {
            /**
             * [Output Only] Full or partial URL to a parent commitment. This field displays for reservations that are tied to a commitment.
             */
            commitment?: pulumi.Input<string>;
            /**
             * [Output Only] Creation timestamp in RFC3339 text format.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The unique identifier for the resource. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#reservations for reservations.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of the resource, provided by the client when initially creating the resource. The resource name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] Reserved for future use.
             */
            satisfiesPzs?: pulumi.Input<boolean>;
            /**
             * [Output Only] Server-defined fully-qualified URL for this resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * Reservation for instances with specific machine shapes.
             */
            specificReservation?: pulumi.Input<inputs.compute.beta.AllocationSpecificSKUReservation>;
            /**
             * Indicates whether the reservation can be consumed by VMs with affinity for "any" reservation. If the field is set, then only VMs that target the reservation by name can consume from this reservation.
             */
            specificReservationRequired?: pulumi.Input<boolean>;
            /**
             * [Output Only] The status of the reservation.
             */
            status?: pulumi.Input<string>;
            /**
             * Zone in which the reservation resides. A zone must be provided if the reservation is created within a commitment.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Specifies the reservations that this instance can consume from.
         */
        interface ReservationAffinity {
            /**
             * Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See  Consuming reserved instances for examples.
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify googleapis.com/reservation-name as the key and specify the name of your reservation as its value.
             */
            key?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of a reservation resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Commitment for a particular resource (a Commitment is composed of one or more of these).
         */
        interface ResourceCommitment {
            /**
             * Name of the accelerator type resource. Applicable only when the type is ACCELERATOR.
             */
            acceleratorType?: pulumi.Input<string>;
            /**
             * The amount of the resource purchased (in a type-dependent unit, such as bytes). For vCPUs, this can just be an integer. For memory, this must be provided in MB. Memory must be a multiple of 256 MB, with up to 6.5GB of memory per every vCPU.
             */
            amount?: pulumi.Input<string>;
            /**
             * Type of resource for which this commitment applies. Possible values are VCPU and MEMORY
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily operations.
         */
        interface ResourcePolicyDailyCycle {
            /**
             * Defines a schedule with units measured in months. The value determines how many months pass between the start of each cycle.
             */
            daysInCycle?: pulumi.Input<number>;
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * A GroupPlacementPolicy specifies resource placement configuration. It specifies the failure bucket separation as well as network locality
         */
        interface ResourcePolicyGroupPlacementPolicy {
            /**
             * The number of availability domains instances will be spread across. If two instances are in different availability domain, they will not be put in the same low latency network
             */
            availabilityDomainCount?: pulumi.Input<number>;
            /**
             * Specifies network collocation
             */
            collocation?: pulumi.Input<string>;
            /**
             * Number of vms in this placement group
             */
            vmCount?: pulumi.Input<number>;
        }
        /**
         * Time window specified for hourly operations.
         */
        interface ResourcePolicyHourlyCycle {
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Defines a schedule with units measured in hours. The value determines how many hours pass between the start of each cycle.
             */
            hoursInCycle?: pulumi.Input<number>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * An InstanceSchedulePolicy specifies when and how frequent certain operations are performed on the instance.
         */
        interface ResourcePolicyInstanceSchedulePolicy {
            /**
             * The expiration time of the schedule. The timestamp is an RFC3339 string.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * The start time of the schedule. The timestamp is an RFC3339 string.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Specifies the time zone to be used in interpreting Schedule.schedule. The value of this field must be a time zone name from the tz database: http://en.wikipedia.org/wiki/Tz_database.
             */
            timeZone?: pulumi.Input<string>;
            /**
             * Specifies the schedule for starting instances.
             */
            vmStartSchedule?: pulumi.Input<inputs.compute.beta.ResourcePolicyInstanceSchedulePolicySchedule>;
            /**
             * Specifies the schedule for stopping instances.
             */
            vmStopSchedule?: pulumi.Input<inputs.compute.beta.ResourcePolicyInstanceSchedulePolicySchedule>;
        }
        /**
         * Schedule for an instance operation.
         */
        interface ResourcePolicyInstanceSchedulePolicySchedule {
            /**
             * Specifies the frequency for the operation, using the unix-cron format.
             */
            schedule?: pulumi.Input<string>;
        }
        /**
         * Contains output only fields. Use this sub-message for all output fields set on ResourcePolicy. The internal structure of this "status" field should mimic the structure of ResourcePolicy proto specification.
         */
        interface ResourcePolicyResourceStatus {
            /**
             * [Output Only] Specifies a set of output values reffering to the instance_schedule_policy system status. This field should have the same name as corresponding policy field.
             */
            instanceSchedulePolicy?: pulumi.Input<inputs.compute.beta.ResourcePolicyResourceStatusInstanceSchedulePolicyStatus>;
        }
        interface ResourcePolicyResourceStatusInstanceSchedulePolicyStatus {
            /**
             * [Output Only] The last time the schedule successfully ran. The timestamp is an RFC3339 string.
             */
            lastRunStartTime?: pulumi.Input<string>;
            /**
             * [Output Only] The next time the schedule is planned to run. The actual time might be slightly different. The timestamp is an RFC3339 string.
             */
            nextRunStartTime?: pulumi.Input<string>;
        }
        /**
         * A snapshot schedule policy specifies when and how frequently snapshots are to be created for the target disk. Also specifies how many and how long these scheduled snapshots should be retained.
         */
        interface ResourcePolicySnapshotSchedulePolicy {
            /**
             * Retention policy applied to snapshots created by this resource policy.
             */
            retentionPolicy?: pulumi.Input<inputs.compute.beta.ResourcePolicySnapshotSchedulePolicyRetentionPolicy>;
            /**
             * A Vm Maintenance Policy specifies what kind of infrastructure maintenance we are allowed to perform on this VM and when. Schedule that is applied to disks covered by this policy.
             */
            schedule?: pulumi.Input<inputs.compute.beta.ResourcePolicySnapshotSchedulePolicySchedule>;
            /**
             * Properties with which snapshots are created such as labels, encryption keys.
             */
            snapshotProperties?: pulumi.Input<inputs.compute.beta.ResourcePolicySnapshotSchedulePolicySnapshotProperties>;
        }
        /**
         * Policy for retention of scheduled snapshots.
         */
        interface ResourcePolicySnapshotSchedulePolicyRetentionPolicy {
            /**
             * Maximum age of the snapshot that is allowed to be kept.
             */
            maxRetentionDays?: pulumi.Input<number>;
            /**
             * Specifies the behavior to apply to scheduled snapshots when the source disk is deleted.
             */
            onSourceDiskDelete?: pulumi.Input<string>;
        }
        /**
         * A schedule for disks where the schedueled operations are performed.
         */
        interface ResourcePolicySnapshotSchedulePolicySchedule {
            dailySchedule?: pulumi.Input<inputs.compute.beta.ResourcePolicyDailyCycle>;
            hourlySchedule?: pulumi.Input<inputs.compute.beta.ResourcePolicyHourlyCycle>;
            weeklySchedule?: pulumi.Input<inputs.compute.beta.ResourcePolicyWeeklyCycle>;
        }
        /**
         * Specified snapshot properties for scheduled snapshots created by this policy.
         */
        interface ResourcePolicySnapshotSchedulePolicySnapshotProperties {
            /**
             * Chain name that the snapshot is created in.
             */
            chainName?: pulumi.Input<string>;
            /**
             * Indication to perform a 'guest aware' snapshot.
             */
            guestFlush?: pulumi.Input<boolean>;
            /**
             * Labels to apply to scheduled snapshots. These can be later modified by the setLabels method. Label values may be empty.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Cloud Storage bucket storage location of the auto snapshot (regional or multi-regional).
             */
            storageLocations?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Time window specified for weekly operations.
         */
        interface ResourcePolicyWeeklyCycle {
            /**
             * Up to 7 intervals/windows, one for each day of the week.
             */
            dayOfWeeks?: pulumi.Input<pulumi.Input<inputs.compute.beta.ResourcePolicyWeeklyCycleDayOfWeek>[]>;
        }
        interface ResourcePolicyWeeklyCycleDayOfWeek {
            /**
             * Defines a schedule that runs on specific days of the week. Specify one or more days. The following options are available: MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, SUNDAY.
             */
            day?: pulumi.Input<string>;
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Description-tagged IP ranges for the router to advertise.
         */
        interface RouterAdvertisedIpRange {
            /**
             * User-specified description for the IP range.
             */
            description?: pulumi.Input<string>;
            /**
             * The IP range to advertise. The value must be a CIDR-formatted string.
             */
            range?: pulumi.Input<string>;
        }
        interface RouterBgp {
            /**
             * User-specified flag to indicate which mode to use for advertisement. The options are DEFAULT or CUSTOM.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These groups will be advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These IP ranges will be advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.beta.RouterAdvertisedIpRange>[]>;
            /**
             * Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. All VPN tunnels that link to this router will have the same local ASN.
             */
            asn?: pulumi.Input<number>;
            /**
             * The interval in seconds between BGP keepalive messages that are sent to the peer.
             * Not currently available publicly.
             * Hold time is three times the interval at which keepalive messages are sent, and the hold time is the maximum number of seconds allowed to elapse between successive keepalive messages that BGP receives from a peer.
             * BGP will use the smaller of either the local hold time value or the peer's hold time value as the hold time for the BGP connection between the two peers.
             * If set, this value must be between 20 and 60. The default is 20.
             */
            keepaliveInterval?: pulumi.Input<number>;
        }
        interface RouterBgpPeer {
            /**
             * User-specified flag to indicate which mode to use for advertisement.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode, which can take one of the following options:
             * - ALL_SUBNETS: Advertises all available subnets, including peer VPC subnets.
             * - ALL_VPC_SUBNETS: Advertises the router's own VPC subnets. Note that this field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These groups are advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These IP ranges are advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.beta.RouterAdvertisedIpRange>[]>;
            /**
             * The priority of routes advertised to this BGP peer. Where there is more than one matching route of maximum length, the routes with the lowest priority value win.
             */
            advertisedRoutePriority?: pulumi.Input<number>;
            /**
             * BFD configuration for the BGP peering.
             * Not currently available publicly.
             */
            bfd?: pulumi.Input<inputs.compute.beta.RouterBgpPeerBfd>;
            /**
             * The status of the BGP peer connection.
             * Not currently available publicly.
             * If set to FALSE, any active session with the peer is terminated and all associated routing information is removed. If set to TRUE, the peer connection can be established with routing information. The default is TRUE.
             */
            enable?: pulumi.Input<string>;
            /**
             * Name of the interface the BGP peer is associated with.
             */
            interfaceName?: pulumi.Input<string>;
            /**
             * IP address of the interface inside Google Cloud Platform. Only IPv4 is supported.
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this BGP peer.
             * - MANAGED_BY_USER is the default value and can be managed by you or other users
             * - MANAGED_BY_ATTACHMENT is a BGP peer that is configured and managed by Cloud Interconnect, specifically by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of BGP peer when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this BGP peer. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * Peer BGP Autonomous System Number (ASN). Each BGP interface may use a different value.
             */
            peerAsn?: pulumi.Input<number>;
            /**
             * IP address of the BGP interface outside Google Cloud Platform. Only IPv4 is supported.
             */
            peerIpAddress?: pulumi.Input<string>;
            /**
             * URI of the VM instance that is used as third-party router appliances such as Next Gen Firewalls, Virtual Routers, or Router Appliances. The VM instance must be located in zones contained in the same region as this Cloud Router. The VM instance is the peer side of the BGP session.
             */
            routerApplianceInstance?: pulumi.Input<string>;
        }
        interface RouterBgpPeerBfd {
            /**
             * The minimum interval, in milliseconds, between BFD control packets received from the peer router. The actual value is negotiated between the two routers and is equal to the greater of this value and the transmit interval of the other router.
             * Not currently available publicly.
             * If set, this value must be between 100 and 30000.
             * The default is 300.
             */
            minReceiveInterval?: pulumi.Input<number>;
            /**
             * The minimum interval, in milliseconds, between BFD control packets transmitted to the peer router. The actual value is negotiated between the two routers and is equal to the greater of this value and the corresponding receive interval of the other router.
             * Not currently available publicly.
             * If set, this value must be between 100 and 30000.
             * The default is 300.
             */
            minTransmitInterval?: pulumi.Input<number>;
            /**
             * The number of consecutive BFD packets that must be missed before BFD declares that a peer is unavailable.
             * Not currently available publicly.
             * If set, the value must be a value between 2 and 16.
             * The default is 3.
             */
            multiplier?: pulumi.Input<number>;
            /**
             * The BFD session initialization mode for this BGP peer.
             * Not currently available publicly.
             * If set to ACTIVE, the Cloud Router will initiate the BFD session for this BGP peer. If set to PASSIVE, the Cloud Router will wait for the peer router to initiate the BFD session for this BGP peer. If set to DISABLED, BFD is disabled for this BGP peer. The default is PASSIVE.
             */
            sessionInitializationMode?: pulumi.Input<string>;
        }
        interface RouterInterface {
            /**
             * IP address and range of the interface. The IP range must be in the RFC3927 link-local IP address space. The value must be a CIDR-formatted string, for example: 169.254.0.1/30. NOTE: Do not truncate the address as it represents the IP address of the interface.
             */
            ipRange?: pulumi.Input<string>;
            /**
             * URI of the linked Interconnect attachment. It must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedInterconnectAttachment?: pulumi.Input<string>;
            /**
             * URI of the linked VPN tunnel, which must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedVpnTunnel?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this interface.
             * - MANAGED_BY_USER is the default value and can be managed directly by users.
             * - MANAGED_BY_ATTACHMENT is an interface that is configured and managed by Cloud Interconnect, specifically, by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of interface when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this interface entry. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * The regional private internal IP address that is used to establish BGP sessions to a VM instance acting as a third-party Router Appliance, such as a Next Gen Firewall, a Virtual Router, or an SD-WAN VM.
             */
            privateIpAddress?: pulumi.Input<string>;
            /**
             * Name of the interface that will be redundant with the current interface you are creating. The redundantInterface must belong to the same Cloud Router as the interface here. To establish the BGP session to a Router Appliance VM, you must create two BGP peers. The two BGP peers must be attached to two separate interfaces that are redundant with each other. The redundant_interface must be 1-63 characters long, and comply with RFC1035. Specifically, the redundant_interface must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            redundantInterface?: pulumi.Input<string>;
            /**
             * The URL of the subnetwork resource that this interface belongs to, which must be in the same region as the Cloud Router. When you establish a BGP session to a VM instance using this interface, the VM instance must belong to the same subnetwork as the subnetwork specified here.
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * Represents a Nat resource. It enables the VMs within the specified subnetworks to access Internet without external IP addresses. It specifies a list of subnetworks (and the ranges within) that want to use NAT. Customers can also provide the external IPs that would be used for NAT. GCP would auto-allocate ephemeral IPs if no external IPs are provided.
         */
        interface RouterNat {
            /**
             * A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT only.
             */
            drainNatIps?: pulumi.Input<pulumi.Input<string>[]>;
            enableEndpointIndependentMapping?: pulumi.Input<boolean>;
            /**
             * Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.
             */
            icmpIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Configure logging on this NAT.
             */
            logConfig?: pulumi.Input<inputs.compute.beta.RouterNatLogConfig>;
            /**
             * Minimum number of ports allocated to a VM from this NAT config. If not set, a default number of ports is allocated to a VM. This is rounded up to the nearest power of 2. For example, if the value of this field is 50, at least 64 ports are allocated to a VM.
             */
            minPortsPerVm?: pulumi.Input<number>;
            /**
             * Unique name of this Nat service. The name must be 1-63 characters long and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * Specify the NatIpAllocateOption, which can take one of the following values:
             * - MANUAL_ONLY: Uses only Nat IP addresses provided by customers. When there are not enough specified Nat IPs, the Nat service fails for new VMs.
             * - AUTO_ONLY: Nat IPs are allocated by Google Cloud Platform; customers can't specify any Nat IPs. When choosing AUTO_ONLY, then nat_ip should be empty.
             */
            natIpAllocateOption?: pulumi.Input<string>;
            /**
             * A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
             */
            natIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specify the Nat option, which can take one of the following values:
             * - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat.
             * - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat.
             * - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
             */
            sourceSubnetworkIpRangesToNat?: pulumi.Input<string>;
            /**
             * A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.beta.RouterNatSubnetworkToNat>[]>;
            /**
             * Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
             */
            tcpEstablishedIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
             */
            tcpTransitoryIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
             */
            udpIdleTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * Configuration of logging on a NAT.
         */
        interface RouterNatLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Specify the desired filtering of logs on this NAT. If unspecified, logs are exported for all connections handled by this NAT. This option can take one of the following values:
             * - ERRORS_ONLY: Export logs only for connection failures.
             * - TRANSLATIONS_ONLY: Export logs only for successful connections.
             * - ALL: Export logs for all connections, successful and unsuccessful.
             */
            filter?: pulumi.Input<string>;
        }
        /**
         * Defines the IP ranges that want to use NAT for a subnetwork.
         */
        interface RouterNatSubnetworkToNat {
            /**
             * URL for the subnetwork resource that will use NAT.
             */
            name?: pulumi.Input<string>;
            /**
             * A list of the secondary ranges of the Subnetwork that are allowed to use NAT. This can be populated only if "LIST_OF_SECONDARY_IP_RANGES" is one of the values in source_ip_ranges_to_nat.
             */
            secondaryIpRangeNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specify the options for NAT ranges in the Subnetwork. All options of a single value are valid except NAT_IP_RANGE_OPTION_UNSPECIFIED. The only valid option with multiple values is: ["PRIMARY_IP_RANGE", "LIST_OF_SECONDARY_IP_RANGES"] Default: [ALL_IP_RANGES]
             */
            sourceIpRangesToNat?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A rule to be applied in a Policy.
         */
        interface Rule {
            /**
             * Required
             */
            action?: pulumi.Input<string>;
            /**
             * Additional restrictions that must be met. All conditions must pass for the rule to match.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.compute.beta.Condition>[]>;
            /**
             * Human-readable description of the rule.
             */
            description?: pulumi.Input<string>;
            /**
             * If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
             */
            ins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
             */
            logConfigs?: pulumi.Input<pulumi.Input<inputs.compute.beta.LogConfig>[]>;
            /**
             * If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
             */
            notIns?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
             */
            permissions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SSLHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, SSL health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the SSL connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * An instance-attached disk resource.
         */
        interface SavedAttachedDisk {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             */
            boot?: pulumi.Input<boolean>;
            /**
             * Specifies the name of the disk attached to the source instance.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * The encryption key for the disk.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.beta.CustomerEncryptionKey>;
            /**
             * The size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * [Output Only] URL of the disk type resource. For example: projects/project/zones/zone/diskTypes/pd-standard or pd-ssd
             */
            diskType?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.beta.GuestOsFeature>[]>;
            /**
             * Specifies zero-based index of the disk that is attached to the source instance.
             */
            index?: pulumi.Input<number>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME.
             */
            interface?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#attachedDisk for attached disks.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Any valid publicly visible licenses.
             */
            licenses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The mode in which this disk is attached to the source instance, either READ_WRITE or READ_ONLY.
             */
            mode?: pulumi.Input<string>;
            /**
             * Specifies a URL of the disk attached to the source instance.
             */
            source?: pulumi.Input<string>;
            /**
             * [Output Only] A size of the storage used by the disk's snapshot by this machine image.
             */
            storageBytes?: pulumi.Input<string>;
            /**
             * [Output Only] An indicator whether storageBytes is in a stable state or it is being adjusted as a result of shared storage reallocation. This status can either be UPDATING, meaning the size of the snapshot is being updated, or UP_TO_DATE, meaning the size of the snapshot is up-to-date.
             */
            storageBytesStatus?: pulumi.Input<string>;
            /**
             * Specifies the type of the attached disk, either SCRATCH or PERSISTENT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Sets the scheduling options for an Instance. NextID: 20
         */
        interface Scheduling {
            /**
             * Specifies whether the instance should be automatically restarted if it is terminated by Compute Engine (not terminated by a user). You can only set the automatic restart option for standard instances. Preemptible instances cannot be automatically restarted.
             *
             * By default, this is set to true so an instance is automatically restarted if it is terminated by Compute Engine.
             */
            automaticRestart?: pulumi.Input<boolean>;
            /**
             * An opaque location hint used to place the instance close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node.
             */
            minNodeCpus?: pulumi.Input<number>;
            /**
             * A set of node affinity and anti-affinity configurations. Refer to Configuring node affinity for more information. Overrides reservationAffinity.
             */
            nodeAffinities?: pulumi.Input<pulumi.Input<inputs.compute.beta.SchedulingNodeAffinity>[]>;
            /**
             * Defines the maintenance behavior for this instance. For standard instances, the default behavior is MIGRATE. For preemptible instances, the default and only possible behavior is TERMINATE. For more information, see Setting Instance Scheduling Options.
             */
            onHostMaintenance?: pulumi.Input<string>;
            /**
             * Defines whether the instance is preemptible. This can only be set during instance creation or while the instance is stopped and therefore, in a `TERMINATED` state. See Instance Life Cycle for more information on the possible instance states.
             */
            preemptible?: pulumi.Input<boolean>;
        }
        /**
         * Node Affinity: the configuration of desired nodes onto which this Instance could be scheduled.
         */
        interface SchedulingNodeAffinity {
            /**
             * Corresponds to the label key of Node resource.
             */
            key?: pulumi.Input<string>;
            /**
             * Defines the operation of node selection. Valid operators are IN for affinity and NOT_IN for anti-affinity.
             */
            operator?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of Node resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Configuration options for Cloud Armor Adaptive Protection (CAAP).
         */
        interface SecurityPolicyAdaptiveProtectionConfig {
            /**
             * If set to true, enables Cloud Armor Machine Learning.
             */
            layer7DdosDefenseConfig?: pulumi.Input<inputs.compute.beta.SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfig>;
        }
        /**
         * Configuration options for L7 DDoS detection.
         */
        interface SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfig {
            /**
             * If set to true, enables CAAP for L7 DDoS detection.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Rule visibility can be one of the following: STANDARD - opaque rules. (default) PREMIUM - transparent rules.
             */
            ruleVisibility?: pulumi.Input<string>;
        }
        interface SecurityPolicyAssociation {
            /**
             * The resource that the security policy is attached to.
             */
            attachmentId?: pulumi.Input<string>;
            /**
             * [Output Only] The display name of the security policy of the association.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The name for an association.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The security policy ID of the association.
             */
            securityPolicyId?: pulumi.Input<string>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface SecurityPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The direction in which this rule applies. This field may only be specified when versioned_expr is set to FIREWALL.
             */
            direction?: pulumi.Input<string>;
            /**
             * Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
             *
             * This field may only be specified when the versioned_expr is set to FIREWALL.
             */
            enableLogging?: pulumi.Input<boolean>;
            /**
             * [Output only] Type of the resource. Always compute#securityPolicyRule for security policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.beta.SecurityPolicyRuleMatcher>;
            /**
             * If set to true, the specified action is not enforced.
             */
            preview?: pulumi.Input<boolean>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
             */
            priority?: pulumi.Input<number>;
            /**
             * Identifier for the rule. This is only unique within the given security policy. This can only be set during rule creation, if rule number is not specified it will be generated by the server.
             */
            ruleNumber?: pulumi.Input<string>;
            /**
             * [Output Only] Calculation of the complexity of a single firewall security policy rule.
             */
            ruleTupleCount?: pulumi.Input<number>;
            /**
             * A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            targetResources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of service accounts indicating the sets of instances that are applied with this rule.
             */
            targetServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface SecurityPolicyRuleMatcher {
            /**
             * The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified.
             */
            config?: pulumi.Input<inputs.compute.beta.SecurityPolicyRuleMatcherConfig>;
            /**
             * User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
             */
            expr?: pulumi.Input<inputs.compute.beta.Expr>;
            /**
             * Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding src_ip_range field in config.
             */
            versionedExpr?: pulumi.Input<string>;
        }
        interface SecurityPolicyRuleMatcherConfig {
            /**
             * CIDR IP address range.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            destIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            layer4Configs?: pulumi.Input<pulumi.Input<inputs.compute.beta.SecurityPolicyRuleMatcherConfigLayer4Config>[]>;
            /**
             * CIDR IP address range. Maximum number of src_ip_ranges allowed is 10.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SecurityPolicyRuleMatcherConfigLayer4Config {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             *
             * This field may only be specified when versioned_expr is set to FIREWALL.
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The authentication and authorization settings for a BackendService.
         */
        interface SecuritySettings {
            /**
             * [Deprecated] Use clientTlsPolicy instead.
             */
            authentication?: pulumi.Input<string>;
            /**
             * Optional. A URL referring to a networksecurity.ClientTlsPolicy resource that describes how clients should authenticate with this service's backends.
             * clientTlsPolicy only applies to a global BackendService with the loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * If left blank, communications are not encrypted.
             * Note: This field currently has no impact.
             */
            clientTlsPolicy?: pulumi.Input<string>;
            /**
             * Optional. A list of Subject Alternative Names (SANs) that the client verifies during a mutual TLS handshake with an server/endpoint for this BackendService. When the server presents its X.509 certificate to the client, the client inspects the certificate's subjectAltName field. If the field contains one of the specified values, the communication continues. Otherwise, it fails. This additional check enables the client to verify that the server is authorized to run the requested service.
             * Note that the contents of the server certificate's subjectAltName field are configured by the Public Key Infrastructure which provisions server identities.
             * Only applies to a global BackendService with loadBalancingScheme set to INTERNAL_SELF_MANAGED. Only applies when BackendService has an attached clientTlsPolicy with clientCertificate (mTLS mode).
             * Note: This field currently has no impact.
             */
            subjectAltNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface ServerBinding {
            type?: pulumi.Input<string>;
        }
        /**
         * A service account.
         */
        interface ServiceAccount {
            /**
             * Email address of the service account.
             */
            email?: pulumi.Input<string>;
            /**
             * The list of scopes to be made available for this service account.
             */
            scopes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * [Output Only] A consumer forwarding rule connected to this service attachment.
         */
        interface ServiceAttachmentConsumerForwardingRule {
            /**
             * The url of a consumer forwarding rule.
             */
            forwardingRule?: pulumi.Input<string>;
            /**
             * The status of the forwarding rule.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enabled by default.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Disabled by default.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled. Enabled by default.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The policy describes the baseline against which Instance boot integrity is measured.
         */
        interface ShieldedInstanceIntegrityPolicy {
            /**
             * Updates the integrity policy baseline using the measurements from the VM instance's most recent boot.
             */
            updateAutoLearnPolicy?: pulumi.Input<boolean>;
        }
        /**
         * A set of Shielded VM options.
         */
        interface ShieldedVmConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The policy describes the baseline against which VM instance boot integrity is measured.
         */
        interface ShieldedVmIntegrityPolicy {
            /**
             * Updates the integrity policy baseline using the measurements from the VM instance's most recent boot.
             */
            updateAutoLearnPolicy?: pulumi.Input<boolean>;
        }
        interface SourceDiskEncryptionKey {
            /**
             * The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.beta.CustomerEncryptionKey>;
            /**
             * URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values:
             * - https://www.googleapis.com/compute/v1/projects/project/zones/zone/disks/disk
             * - projects/project/zones/zone/disks/disk
             * - zones/zone/disks/disk
             */
            sourceDisk?: pulumi.Input<string>;
        }
        /**
         * A specification of the parameters to use when creating the instance template from a source instance.
         */
        interface SourceInstanceParams {
            /**
             * Attached disks configuration. If not provided, defaults are applied: For boot disk and any other R/W disks, new custom images will be created from each disk. For read-only disks, they will be attached in read-only mode. Local SSD disks will be created as blank volumes.
             */
            diskConfigs?: pulumi.Input<pulumi.Input<inputs.compute.beta.DiskInstantiationConfig>[]>;
        }
        interface SourceInstanceProperties {
            /**
             * Enables instances created based on this machine image to send packets with source IP addresses other than their own and receive packets with destination IP addresses other than their own. If these instances will be used as an IP gateway or it will be set as the next-hop in a Route resource, specify true. If unsure, leave this set to false. See the Enable IP forwarding documentation for more information.
             */
            canIpForward?: pulumi.Input<boolean>;
            /**
             * Whether the instance created from this machine image should be protected against deletion.
             */
            deletionProtection?: pulumi.Input<boolean>;
            /**
             * An optional text description for the instances that are created from this machine image.
             */
            description?: pulumi.Input<string>;
            /**
             * An array of disks that are associated with the instances that are created from this machine image.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.compute.beta.SavedAttachedDisk>[]>;
            /**
             * A list of guest accelerator cards' type and count to use for instances created from this machine image.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.beta.AcceleratorConfig>[]>;
            /**
             * Labels to apply to instances that are created from this machine image.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The machine type to use for instances that are created from this machine image.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs to assign to instances that are created from this machine image. These pairs can consist of custom metadata or predefined keys. See Project and instance metadata for more information.
             */
            metadata?: pulumi.Input<inputs.compute.beta.Metadata>;
            /**
             * Minimum cpu/platform to be used by instances created from this machine image. The instance may be scheduled on the specified or newer cpu/platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: "Intel Haswell" or minCpuPlatform: "Intel Sandy Bridge". For more information, read Specifying a Minimum CPU Platform.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * An array of network access configurations for this interface.
             */
            networkInterfaces?: pulumi.Input<pulumi.Input<inputs.compute.beta.NetworkInterface>[]>;
            /**
             * PostKeyRevocationActionType of the instance.
             */
            postKeyRevocationActionType?: pulumi.Input<string>;
            /**
             * Specifies the scheduling options for the instances that are created from this machine image.
             */
            scheduling?: pulumi.Input<inputs.compute.beta.Scheduling>;
            /**
             * A list of service accounts with specified scopes. Access tokens for these service accounts are available to the instances that are created from this machine image. Use metadata queries to obtain the access tokens for these instances.
             */
            serviceAccounts?: pulumi.Input<pulumi.Input<inputs.compute.beta.ServiceAccount>[]>;
            /**
             * A list of tags to apply to the instances that are created from this machine image. The tags identify valid sources or targets for network firewalls. The setTags method can modify this list of tags. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<inputs.compute.beta.Tags>;
        }
        /**
         * Configuration and status of a managed SSL certificate.
         */
        interface SslCertificateManagedSslCertificate {
            /**
             * [Output only] Detailed statuses of the domains specified for managed certificate resource.
             */
            domainStatus?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The domains for which a managed SSL certificate will be generated. Each Google-managed SSL certificate supports up to the [maximum number of domains per Google-managed SSL certificate](/load-balancing/docs/quotas#ssl_certificates).
             */
            domains?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Output only] Status of the managed certificate resource.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Configuration and status of a self-managed SSL certificate.
         */
        interface SslCertificateSelfManagedSslCertificate {
            /**
             * A local certificate file. The certificate must be in PEM format. The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert.
             */
            certificate?: pulumi.Input<string>;
            /**
             * A write-only private key in PEM format. Only insert requests will include this field.
             */
            privateKey?: pulumi.Input<string>;
        }
        interface StatefulPolicy {
            preservedState?: pulumi.Input<inputs.compute.beta.StatefulPolicyPreservedState>;
        }
        /**
         * Configuration of preserved resources.
         */
        interface StatefulPolicyPreservedState {
            /**
             * Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
             */
            disks?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * The available logging options for this subnetwork.
         */
        interface SubnetworkLogConfig {
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Default is an interval of 5 seconds per connection.
             */
            aggregationInterval?: pulumi.Input<string>;
            /**
             * Whether to enable flow logging for this subnetwork. If this field is not explicitly set, it will not appear in get listings. If not set the default behavior is to disable flow logging.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Export filter used to define which VPC flow logs should be logged.
             */
            filterExpr?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. The value of the field must be in [0, 1]. Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. Default is 0.5, which means half of all collected logs are reported.
             */
            flowSampling?: pulumi.Input<number>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Configures whether all, none or a subset of metadata fields should be added to the reported VPC flow logs. Default is EXCLUDE_ALL_METADATA.
             */
            metadata?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" was set to CUSTOM_METADATA.
             */
            metadataFields?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a secondary IP range of a subnetwork.
         */
        interface SubnetworkSecondaryRange {
            /**
             * The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported. The range can be any range listed in the Valid ranges list.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.
             */
            rangeName?: pulumi.Input<string>;
        }
        /**
         * Subsetting options to make L4 ILB support any number of backend instances
         */
        interface Subsetting {
            policy?: pulumi.Input<string>;
        }
        interface TCPHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, TCP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the TCP connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * A set of instance tags.
         */
        interface Tags {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the tags' contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update tags. You must always provide an up-to-date fingerprint hash in order to update or change tags.
             *
             * To see the latest fingerprint, make get() request to the instance.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * An array of tags. Each tag must be 1-63 characters long, and comply with RFC1035.
             */
            items?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Message for the expected URL mappings.
         */
        interface UrlMapTest {
            /**
             * Description of this test case.
             */
            description?: pulumi.Input<string>;
            /**
             * The expected output URL evaluated by load balancer containing the scheme, host, path and query parameters.
             * For rules that forward requests to backends, the test passes only when expectedOutputUrl matches the request forwarded by load balancer to backends. For rules with urlRewrite, the test verifies that the forwarded request matches hostRewrite and pathPrefixRewrite in the urlRewrite action. When service is specified, expectedOutputUrl`s scheme is ignored.
             * For rules with urlRedirect, the test passes only if expectedOutputUrl matches the URL in the load balancer's redirect response. If urlRedirect specifies https_redirect, the test passes only if the scheme in expectedOutputUrl is also set to https. If urlRedirect specifies strip_query, the test passes only if expectedOutputUrl does not contain any query parameters.
             * expectedOutputUrl is optional when service is specified.
             */
            expectedOutputUrl?: pulumi.Input<string>;
            /**
             * For rules with urlRedirect, the test passes only if expectedRedirectResponseCode matches the HTTP status code in load balancer's redirect response.
             * expectedRedirectResponseCode cannot be set when service is set.
             */
            expectedRedirectResponseCode?: pulumi.Input<number>;
            /**
             * HTTP headers for this request. If headers contains a host header, then host must also match the header value.
             */
            headers?: pulumi.Input<pulumi.Input<inputs.compute.beta.UrlMapTestHeader>[]>;
            /**
             * Host portion of the URL. If headers contains a host header, then host must also match the header value.
             */
            host?: pulumi.Input<string>;
            /**
             * Path portion of the URL.
             */
            path?: pulumi.Input<string>;
            /**
             * Expected BackendService or BackendBucket resource the given URL should be mapped to.
             * service cannot be set if expectedRedirectResponseCode is set.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * HTTP headers used in UrlMapTests.
         */
        interface UrlMapTestHeader {
            /**
             * Header name.
             */
            name?: pulumi.Input<string>;
            /**
             * Header value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The spec for modifying the path before sending the request to the matched backend service.
         */
        interface UrlRewrite {
            /**
             * Prior to forwarding the request to the selected service, the request's host header is replaced with contents of hostRewrite.
             * The value must be between 1 and 255 characters.
             */
            hostRewrite?: pulumi.Input<string>;
            /**
             * Prior to forwarding the request to the selected backend service, the matching portion of the request's path is replaced by pathPrefixRewrite.
             * The value must be between 1 and 1024 characters.
             */
            pathPrefixRewrite?: pulumi.Input<string>;
        }
        /**
         * A VPN gateway interface.
         */
        interface VpnGatewayVpnGatewayInterface {
            /**
             * The numeric ID of this VPN gateway interface.
             */
            id?: pulumi.Input<number>;
            /**
             * URL of the interconnect attachment resource. When the value of this field is present, the VPN Gateway will be used for IPsec-encrypted Cloud Interconnect; all Egress or Ingress traffic for this VPN Gateway interface will go through the specified interconnect attachment resource.
             * Not currently available in all Interconnect locations.
             */
            interconnectAttachment?: pulumi.Input<string>;
            /**
             * [Output Only] The external IP address for this VPN gateway interface.
             */
            ipAddress?: pulumi.Input<string>;
        }
        /**
         * In contrast to a single BackendService in  HttpRouteAction to which all matching traffic is directed to, WeightedBackendService allows traffic to be split across multiple BackendServices. The volume of traffic for each BackendService is proportional to the weight specified in each WeightedBackendService
         */
        interface WeightedBackendService {
            /**
             * The full or partial URL to the default BackendService resource. Before forwarding the request to backendService, the loadbalancer applies any relevant headerActions specified as part of this backendServiceWeight.
             */
            backendService?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * headerAction specified here take effect before headerAction in the enclosing HttpRouteRule, PathMatcher and UrlMap.
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.beta.HttpHeaderAction>;
            /**
             * Specifies the fraction of traffic sent to backendService, computed as weight / (sum of all weightedBackendService weights in routeAction) .
             * The selection of a backend service is determined only for new traffic. Once a user's request has been directed to a backendService, subsequent requests will be sent to the same backendService as determined by the BackendService's session affinity policy.
             * The value must be between 0 and 1000
             */
            weight?: pulumi.Input<number>;
        }
    }
    namespace v1 {
        /**
         * A specification of the type and number of accelerator cards attached to the instance.
         */
        interface AcceleratorConfig {
            /**
             * The number of the guest accelerator cards exposed to this instance.
             */
            acceleratorCount?: pulumi.Input<number>;
            /**
             * Full or partial URL of the accelerator type resource to attach to this instance. For example: projects/my-project/zones/us-central1-c/acceleratorTypes/nvidia-tesla-p100 If you are creating an instance template, specify only the accelerator name. See GPUs on Compute Engine for a full list of accelerator types.
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * An access configuration attached to an instance's network interface. Only one access config per instance is supported.
         */
        interface AccessConfig {
            /**
             * [Output Only] Type of the resource. Always compute#accessConfig for access configs.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of this access configuration. The default and recommended name is External NAT, but you can use any arbitrary string, such as My external IP or Network Access.
             */
            name?: pulumi.Input<string>;
            /**
             * An external IP address associated with this instance. Specify an unused static external IP address available to the project or leave this field undefined to use an IP from a shared ephemeral IP address pool. If you specify a static external IP address, it must live in the same region as the zone of the instance.
             */
            natIP?: pulumi.Input<string>;
            /**
             * This signifies the networking tier used for configuring this access configuration and can only take the following values: PREMIUM, STANDARD.
             *
             * If an AccessConfig is specified without a valid external IP address, an ephemeral IP will be created with this networkTier.
             *
             * If an AccessConfig with a valid external IP address is specified, it must match that of the networkTier associated with the Address resource owning that IP.
             */
            networkTier?: pulumi.Input<string>;
            /**
             * The DNS domain name for the public PTR record. You can set this field only if the `setPublicPtr` field is enabled.
             */
            publicPtrDomainName?: pulumi.Input<string>;
            /**
             * Specifies whether a public DNS 'PTR' record should be created to map the external IP address of the instance to a DNS domain name.
             */
            setPublicPtr?: pulumi.Input<boolean>;
            /**
             * The type of configuration. The default and only option is ONE_TO_ONE_NAT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled).
         */
        interface AdvancedMachineFeatures {
            /**
             * Whether to enable nested virtualization or not (default is false).
             */
            enableNestedVirtualization?: pulumi.Input<boolean>;
        }
        /**
         * An alias IP range attached to an instance's network interface.
         */
        interface AliasIpRange {
            /**
             * The IP alias ranges to allocate for this interface. This IP CIDR range must belong to the specified subnetwork and cannot contain IP addresses reserved by system or used by other network interfaces. This range may be a single IP address (such as 10.2.3.4), a netmask (such as /24) or a CIDR-formatted string (such as 10.1.2.0/24).
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name of a subnetwork secondary IP range from which to allocate an IP alias range. If not specified, the primary range of the subnetwork is used.
             */
            subnetworkRangeName?: pulumi.Input<string>;
        }
        interface AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk {
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
        }
        /**
         * Properties of the SKU instances being reserved. Next ID: 9
         */
        interface AllocationSpecificSKUAllocationReservedInstanceProperties {
            /**
             * Specifies accelerator type and count.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.v1.AcceleratorConfig>[]>;
            /**
             * Specifies amount of local ssd to reserve with each instance. The type of disk is local-ssd.
             */
            localSsds?: pulumi.Input<pulumi.Input<inputs.compute.v1.AllocationSpecificSKUAllocationAllocatedInstancePropertiesReservedDisk>[]>;
            /**
             * An opaque location hint used to place the allocation close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * Specifies type of machine (name only) which has fixed number of vCPUs and fixed amount of memory. This also includes specifying custom machine type following custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY pattern.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Minimum cpu platform the reservation.
             */
            minCpuPlatform?: pulumi.Input<string>;
        }
        /**
         * This reservation type allows to pre allocate specific instance configuration.
         */
        interface AllocationSpecificSKUReservation {
            /**
             * Specifies the number of resources that are allocated.
             */
            count?: pulumi.Input<string>;
            /**
             * [Output Only] Indicates how many instances are in use.
             */
            inUseCount?: pulumi.Input<string>;
            /**
             * The instance properties for the reservation.
             */
            instanceProperties?: pulumi.Input<inputs.compute.v1.AllocationSpecificSKUAllocationReservedInstanceProperties>;
        }
        /**
         * An instance-attached disk resource.
         */
        interface AttachedDisk {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             */
            boot?: pulumi.Input<boolean>;
            /**
             * Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance.
             *
             * If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Encrypts or decrypts a disk using a customer-supplied encryption key.
             *
             * If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key.
             *
             * If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance.
             *
             * If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
             */
            diskEncryptionKey?: pulumi.Input<inputs.compute.v1.CustomerEncryptionKey>;
            /**
             * The size of the disk in GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * A list of features to enable on the guest operating system. Applicable only for bootable images. Read  Enabling guest operating system features to see a list of available options.
             */
            guestOsFeatures?: pulumi.Input<pulumi.Input<inputs.compute.v1.GuestOsFeature>[]>;
            /**
             * [Output Only] A zero-based index to this disk, where 0 is reserved for the boot disk. If you have many disks attached to an instance, each disk would have a unique index number.
             */
            index?: pulumi.Input<number>;
            /**
             * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
             *
             * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
             */
            initializeParams?: pulumi.Input<inputs.compute.v1.AttachedDiskInitializeParams>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. Persistent disks must always use SCSI and the request will fail if you attempt to attach a persistent disk in any other format than SCSI. Local SSDs can use either NVME or SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance.
             */
            interface?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#attachedDisk for attached disks.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Any valid publicly visible licenses.
             */
            licenses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If not specified, the default is to attach the disk in READ_WRITE mode.
             */
            mode?: pulumi.Input<string>;
            /**
             * [Output Only] shielded vm initial state stored on disk
             */
            shieldedInstanceInitialState?: pulumi.Input<inputs.compute.v1.InitialStateConfig>;
            /**
             * Specifies a valid partial or full URL to an existing Persistent Disk resource. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * If desired, you can also attach existing non-root persistent disks using this property. This field is only applicable for persistent disks.
             *
             * Note that for InstanceTemplate, specify the disk name, not the URL for the disk.
             */
            source?: pulumi.Input<string>;
            /**
             * Specifies the type of the disk, either SCRATCH or PERSISTENT. If not specified, the default is PERSISTENT.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.
         *
         * This property is mutually exclusive with the source property; you can only define one or the other, but not both.
         */
        interface AttachedDiskInitializeParams {
            /**
             * An optional description. Provide this property when creating the disk.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies the disk name. If not specified, the default is to use the name of the instance. If a disk with the same name already exists in the given region, the existing disk is attached to the new instance and the new disk is not created.
             */
            diskName?: pulumi.Input<string>;
            /**
             * Specifies the size of the disk in base-2 GB. The size must be at least 10 GB. If you specify a sourceImage, which is required for boot disks, the default size is the size of the sourceImage. If you do not specify a sourceImage, the default disk size is 500 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Specifies the disk type to use to create the instance. If not specified, the default is pd-standard, specified using the full URL. For example:
             * https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/pd-standard
             *
             *
             * Other values include pd-ssd and local-ssd. If you define this field, you can provide either the full or partial URL. For example, the following are valid values:
             * - https://www.googleapis.com/compute/v1/projects/project/zones/zone/diskTypes/diskType
             * - projects/project/zones/zone/diskTypes/diskType
             * - zones/zone/diskTypes/diskType  Note that for InstanceTemplate, this is the name of the disk type, not URL.
             */
            diskType?: pulumi.Input<string>;
            /**
             * Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Specifies which action to take on instance update with this disk. Default is to use the existing disk.
             */
            onUpdateAction?: pulumi.Input<string>;
            /**
             * Indicates how many IOPS must be provisioned for the disk.
             */
            provisionedIops?: pulumi.Input<string>;
            /**
             * Resource policies applied to this disk for automatic snapshot creations. Specified using the full or partial URL. For instance template, specify only the resource policy name.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD.
             *
             * To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image:
             * projects/debian-cloud/global/images/family/debian-9
             *
             *
             * Alternatively, use a specific version of a public operating system image:
             * projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD
             *
             *
             * To create a disk with a custom image that you created, specify the image name in the following format:
             * global/images/my-custom-image
             *
             *
             * You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name:
             * global/images/family/my-image-family
             *
             *
             * If the source image is deleted later, this field will not be set.
             */
            sourceImage?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
             *
             * Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
             */
            sourceImageEncryptionKey?: pulumi.Input<inputs.compute.v1.CustomerEncryptionKey>;
            /**
             * The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD.
             *
             * To create a disk with a snapshot that you created, specify the snapshot name in the following format:
             * global/snapshots/my-backup
             *
             *
             * If the source snapshot is deleted later, this field will not be set.
             */
            sourceSnapshot?: pulumi.Input<string>;
            /**
             * The customer-supplied encryption key of the source snapshot.
             */
            sourceSnapshotEncryptionKey?: pulumi.Input<inputs.compute.v1.CustomerEncryptionKey>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.
         *
         * If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.
         *
         * Example Policy with multiple AuditConfigs:
         *
         * { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] }
         *
         * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.compute.v1.AuditLogConfig>[]>;
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example:
         *
         * { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] }
         *
         * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of [Binding.members][].
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            ignoreChildExemptions?: pulumi.Input<boolean>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authorization-related information used by Cloud Audit Logging.
         */
        interface AuthorizationLoggingOptions {
            /**
             * The type of the permission that was checked.
             */
            permissionType?: pulumi.Input<string>;
        }
        interface AutoscalerStatusDetails {
            /**
             * The status message.
             */
            message?: pulumi.Input<string>;
            /**
             * The type of error, warning, or notice returned. Current set of possible values:
             * - ALL_INSTANCES_UNHEALTHY (WARNING): All instances in the instance group are unhealthy (not in RUNNING state).
             * - BACKEND_SERVICE_DOES_NOT_EXIST (ERROR): There is no backend service attached to the instance group.
             * - CAPPED_AT_MAX_NUM_REPLICAS (WARNING): Autoscaler recommends a size greater than maxNumReplicas.
             * - CUSTOM_METRIC_DATA_POINTS_TOO_SPARSE (WARNING): The custom metric samples are not exported often enough to be a credible base for autoscaling.
             * - CUSTOM_METRIC_INVALID (ERROR): The custom metric that was specified does not exist or does not have the necessary labels.
             * - MIN_EQUALS_MAX (WARNING): The minNumReplicas is equal to maxNumReplicas. This means the autoscaler cannot add or remove instances from the instance group.
             * - MISSING_CUSTOM_METRIC_DATA_POINTS (WARNING): The autoscaler did not receive any data from the custom metric configured for autoscaling.
             * - MISSING_LOAD_BALANCING_DATA_POINTS (WARNING): The autoscaler is configured to scale based on a load balancing signal but the instance group has not received any requests from the load balancer.
             * - MODE_OFF (WARNING): Autoscaling is turned off. The number of instances in the group won't change automatically. The autoscaling configuration is preserved.
             * - MODE_ONLY_UP (WARNING): Autoscaling is in the "Autoscale only out" mode. The autoscaler can add instances but not remove any.
             * - MORE_THAN_ONE_BACKEND_SERVICE (ERROR): The instance group cannot be autoscaled because it has more than one backend service attached to it.
             * - NOT_ENOUGH_QUOTA_AVAILABLE (ERROR): There is insufficient quota for the necessary resources, such as CPU or number of instances.
             * - REGION_RESOURCE_STOCKOUT (ERROR): Shown only for regional autoscalers: there is a resource stockout in the chosen region.
             * - SCALING_TARGET_DOES_NOT_EXIST (ERROR): The target to be scaled does not exist.
             * - UNSUPPORTED_MAX_RATE_LOAD_BALANCING_CONFIGURATION (ERROR): Autoscaling does not work with an HTTP/S load balancer that has been configured for maxRate.
             * - ZONE_RESOURCE_STOCKOUT (ERROR): For zonal autoscalers: there is a resource stockout in the chosen zone. For regional autoscalers: in at least one of the zones you're using there is a resource stockout.  New values might be added in the future. Some of the values might not be available in all API versions.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Cloud Autoscaler policy.
         */
        interface AutoscalingPolicy {
            /**
             * The number of seconds that the autoscaler waits before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. The default time autoscaler waits is 60 seconds.
             *
             * Virtual machine initialization times might vary because of numerous factors. We recommend that you test how long an instance may take to initialize. To do this, create an instance and time the startup process.
             */
            coolDownPeriodSec?: pulumi.Input<number>;
            /**
             * Defines the CPU utilization policy that allows the autoscaler to scale based on the average CPU utilization of a managed instance group.
             */
            cpuUtilization?: pulumi.Input<inputs.compute.v1.AutoscalingPolicyCpuUtilization>;
            /**
             * Configuration parameters of autoscaling based on a custom metric.
             */
            customMetricUtilizations?: pulumi.Input<pulumi.Input<inputs.compute.v1.AutoscalingPolicyCustomMetricUtilization>[]>;
            /**
             * Configuration parameters of autoscaling based on load balancer.
             */
            loadBalancingUtilization?: pulumi.Input<inputs.compute.v1.AutoscalingPolicyLoadBalancingUtilization>;
            /**
             * The maximum number of instances that the autoscaler can scale out to. This is required when creating or updating an autoscaler. The maximum number of replicas must not be lower than minimal number of replicas.
             */
            maxNumReplicas?: pulumi.Input<number>;
            /**
             * The minimum number of replicas that the autoscaler can scale in to. This cannot be less than 0. If not provided, autoscaler chooses a default value depending on maximum number of instances allowed.
             */
            minNumReplicas?: pulumi.Input<number>;
            /**
             * Defines operating mode for this policy.
             */
            mode?: pulumi.Input<string>;
            scaleInControl?: pulumi.Input<inputs.compute.v1.AutoscalingPolicyScaleInControl>;
            /**
             * Scaling schedules defined for an autoscaler. Multiple schedules can be set on an autoscaler, and they can overlap. During overlapping periods the greatest min_required_replicas of all scaling schedules is applied. Up to 128 scaling schedules are allowed.
             */
            scalingSchedules?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * CPU utilization policy.
         */
        interface AutoscalingPolicyCpuUtilization {
            /**
             * Indicates whether predictive autoscaling based on CPU metric is enabled. Valid values are:
             *
             * * NONE (default). No predictive method is used. The autoscaler scales the group to meet current demand based on real-time metrics. * OPTIMIZE_AVAILABILITY. Predictive autoscaling improves availability by monitoring daily and weekly load patterns and scaling out ahead of anticipated demand.
             */
            predictiveMethod?: pulumi.Input<string>;
            /**
             * The target CPU utilization that the autoscaler maintains. Must be a float value in the range (0, 1]. If not specified, the default is 0.6.
             *
             * If the CPU level is below the target utilization, the autoscaler scales in the number of instances until it reaches the minimum number of instances you specified or until the average CPU of your instances reaches the target utilization.
             *
             * If the average CPU is above the target utilization, the autoscaler scales out until it reaches the maximum number of instances you specified or until the average utilization reaches the target utilization.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Custom utilization metric policy.
         */
        interface AutoscalingPolicyCustomMetricUtilization {
            /**
             * A filter string, compatible with a Stackdriver Monitoring filter string for TimeSeries.list API call. This filter is used to select a specific TimeSeries for the purpose of autoscaling and to determine whether the metric is exporting per-instance or per-group data.
             *
             * For the filter to be valid for autoscaling purposes, the following rules apply:
             * - You can only use the AND operator for joining selectors.
             * - You can only use direct equality comparison operator (=) without any functions for each selector.
             * - You can specify the metric in both the filter string and in the metric field. However, if specified in both places, the metric must be identical.
             * - The monitored resource type determines what kind of values are expected for the metric. If it is a gce_instance, the autoscaler expects the metric to include a separate TimeSeries for each instance in a group. In such a case, you cannot filter on resource labels.
             * If the resource type is any other value, the autoscaler expects this metric to contain values that apply to the entire autoscaled instance group and resource label filtering can be performed to point autoscaler at the correct TimeSeries to scale upon. This is called a per-group metric for the purpose of autoscaling.
             *
             * If not specified, the type defaults to gce_instance.
             *
             * Try to provide a filter that is selective enough to pick just one TimeSeries for the autoscaled group or for each of the instances (if you are using gce_instance resource type). If multiple TimeSeries are returned upon the query execution, the autoscaler will sum their respective values to obtain its scaling value.
             */
            filter?: pulumi.Input<string>;
            /**
             * The identifier (type) of the Stackdriver Monitoring metric. The metric cannot have negative values.
             *
             * The metric must have a value type of INT64 or DOUBLE.
             */
            metric?: pulumi.Input<string>;
            /**
             * If scaling is based on a per-group metric value that represents the total amount of work to be done or resource usage, set this value to an amount assigned for a single instance of the scaled group. Autoscaler keeps the number of instances proportional to the value of this metric. The metric itself does not change value due to group resizing.
             *
             * A good metric to use with the target is for example pubsub.googleapis.com/subscription/num_undelivered_messages or a custom metric exporting the total number of requests coming to your instances.
             *
             * A bad example would be a metric exporting an average or median latency, since this value can't include a chunk assignable to a single instance, it could be better used with utilization_target instead.
             */
            singleInstanceAssignment?: pulumi.Input<number>;
            /**
             * The target value of the metric that autoscaler maintains. This must be a positive value. A utilization metric scales number of virtual machines handling requests to increase or decrease proportionally to the metric.
             *
             * For example, a good metric to use as a utilization_target is https://www.googleapis.com/compute/v1/instance/network/received_bytes_count. The autoscaler works to keep this value constant for each of the instances.
             */
            utilizationTarget?: pulumi.Input<number>;
            /**
             * Defines how target utilization value is expressed for a Stackdriver Monitoring metric. Either GAUGE, DELTA_PER_SECOND, or DELTA_PER_MINUTE.
             */
            utilizationTargetType?: pulumi.Input<string>;
        }
        /**
         * Configuration parameters of autoscaling based on load balancing.
         */
        interface AutoscalingPolicyLoadBalancingUtilization {
            /**
             * Fraction of backend capacity utilization (set in HTTP(S) load balancing configuration) that the autoscaler maintains. Must be a positive float value. If not defined, the default is 0.8.
             */
            utilizationTarget?: pulumi.Input<number>;
        }
        /**
         * Configuration that allows for slower scale in so that even if Autoscaler recommends an abrupt scale in of a MIG, it will be throttled as specified by the parameters below.
         */
        interface AutoscalingPolicyScaleInControl {
            /**
             * Maximum allowed number (or %) of VMs that can be deducted from the peak recommendation during the window autoscaler looks at when computing recommendations. Possibly all these VMs can be deleted at once so user service needs to be prepared to lose that many VMs in one step.
             */
            maxScaledInReplicas?: pulumi.Input<inputs.compute.v1.FixedOrPercent>;
            /**
             * How far back autoscaling looks when computing recommendations to include directives regarding slower scale in, as described above.
             */
            timeWindowSec?: pulumi.Input<number>;
        }
        /**
         * Message containing information of one individual backend.
         */
        interface Backend {
            /**
             * Specifies how to determine whether the backend of a load balancer can handle additional traffic or is fully loaded. For usage guidelines, see  Connection balancing mode.
             */
            balancingMode?: pulumi.Input<string>;
            /**
             * A multiplier applied to the backend's target capacity of its balancing mode. The default value is 1, which means the group serves up to 100% of its configured capacity (depending on balancingMode). A setting of 0 means the group is completely drained, offering 0% of its available capacity. The valid ranges are 0.0 and [0.1,1.0]. You cannot configure a setting larger than 0 and smaller than 0.1. You cannot configure a setting of 0 when there is only one backend attached to the backend service.
             *
             * Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            capacityScaler?: pulumi.Input<number>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * This field designates whether this is a failover backend. More than one failover backend can be configured for a given BackendService.
             */
            failover?: pulumi.Input<boolean>;
            /**
             * The fully-qualified URL of an instance group or network endpoint group (NEG) resource. The type of backend that a backend service supports depends on the backend service's loadBalancingScheme.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL (except Network Load Balancing),  INTERNAL_SELF_MANAGED, or INTERNAL_MANAGED , the backend can be either an instance group or a NEG. The backends on the backend service must be either all instance groups or all NEGs. You cannot mix instance group and NEG backends on the same backend service.
             *
             *
             * - When the loadBalancingScheme for the backend service is EXTERNAL for Network Load Balancing or INTERNAL for Internal TCP/UDP Load Balancing, the backend must be an instance group. NEGs are not supported.
             *
             * For regional services, the backend must be in the same region as the backend service.
             *
             * You must use the fully-qualified URL (starting with https://www.googleapis.com/) to specify the instance group or NEG. Partial URLs are not supported.
             */
            group?: pulumi.Input<string>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode. Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a target maximum number of simultaneous connections. For usage guidelines, see Connection balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is RATE. Not supported by:
             *
             * - Internal TCP/UDP Load Balancing - Network Load Balancing.
             */
            maxConnectionsPerInstance?: pulumi.Input<number>;
            /**
             * Defines a maximum number of HTTP requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRate?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerEndpoint?: pulumi.Input<number>;
            /**
             * Defines a maximum target for requests per second (RPS). For usage guidelines, see Rate balancing mode and Utilization balancing mode.
             *
             * Not available if the backend's balancingMode is CONNECTION.
             */
            maxRatePerInstance?: pulumi.Input<number>;
            maxUtilization?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend bucket.
         */
        interface BackendBucketCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.v1.BackendBucketCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.v1.BackendBucketCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendBucketCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendBucketCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Message containing Cloud CDN configuration for a backend service.
         */
        interface BackendServiceCdnPolicy {
            /**
             * Bypass the cache when the specified request headers are matched - e.g. Pragma or Authorization headers. Up to 5 headers can be specified. The cache is bypassed for all cdnPolicy.cacheMode settings.
             */
            bypassCacheOnRequestHeaders?: pulumi.Input<pulumi.Input<inputs.compute.v1.BackendServiceCdnPolicyBypassCacheOnRequestHeader>[]>;
            /**
             * The CacheKeyPolicy for this CdnPolicy.
             */
            cacheKeyPolicy?: pulumi.Input<inputs.compute.v1.CacheKeyPolicy>;
            /**
             * Specifies the cache setting for all responses from this backend. The possible values are:
             *
             * USE_ORIGIN_HEADERS Requires the origin to set valid caching headers to cache content. Responses without these headers will not be cached at Google's edge, and will require a full trip to the origin on every request, potentially impacting performance and increasing load on the origin server.
             *
             * FORCE_CACHE_ALL Cache all content, ignoring any "private", "no-store" or "no-cache" directives in Cache-Control response headers. Warning: this may result in Cloud CDN caching private, per-user (user identifiable) content.
             *
             * CACHE_ALL_STATIC Automatically cache static content, including common image formats, media (video and audio), and web assets (JavaScript and CSS). Requests and responses that are marked as uncacheable, as well as dynamic content (including HTML), will not be cached.
             */
            cacheMode?: pulumi.Input<string>;
            /**
             * Specifies a separate client (e.g. browser client) maximum TTL. This is used to clamp the max-age (or Expires) value sent to the client. With FORCE_CACHE_ALL, the lesser of client_ttl and default_ttl is used for the response max-age directive, along with a "public" directive. For cacheable content in CACHE_ALL_STATIC mode, client_ttl clamps the max-age from the origin (if specified), or else sets the response max-age directive to the lesser of the client_ttl and default_ttl, and also ensures a "public" cache-control directive is present. If a client TTL is not specified, a default value (1 hour) will be used. The maximum allowed value is 86400s (1 day).
             */
            clientTtl?: pulumi.Input<number>;
            /**
             * Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age). Setting a TTL of "0" means "always revalidate". The value of defaultTTL cannot be set to a value greater than that of maxTTL, but can be equal. When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses. The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            defaultTtl?: pulumi.Input<number>;
            /**
             * Specifies the maximum allowed TTL for cached content served by this origin. Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTTL seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive. Headers sent to the client will not be modified. Setting a TTL of "0" means "always revalidate". The maximum allowed value is 31,622,400s (1 year), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            maxTtl?: pulumi.Input<number>;
            /**
             * Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency. When the cache mode is set to CACHE_ALL_STATIC or USE_ORIGIN_HEADERS, negative caching applies to responses with the specified response code that lack any Cache-Control, Expires, or Pragma: no-cache directives. When the cache mode is set to FORCE_CACHE_ALL, negative caching applies to all responses with the specified response code, and override any caching headers. By default, Cloud CDN will apply the following default TTLs to these status codes: HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s HTTP 405 (Method Not Found), 421 (Misdirected Request), 501 (Not Implemented): 60s. These defaults can be overridden in negative_caching_policy.
             */
            negativeCaching?: pulumi.Input<boolean>;
            /**
             * Sets a cache TTL for the specified HTTP status code. negative_caching must be enabled to configure negative_caching_policy. Omitting the policy and leaving negative_caching enabled will use Cloud CDN's default cache TTLs. Note that when specifying an explicit negative_caching_policy, you should take care to specify a cache TTL for all response codes that you wish to cache. Cloud CDN will not apply any default negative caching when a policy exists.
             */
            negativeCachingPolicy?: pulumi.Input<pulumi.Input<inputs.compute.v1.BackendServiceCdnPolicyNegativeCachingPolicy>[]>;
            /**
             * If true then Cloud CDN will combine multiple concurrent cache fill requests into a small number of requests to the origin.
             */
            requestCoalescing?: pulumi.Input<boolean>;
            /**
             * Serve existing content from the cache (if available) when revalidating content with the origin, or when an error is encountered when refreshing the cache. This setting defines the default "max-stale" duration for any cached responses that do not specify a max-stale directive. Stale responses that exceed the TTL configured here will not be served. The default limit (max-stale) is 86400s (1 day), which will allow stale content to be served up to this limit beyond the max-age (or s-max-age) of a cached response. The maximum allowed value is 604800 (1 week). Set this to zero (0) to disable serve-while-stale.
             */
            serveWhileStale?: pulumi.Input<number>;
            /**
             * Maximum number of seconds the response to a signed URL request will be considered fresh. After this time period, the response will be revalidated before being served. Defaults to 1hr (3600s). When serving responses to signed URL requests, Cloud CDN will internally behave as though all responses from this backend had a "Cache-Control: public, max-age=[TTL]" header, regardless of any existing Cache-Control header. The actual headers served in responses will not be altered.
             */
            signedUrlCacheMaxAgeSec?: pulumi.Input<string>;
            /**
             * [Output Only] Names of the keys for signing request URLs.
             */
            signedUrlKeyNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Bypass the cache when the specified request headers are present, e.g. Pragma or Authorization headers. Values are case insensitive. The presence of such a header overrides the cache_mode setting.
         */
        interface BackendServiceCdnPolicyBypassCacheOnRequestHeader {
            /**
             * The header field name to match on when bypassing cache. Values are case-insensitive.
             */
            headerName?: pulumi.Input<string>;
        }
        /**
         * Specify CDN TTLs for response error codes.
         */
        interface BackendServiceCdnPolicyNegativeCachingPolicy {
            /**
             * The HTTP status code to define a TTL against. Only HTTP status codes 300, 301, 302, 307, 308, 404, 405, 410, 421, 451 and 501 are can be specified as values, and you cannot specify a status code more than once.
             */
            code?: pulumi.Input<number>;
            /**
             * The TTL (in seconds) for which to cache responses with the corresponding status code. The maximum allowed value is 1800s (30 minutes), noting that infrequently accessed objects may be evicted from the cache before the defined TTL.
             */
            ttl?: pulumi.Input<number>;
        }
        /**
         * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. On failover or failback, this field indicates whether connection draining will be honored. GCP has a fixed connection draining timeout of 10 minutes. A setting of true terminates existing TCP connections to the active pool during failover and failback, immediately draining traffic. A setting of false allows existing TCP connections to persist, even on VMs no longer in the active pool, for up to the duration of the connection draining timeout (10 minutes).
         */
        interface BackendServiceFailoverPolicy {
            /**
             * This can be set to true only if the protocol is TCP.
             *
             * The default is false.
             */
            disableConnectionDrainOnFailover?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing, If set to true, connections to the load balancer are dropped when all primary and all backup backend VMs are unhealthy.If set to false, connections are distributed among all primary VMs when all primary and all backup backend VMs are unhealthy. The default is false.
             */
            dropTrafficIfUnhealthy?: pulumi.Input<boolean>;
            /**
             * Applicable only to Failover for Internal TCP/UDP Load Balancing and Network Load Balancing. The value of the field must be in the range [0, 1]. If the value is 0, the load balancer performs a failover when the number of healthy primary VMs equals zero. For all other values, the load balancer performs a failover when the total number of healthy primary VMs is less than this ratio.
             */
            failoverRatio?: pulumi.Input<number>;
        }
        /**
         * Identity-Aware Proxy
         */
        interface BackendServiceIAP {
            /**
             * Whether the serving infrastructure will authenticate and authorize all incoming requests. If true, the oauth2ClientId and oauth2ClientSecret fields must be non-empty.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * OAuth2 client ID to use for the authentication flow.
             */
            oauth2ClientId?: pulumi.Input<string>;
            /**
             * OAuth2 client secret to use for the authentication flow. For security reasons, this value cannot be retrieved via the API. Instead, the SHA-256 hash of the value is returned in the oauth2ClientSecretSha256 field.
             */
            oauth2ClientSecret?: pulumi.Input<string>;
            /**
             * [Output Only] SHA256 hash value for the field oauth2_client_secret above.
             */
            oauth2ClientSecretSha256?: pulumi.Input<string>;
        }
        /**
         * The available logging options for the load balancer traffic served by this backend service.
         */
        interface BackendServiceLogConfig {
            /**
             * This field denotes whether to enable logging for the load balancer traffic served by this backend service.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified if logging is enabled for this backend service. The value of the field must be in [0, 1]. This configures the sampling rate of requests to the load balancer where 1.0 means all logged requests are reported and 0.0 means no logged requests are reported. The default value is 1.0.
             */
            sampleRate?: pulumi.Input<number>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            bindingId?: pulumi.Input<string>;
            /**
             * The condition that is associated with this binding.
             *
             * If the condition evaluates to `true`, then this binding applies to the current request.
             *
             * If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.
             *
             * To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.compute.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
             *
             * * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
             *
             * * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
             *
             * * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` .
             *
             *
             *
             * * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
             *
             * * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
             *
             * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding.
             *
             * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding.
             *
             * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding.
             *
             *
             *
             * * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Message containing what to include in the cache key for a request for Cloud CDN.
         */
        interface CacheKeyPolicy {
            /**
             * If true, requests to different hosts will be cached separately.
             */
            includeHost?: pulumi.Input<boolean>;
            /**
             * If true, http and https requests will be cached separately.
             */
            includeProtocol?: pulumi.Input<boolean>;
            /**
             * If true, include query string parameters in the cache key according to query_string_whitelist and query_string_blacklist. If neither is set, the entire query string will be included. If false, the query string will be excluded from the cache key entirely.
             */
            includeQueryString?: pulumi.Input<boolean>;
            /**
             * Names of query string parameters to exclude in cache keys. All other parameters will be included. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringBlacklist?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Names of query string parameters to include in cache keys. All other parameters will be excluded. Either specify query_string_whitelist or query_string_blacklist, not both. '&' and '=' will be percent encoded and not treated as delimiters.
             */
            queryStringWhitelist?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings controlling the volume of connections to a backend service.
         */
        interface CircuitBreakers {
            /**
             * The maximum number of connections to the backend service. If not specified, there is no limit.
             */
            maxConnections?: pulumi.Input<number>;
            /**
             * The maximum number of pending requests allowed to the backend service. If not specified, there is no limit.
             */
            maxPendingRequests?: pulumi.Input<number>;
            /**
             * The maximum number of parallel requests that allowed to the backend service. If not specified, there is no limit.
             */
            maxRequests?: pulumi.Input<number>;
            /**
             * Maximum requests for a single connection to the backend service. This parameter is respected by both the HTTP/1.1 and HTTP/2 implementations. If not specified, there is no limit. Setting this parameter to 1 will effectively disable keep alive.
             */
            maxRequestsPerConnection?: pulumi.Input<number>;
            /**
             * The maximum number of parallel retries allowed to the backend cluster. If not specified, the default is 1.
             */
            maxRetries?: pulumi.Input<number>;
        }
        /**
         * A condition to be met.
         */
        interface Condition {
            /**
             * Trusted attributes supplied by the IAM system.
             */
            iam?: pulumi.Input<string>;
            /**
             * An operator to apply the subject with.
             */
            op?: pulumi.Input<string>;
            /**
             * Trusted attributes discharged by the service.
             */
            svc?: pulumi.Input<string>;
            /**
             * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
             */
            sys?: pulumi.Input<string>;
            /**
             * The objects of the condition.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A set of Confidential Instance options.
         */
        interface ConfidentialInstanceConfig {
            /**
             * Defines whether the instance should have confidential compute enabled.
             */
            enableConfidentialCompute?: pulumi.Input<boolean>;
        }
        /**
         * Message containing connection draining configuration.
         */
        interface ConnectionDraining {
            /**
             * Configures a duration timeout for existing requests on a removed backend instance. For supported load balancers and protocols, as described in Enabling connection draining.
             */
            drainingTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * This message defines settings for a consistent hash style load balancer.
         */
        interface ConsistentHashLoadBalancerSettings {
            /**
             * Hash is based on HTTP Cookie. This field describes a HTTP cookie that will be used as the hash key for the consistent hash load balancer. If the cookie is not present, it will be generated. This field is applicable if the sessionAffinity is set to HTTP_COOKIE.
             */
            httpCookie?: pulumi.Input<inputs.compute.v1.ConsistentHashLoadBalancerSettingsHttpCookie>;
            /**
             * The hash based on the value of the specified header field. This field is applicable if the sessionAffinity is set to HEADER_FIELD.
             */
            httpHeaderName?: pulumi.Input<string>;
            /**
             * The minimum number of virtual nodes to use for the hash ring. Defaults to 1024. Larger ring sizes result in more granular load distributions. If the number of hosts in the load balancing pool is larger than the ring size, each host will be assigned a single virtual node.
             */
            minimumRingSize?: pulumi.Input<string>;
        }
        /**
         * The information about the HTTP Cookie on which the hash function is based for load balancing policies that use a consistent hash.
         */
        interface ConsistentHashLoadBalancerSettingsHttpCookie {
            /**
             * Name of the cookie.
             */
            name?: pulumi.Input<string>;
            /**
             * Path to set for the cookie.
             */
            path?: pulumi.Input<string>;
            /**
             * Lifetime of the cookie.
             */
            ttl?: pulumi.Input<inputs.compute.v1.Duration>;
        }
        /**
         * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
         */
        interface CorsPolicy {
            /**
             * In response to a preflight request, setting this to true indicates that the actual request can include user credentials. This translates to the Access-Control-Allow-Credentials header.
             * Default is false.
             */
            allowCredentials?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Allow-Headers header.
             */
            allowHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the content for the Access-Control-Allow-Methods header.
             */
            allowMethods?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the regualar expression patterns that match allowed origins. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOriginRegexes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the list of origins that will be allowed to do CORS requests.
             * An origin is allowed if it matches either an item in allowOrigins or an item in allowOriginRegexes.
             */
            allowOrigins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If true, specifies the CORS policy is disabled. The default value of false, which indicates that the CORS policy is in effect.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Specifies the content for the Access-Control-Expose-Headers header.
             */
            exposeHeaders?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies how long results of a preflight request can be cached in seconds. This translates to the Access-Control-Max-Age header.
             */
            maxAge?: pulumi.Input<number>;
        }
        interface CustomerEncryptionKey {
            /**
             * The name of the encryption key that is stored in Google Cloud KMS.
             */
            kmsKeyName?: pulumi.Input<string>;
            /**
             * The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
             */
            kmsKeyServiceAccount?: pulumi.Input<string>;
            /**
             * Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
             */
            rawKey?: pulumi.Input<string>;
            /**
             * [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             */
            sha256?: pulumi.Input<string>;
        }
        /**
         * Deprecation status for a public resource.
         */
        interface DeprecationStatus {
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DELETED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deleted?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to DEPRECATED. This is only informational and the status will not change unless the client explicitly changes it.
             */
            deprecated?: pulumi.Input<string>;
            /**
             * An optional RFC3339 timestamp on or after which the state of this resource is intended to change to OBSOLETE. This is only informational and the status will not change unless the client explicitly changes it.
             */
            obsolete?: pulumi.Input<string>;
            /**
             * The URL of the suggested replacement for a deprecated resource. The suggested replacement resource must be the same kind of resource as the deprecated resource.
             */
            replacement?: pulumi.Input<string>;
            /**
             * The deprecation state of this resource. This can be ACTIVE, DEPRECATED, OBSOLETE, or DELETED. Operations which communicate the end of life date for an image, can use ACTIVE. Operations which create a new resource using a DEPRECATED resource will return successfully, but with a warning indicating the deprecated resource and recommending its replacement. Operations which use OBSOLETE or DELETED resources will be rejected and result in an error.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * A specification of the desired way to instantiate a disk in the instance template when its created from a source instance.
         */
        interface DiskInstantiationConfig {
            /**
             * Specifies whether the disk will be auto-deleted when the instance is deleted (but not when the disk is detached from the instance).
             */
            autoDelete?: pulumi.Input<boolean>;
            /**
             * The custom source image to be used to restore this disk when instantiating this instance template.
             */
            customImage?: pulumi.Input<string>;
            /**
             * Specifies the device name of the disk to which the configurations apply to.
             */
            deviceName?: pulumi.Input<string>;
            /**
             * Specifies whether to include the disk and what image to use. Possible values are:
             * - source-image: to use the same image that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - source-image-family: to use the same image family that was used to create the source instance's corresponding disk. Applicable to the boot disk and additional read-write disks.
             * - custom-image: to use a user-provided image url for disk creation. Applicable to the boot disk and additional read-write disks.
             * - attach-read-only: to attach a read-only disk. Applicable to read-only disks.
             * - do-not-include: to exclude a disk from the template. Applicable to additional read-write disks, local SSDs, and read-only disks.
             */
            instantiateFrom?: pulumi.Input<string>;
        }
        /**
         * A set of Display Device options
         */
        interface DisplayDevice {
            /**
             * Defines whether the instance has Display enabled.
             */
            enableDisplay?: pulumi.Input<boolean>;
        }
        interface DistributionPolicy {
            /**
             * The distribution shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType).
             */
            targetShape?: pulumi.Input<string>;
            /**
             * Zones where the regional managed instance group will create and manage its instances.
             */
            zones?: pulumi.Input<pulumi.Input<inputs.compute.v1.DistributionPolicyZoneConfiguration>[]>;
        }
        interface DistributionPolicyZoneConfiguration {
            /**
             * The URL of the zone. The zone must exist in the region where the managed instance group is located.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A Duration represents a fixed-length span of time represented as a count of seconds and fractions of seconds at nanosecond resolution. It is independent of any calendar and concepts like "day" or "month". Range is approximately 10,000 years.
         */
        interface Duration {
            /**
             * Span of time that's a fraction of a second at nanosecond resolution. Durations less than one second are represented with a 0 `seconds` field and a positive `nanos` field. Must be from 0 to 999,999,999 inclusive.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Span of time at a resolution of a second. Must be from 0 to 315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
             */
            seconds?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.
         *
         * Example (Comparison):
         *
         * title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100"
         *
         * Example (Equality):
         *
         * title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email"
         *
         * Example (Logic):
         *
         * title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'"
         *
         * Example (Data Manipulation):
         *
         * title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)"
         *
         * The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The interface for the external VPN gateway.
         */
        interface ExternalVpnGatewayInterface {
            /**
             * The numeric ID of this interface. The allowed input values for this id for different redundancy types of external VPN gateway: SINGLE_IP_INTERNALLY_REDUNDANT - 0 TWO_IPS_REDUNDANCY - 0, 1 FOUR_IPS_REDUNDANCY - 0, 1, 2, 3
             */
            id?: pulumi.Input<number>;
            /**
             * IP address of the interface in the external VPN gateway. Only IPv4 is supported. This IP address can be either from your on-premise gateway or another Cloud provider's VPN gateway, it cannot be an IP address from Google Compute Engine.
             */
            ipAddress?: pulumi.Input<string>;
        }
        interface FileContentBuffer {
            /**
             * The raw content in the secure keys file.
             */
            content?: pulumi.Input<string>;
            /**
             * The file type of source file.
             */
            fileType?: pulumi.Input<string>;
        }
        /**
         * The available logging options for a firewall rule.
         */
        interface FirewallLogConfig {
            /**
             * This field denotes whether to enable logging for a particular firewall rule.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
             */
            metadata?: pulumi.Input<string>;
        }
        interface FirewallPolicyAssociation {
            /**
             * The target that the firewall policy is attached to.
             */
            attachmentTarget?: pulumi.Input<string>;
            /**
             * [Output Only] Deprecated, please use short name instead. The display name of the firewall policy of the association.
             */
            displayName?: pulumi.Input<string>;
            /**
             * [Output Only] The firewall policy ID of the association.
             */
            firewallPolicyId?: pulumi.Input<string>;
            /**
             * The name for an association.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The short name of the firewall policy of the association.
             */
            shortName?: pulumi.Input<string>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface FirewallPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description for this resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The direction in which this rule applies.
             */
            direction?: pulumi.Input<string>;
            /**
             * Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
             */
            enableLogging?: pulumi.Input<boolean>;
            /**
             * [Output only] Type of the resource. Always compute#firewallPolicyRule for firewall policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.v1.FirewallPolicyRuleMatcher>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.
             */
            priority?: pulumi.Input<number>;
            /**
             * [Output Only] Calculation of the complexity of a single firewall policy rule.
             */
            ruleTupleCount?: pulumi.Input<number>;
            /**
             * A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
             */
            targetResources?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of secure labels that controls which instances the firewall rule applies to. If targetSecureLabel are specified, then the firewall rule applies only to instances in the VPC network that have one of those secure labels. targetSecureLabel may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureLabel are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label values allowed is 256.
             */
            targetSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of service accounts indicating the sets of instances that are applied with this rule.
             */
            targetServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface FirewallPolicyRuleMatcher {
            /**
             * CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.
             */
            destIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Pairs of IP protocols and ports that the rule should match.
             */
            layer4Configs?: pulumi.Input<pulumi.Input<inputs.compute.v1.FirewallPolicyRuleMatcherLayer4Config>[]>;
            /**
             * CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of firewall label values, which should be matched at the source of the traffic. Maximum number of source label values allowed is 256.
             */
            srcSecureLabels?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface FirewallPolicyRuleMatcherLayer4Config {
            /**
             * The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
             */
            ipProtocol?: pulumi.Input<string>;
            /**
             * An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
             *
             * Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
             */
            ports?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Encapsulates numeric value that can be either absolute or relative.
         */
        interface FixedOrPercent {
            /**
             * [Output Only] Absolute value of VM instances calculated based on the specific mode.
             *
             *
             * - If the value is fixed, then the calculated value is equal to the fixed value.
             * - If the value is a percent, then the calculated value is percent/100 * targetSize. For example, the calculated value of a 80% of a managed instance group with 150 instances would be (80/100 * 150) = 120 VM instances. If there is a remainder, the number is rounded up.
             */
            calculated?: pulumi.Input<number>;
            /**
             * Specifies a fixed number of VM instances. This must be a positive integer.
             */
            fixed?: pulumi.Input<number>;
            /**
             * Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * Describes the auto-registration of the Forwarding Rule to Service Directory. The region and project of the Service Directory resource generated from this registration will be the same as this Forwarding Rule.
         */
        interface ForwardingRuleServiceDirectoryRegistration {
            /**
             * Service Directory namespace to register the forwarding rule under.
             */
            namespace?: pulumi.Input<string>;
            /**
             * Service Directory service to register the forwarding rule under.
             */
            service?: pulumi.Input<string>;
            /**
             * [Optional] Service Directory region to register this global forwarding rule under. Default to "us-central1". Only used for PSC for Google APIs. All PSC for Google APIs Forwarding Rules on the same network should use the same Service Directory region.
             */
            serviceDirectoryRegion?: pulumi.Input<string>;
        }
        interface GRPCHealthCheck {
            /**
             * The gRPC service name for the health check. This field is optional. The value of grpc_service_name has the following meanings by convention:
             * - Empty service_name means the overall status of all services at the backend.
             * - Non-empty service_name means the health of that gRPC service, as defined by the owner of the service.
             * The grpc_service_name can only be ASCII.
             */
            grpcServiceName?: pulumi.Input<string>;
            /**
             * The port number for the health check request. Must be specified if port_name and port_specification are not set or if port_specification is USE_FIXED_PORT. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence. The port_name should conform to RFC1035.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, gRPC health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
        }
        /**
         * Guest OS features.
         */
        interface GuestOsFeature {
            /**
             * The ID of a supported feature. Read  Enabling guest operating system features to see a list of available options.
             */
            type?: pulumi.Input<string>;
        }
        interface HTTP2HealthCheck {
            /**
             * The value of the host header in the HTTP/2 health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP2 health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP/2 health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        interface HTTPHealthCheck {
            /**
             * The value of the host header in the HTTP health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTP health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        interface HTTPSHealthCheck {
            /**
             * The value of the host header in the HTTPS health check request. If left empty (default value), the IP on behalf of which this health check is performed will be used.
             */
            host?: pulumi.Input<string>;
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, HTTPS health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The request path of the HTTPS health check request. The default value is /.
             */
            requestPath?: pulumi.Input<string>;
            /**
             * The string to match anywhere in the first 1024 bytes of the response body. If left empty (the default value), the status code determines health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * Configuration of logging on a health check. If logging is enabled, logs will be exported to Stackdriver.
         */
        interface HealthCheckLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default, which means no health check logging will be done.
             */
            enable?: pulumi.Input<boolean>;
        }
        /**
         * UrlMaps A host-matching rule for a URL. If matched, will use the named PathMatcher to select the BackendService.
         */
        interface HostRule {
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The list of host patterns to match. They must be valid hostnames with optional port numbers in the format host:port. * matches any string of ([a-z0-9-.]*). In that case, * must be the first character and must be followed in the pattern by either - or ..
             * * based matching is not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            hosts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the PathMatcher to use to match the path portion of the URL if the hostRule matches the URL's host portion.
             */
            pathMatcher?: pulumi.Input<string>;
        }
        /**
         * Specification for how requests are aborted as part of fault injection.
         */
        interface HttpFaultAbort {
            /**
             * The HTTP status code used to abort the request.
             * The value must be between 200 and 599 inclusive.
             */
            httpStatus?: pulumi.Input<number>;
            /**
             * The percentage of traffic (connections/operations/requests) which will be aborted as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * Specifies the delay introduced by Loadbalancer before forwarding the request to the backend service as part of fault injection.
         */
        interface HttpFaultDelay {
            /**
             * Specifies the value of the fixed delay interval.
             */
            fixedDelay?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * The percentage of traffic (connections/operations/requests) on which delay will be introduced as part of fault injection.
             * The value must be between 0.0 and 100.0 inclusive.
             */
            percentage?: pulumi.Input<number>;
        }
        /**
         * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
         */
        interface HttpFaultInjection {
            /**
             * The specification for how client requests are aborted as part of fault injection.
             */
            abort?: pulumi.Input<inputs.compute.v1.HttpFaultAbort>;
            /**
             * The specification for how client requests are delayed as part of fault injection, before being sent to a backend service.
             */
            delay?: pulumi.Input<inputs.compute.v1.HttpFaultDelay>;
        }
        /**
         * The request and response header transformations that take effect before the request is passed along to the selected backendService.
         */
        interface HttpHeaderAction {
            /**
             * Headers to add to a matching request prior to forwarding the request to the backendService.
             */
            requestHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the request prior to forwarding the request to the backendService.
             */
            requestHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Headers to add the response prior to sending the response back to the client.
             */
            responseHeadersToAdd?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpHeaderOption>[]>;
            /**
             * A list of header names for headers that need to be removed from the response prior to sending the response back to the client.
             */
            responseHeadersToRemove?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * matchRule criteria for request header matches.
         */
        interface HttpHeaderMatch {
            /**
             * The value should exactly match contents of exactMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the HTTP header to match.
             * For matching against the HTTP request's authority, use a headerMatch with the header name ":authority".
             * For matching a request's method, use the headerName ":method".
             * When the URL map is bound to target gRPC proxy that has validateForProxyless field set to true, only non-binary user-specified custom metadata and the `content-type` header are supported. The following transport-level headers cannot be used in header matching rules: `:authority`, `:method`, `:path`, `:scheme`, `user-agent`, `accept-encoding`, `content-encoding`, `grpc-accept-encoding`, `grpc-encoding`, `grpc-previous-rpc-attempts`, `grpc-tags-bin`, `grpc-timeout` and `grpc-trace-bin.
             */
            headerName?: pulumi.Input<string>;
            /**
             * If set to false, the headerMatch is considered a match if the match criteria above are met. If set to true, the headerMatch is considered a match if the match criteria above are NOT met.
             * The default setting is false.
             */
            invertMatch?: pulumi.Input<boolean>;
            /**
             * The value of the header must start with the contents of prefixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * A header with the contents of headerName must exist. The match takes place whether or not the request's header has a value.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The header value must be an integer and its value must be in the range specified in rangeMatch. If the header does not contain an integer, number or is empty, the match fails.
             * For example for a range [-5, 0]
             * - -3 will match.
             * - 0 will not match.
             * - 0.25 will not match.
             * - -3someString will not match.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that rangeMatch is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             */
            rangeMatch?: pulumi.Input<inputs.compute.v1.Int64RangeMatch>;
            /**
             * The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see:  github.com/google/re2/wiki/Syntax
             * For matching against a port specified in the HTTP request, use a headerMatch with headerName set to PORT and a regular expression that satisfies the RFC2616 Host header's port specifier.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
            /**
             * The value of the header must end with the contents of suffixMatch.
             * Only one of exactMatch, prefixMatch, suffixMatch, regexMatch, presentMatch or rangeMatch must be set.
             */
            suffixMatch?: pulumi.Input<string>;
        }
        /**
         * Specification determining how headers are added to requests or responses.
         */
        interface HttpHeaderOption {
            /**
             * The name of the header.
             */
            headerName?: pulumi.Input<string>;
            /**
             * The value of the header to add.
             */
            headerValue?: pulumi.Input<string>;
            /**
             * If false, headerValue is appended to any values that already exist for the header. If true, headerValue is set for the header, discarding any values that were set for that header.
             * The default value is false.
             */
            replace?: pulumi.Input<boolean>;
        }
        /**
         * HttpRouteRuleMatch criteria for a request's query parameter.
         */
        interface HttpQueryParameterMatch {
            /**
             * The queryParameterMatch matches if the value of the parameter exactly matches the contents of exactMatch.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            exactMatch?: pulumi.Input<string>;
            /**
             * The name of the query parameter to match. The query parameter must exist in the request, in the absence of which the request match fails.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies that the queryParameterMatch matches if the request contains the query parameter, irrespective of whether the parameter has a value or not.
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             */
            presentMatch?: pulumi.Input<boolean>;
            /**
             * The queryParameterMatch matches if the value of the parameter matches the regular expression specified by regexMatch. For the regular expression grammar, please see github.com/google/re2/wiki/Syntax
             * Only one of presentMatch, exactMatch or regexMatch must be set.
             * Note that regexMatch only applies when the loadBalancingScheme is set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Specifies settings for an HTTP redirect.
         */
        interface HttpRedirectAction {
            /**
             * The host that will be used in the redirect response instead of the one that was supplied in the request.
             * The value must be between 1 and 255 characters.
             */
            hostRedirect?: pulumi.Input<string>;
            /**
             * If set to true, the URL scheme in the redirected request is set to https. If set to false, the URL scheme of the redirected request will remain the same as that of the request.
             * This must only be set for UrlMaps used in TargetHttpProxys. Setting this true for TargetHttpsProxy is not permitted.
             * The default is set to false.
             */
            httpsRedirect?: pulumi.Input<boolean>;
            /**
             * The path that will be used in the redirect response instead of the one that was supplied in the request.
             * pathRedirect cannot be supplied together with prefixRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            pathRedirect?: pulumi.Input<string>;
            /**
             * The prefix that replaces the prefixMatch specified in the HttpRouteRuleMatch, retaining the remaining portion of the URL before redirecting the request.
             * prefixRedirect cannot be supplied together with pathRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
             * The value must be between 1 and 1024 characters.
             */
            prefixRedirect?: pulumi.Input<string>;
            /**
             * The HTTP Status code to use for this RedirectAction.
             * Supported values are:
             * - MOVED_PERMANENTLY_DEFAULT, which is the default value and corresponds to 301.
             * - FOUND, which corresponds to 302.
             * - SEE_OTHER which corresponds to 303.
             * - TEMPORARY_REDIRECT, which corresponds to 307. In this case, the request method will be retained.
             * - PERMANENT_REDIRECT, which corresponds to 308. In this case, the request method will be retained.
             */
            redirectResponseCode?: pulumi.Input<string>;
            /**
             * If set to true, any accompanying query portion of the original URL is removed prior to redirecting the request. If set to false, the query portion of the original URL is retained.
             * The default is set to false.
             */
            stripQuery?: pulumi.Input<boolean>;
        }
        /**
         * The retry policy associates with HttpRouteRule
         */
        interface HttpRetryPolicy {
            /**
             * Specifies the allowed number retries. This number must be > 0. If not specified, defaults to 1.
             */
            numRetries?: pulumi.Input<number>;
            /**
             * Specifies a non-zero timeout per retry attempt.
             * If not specified, will use the timeout set in HttpRouteAction. If timeout in HttpRouteAction is not set, will use the largest timeout among all backend services associated with the route.
             */
            perTryTimeout?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * Specfies one or more conditions when this retry rule applies. Valid values are:
             * - 5xx: Loadbalancer will attempt a retry if the backend service responds with any 5xx response code, or if the backend service does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.
             * - gateway-error: Similar to 5xx, but only applies to response codes 502, 503 or 504.
             * -
             * - connect-failure: Loadbalancer will retry on failures connecting to backend services, for example due to connection timeouts.
             * - retriable-4xx: Loadbalancer will retry for retriable 4xx response codes. Currently the only retriable error supported is 409.
             * - refused-stream:Loadbalancer will retry if the backend service resets the stream with a REFUSED_STREAM error code. This reset type indicates that it is safe to retry.
             * - cancelledLoadbalancer will retry if the gRPC status code in the response header is set to cancelled
             * - deadline-exceeded: Loadbalancer will retry if the gRPC status code in the response header is set to deadline-exceeded
             * - resource-exhausted: Loadbalancer will retry if the gRPC status code in the response header is set to resource-exhausted
             * - unavailable: Loadbalancer will retry if the gRPC status code in the response header is set to unavailable
             */
            retryConditions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface HttpRouteAction {
            /**
             * The specification for allowing client side cross-origin requests. Please see W3C Recommendation for Cross Origin Resource Sharing
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            corsPolicy?: pulumi.Input<inputs.compute.v1.CorsPolicy>;
            /**
             * The specification for fault injection introduced into traffic to test the resiliency of clients to backend service failure. As part of fault injection, when clients send requests to a backend service, delays can be introduced by Loadbalancer on a percentage of requests before sending those request to the backend service. Similarly requests from clients can be aborted by the Loadbalancer for a percentage of requests.
             * timeout and retry_policy will be ignored by clients that are configured with a fault_injection_policy.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            faultInjectionPolicy?: pulumi.Input<inputs.compute.v1.HttpFaultInjection>;
            /**
             * Specifies the maximum duration (timeout) for streams on the selected route. Unlike the timeout field where the timeout duration starts from the time the request has been fully processed (i.e. end-of-stream), the duration in this field is computed from the beginning of the stream until the response has been completely processed, including all retries. A stream that does not complete in this duration is closed.
             * If not specified, will use the largest maxStreamDuration among all backend services associated with the route.
             * This field is only allowed if the Url map is used with backend services with loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            maxStreamDuration?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * Specifies the policy on how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            requestMirrorPolicy?: pulumi.Input<inputs.compute.v1.RequestMirrorPolicy>;
            /**
             * Specifies the retry policy associated with this route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            retryPolicy?: pulumi.Input<inputs.compute.v1.HttpRetryPolicy>;
            /**
             * Specifies the timeout for the selected route. Timeout is computed from the time the request has been fully processed (i.e. end-of-stream) up until the response has been completely processed. Timeout includes all retries.
             * If not specified, will use the largest timeout among all backend services associated with the route.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            timeout?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * The spec to modify the URL of the request, prior to forwarding the request to the matched service.
             * urlRewrite is the only action supported in UrlMaps for external HTTP(S) load balancers.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            urlRewrite?: pulumi.Input<inputs.compute.v1.UrlRewrite>;
            /**
             * A list of weighted backend services to send traffic to when a route match occurs. The weights determine the fraction of traffic that flows to their corresponding backend service. If all traffic needs to go to a single backend service, there must be one  weightedBackendService with weight set to a non-zero number.
             * Once a backendService is identified and before forwarding the request to the backend service, advanced routing actions such as URL rewrites and header transformations are applied depending on additional settings specified in this HttpRouteAction.
             */
            weightedBackendServices?: pulumi.Input<pulumi.Input<inputs.compute.v1.WeightedBackendService>[]>;
        }
        /**
         * An HttpRouteRule specifies how to match an HTTP request and the corresponding routing action that load balancing proxies will perform.
         */
        interface HttpRouteRule {
            /**
             * The short description conveying the intent of this routeRule.
             * The description can have a maximum length of 1024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * The headerAction specified here are applied before the matching pathMatchers[].headerAction and after pathMatchers[].routeRules[].routeAction.weightedBackendService.backendServiceWeightAction[].headerAction
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.v1.HttpHeaderAction>;
            /**
             * The list of criteria for matching attributes of a request to this routeRule. This list has OR semantics: the request matches this routeRule when any of the matchRules are satisfied. However predicates within a given matchRule have AND semantics. All predicates within a matchRule must match for the request to match the rule.
             */
            matchRules?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpRouteRuleMatch>[]>;
            /**
             * For routeRules within a given pathMatcher, priority determines the order in which load balancer will interpret routeRules. RouteRules are evaluated in order of priority, from the lowest to highest number. The priority of a rule decreases as its number increases (1, 2, 3, N+1). The first rule that matches the request is applied.
             * You cannot configure two or more routeRules with the same priority. Priority for each rule must be set to a number between 0 and 2147483647 inclusive.
             * Priority numbers can have gaps, which enable you to add or remove rules in the future without affecting the rest of the rules. For example, 1, 2, 3, 4, 5, 9, 12, 16 is a valid series of priority numbers to which you could add rules numbered from 6 to 8, 10 to 11, and 13 to 15 in the future without any impact on existing rules.
             */
            priority?: pulumi.Input<number>;
            /**
             * In response to a matching matchRule, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If  routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a routeRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.v1.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When this rule is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.v1.HttpRedirectAction>;
        }
        /**
         * HttpRouteRuleMatch specifies a set of criteria for matching requests to an HttpRouteRule. All specified criteria must be satisfied for a match to occur.
         */
        interface HttpRouteRuleMatch {
            /**
             * For satisfying the matchRule condition, the path of the request must exactly match the value specified in fullPathMatch after removing any query parameters and anchor that may be part of the original URL.
             * fullPathMatch must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            fullPathMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of header match criteria, all of which must match corresponding headers in the request.
             */
            headerMatches?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpHeaderMatch>[]>;
            /**
             * Specifies that prefixMatch and fullPathMatch matches are case sensitive.
             * The default value is false.
             * ignoreCase must not be used with regexMatch.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            ignoreCase?: pulumi.Input<boolean>;
            /**
             * Opaque filter criteria used by Loadbalancer to restrict routing configuration to a limited set of xDS compliant clients. In their xDS requests to Loadbalancer, xDS clients present node metadata. When there is a match, the relevant routing configuration is made available to those proxies.
             * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata. If multiple metadataFilters are specified, all of them need to be satisfied in order to be considered a match.
             * metadataFilters specified here will be applied after those specified in ForwardingRule that refers to the UrlMap this HttpRouteRuleMatch belongs to.
             * metadataFilters only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            metadataFilters?: pulumi.Input<pulumi.Input<inputs.compute.v1.MetadataFilter>[]>;
            /**
             * For satisfying the matchRule condition, the request's path must begin with the specified prefixMatch. prefixMatch must begin with a /.
             * The value must be between 1 and 1024 characters.
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             */
            prefixMatch?: pulumi.Input<string>;
            /**
             * Specifies a list of query parameter match criteria, all of which must match corresponding query parameters in the request.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            queryParameterMatches?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpQueryParameterMatch>[]>;
            /**
             * For satisfying the matchRule condition, the path of the request must satisfy the regular expression specified in regexMatch after removing any query parameters and anchor supplied with the original URL. For regular expression grammar please see github.com/google/re2/wiki/Syntax
             * Only one of prefixMatch, fullPathMatch or regexMatch must be specified.
             * Note that regexMatch only applies to Loadbalancers that have their loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             */
            regexMatch?: pulumi.Input<string>;
        }
        /**
         * Initial State for shielded instance, these are public keys which are safe to store in public
         */
        interface InitialStateConfig {
            /**
             * The Key Database (db).
             */
            dbs?: pulumi.Input<pulumi.Input<inputs.compute.v1.FileContentBuffer>[]>;
            /**
             * The forbidden key database (dbx).
             */
            dbxs?: pulumi.Input<pulumi.Input<inputs.compute.v1.FileContentBuffer>[]>;
            /**
             * The Key Exchange Key (KEK).
             */
            keks?: pulumi.Input<pulumi.Input<inputs.compute.v1.FileContentBuffer>[]>;
            /**
             * The Platform Key (PK).
             */
            pk?: pulumi.Input<inputs.compute.v1.FileContentBuffer>;
        }
        interface InstanceGroupManagerActionsSummary {
            /**
             * [Output Only] The total number of instances in the managed instance group that are scheduled to be abandoned. Abandoning an instance removes it from the managed instance group without deleting it.
             */
            abandoning?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be created or are currently being created. If the group fails to create any of these instances, it tries again until it creates the instance successfully.
             *
             * If you have disabled creation retries, this field will not be populated; instead, the creatingWithoutRetries field will be populated.
             */
            creating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances that the managed instance group will attempt to create. The group attempts to create each instance only once. If the group fails to create any of these instances, it decreases the group's targetSize value accordingly.
             */
            creatingWithoutRetries?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be deleted or are currently being deleted.
             */
            deleting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are running and have no scheduled actions.
             */
            none?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be recreated or are currently being being recreated. Recreating an instance deletes the existing root persistent disk and creates a new disk from the image that is defined in the instance template.
             */
            recreating?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being reconfigured with properties that do not require a restart or a recreate action. For example, setting or removing target pools for the instance.
             */
            refreshing?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are scheduled to be restarted or are currently being restarted.
             */
            restarting?: pulumi.Input<number>;
            /**
             * [Output Only] The number of instances in the managed instance group that are being verified. See the managedInstances[].currentAction property in the listManagedInstances method documentation.
             */
            verifying?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerAutoHealingPolicy {
            /**
             * The URL for the health check that signals autohealing.
             */
            healthCheck?: pulumi.Input<string>;
            /**
             * The number of seconds that the managed instance group waits before it applies autohealing policies to new instances or recently recreated instances. This initial delay allows instances to initialize and run their startup scripts before the instance group determines that they are UNHEALTHY. This prevents the managed instance group from recreating its instances prematurely. This value must be from range [0, 3600].
             */
            initialDelaySec?: pulumi.Input<number>;
        }
        interface InstanceGroupManagerStatus {
            /**
             * [Output Only] The URL of the Autoscaler that targets this instance group manager.
             */
            autoscaler?: pulumi.Input<string>;
            /**
             * [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
             */
            isStable?: pulumi.Input<boolean>;
            /**
             * [Output Only] Stateful status of the given Instance Group Manager.
             */
            stateful?: pulumi.Input<inputs.compute.v1.InstanceGroupManagerStatusStateful>;
            /**
             * [Output Only] A status of consistency of Instances' versions with their target version specified by version field on Instance Group Manager.
             */
            versionTarget?: pulumi.Input<inputs.compute.v1.InstanceGroupManagerStatusVersionTarget>;
        }
        interface InstanceGroupManagerStatusStateful {
            /**
             * [Output Only] A bit indicating whether the managed instance group has stateful configuration, that is, if you have configured any items in a stateful policy or in per-instance configs. The group might report that it has no stateful config even when there is still some preserved state on a managed instance, for example, if you have deleted all PICs but not yet applied those deletions.
             */
            hasStatefulConfig?: pulumi.Input<boolean>;
            /**
             * [Output Only] Status of per-instance configs on the instance.
             */
            perInstanceConfigs?: pulumi.Input<inputs.compute.v1.InstanceGroupManagerStatusStatefulPerInstanceConfigs>;
        }
        interface InstanceGroupManagerStatusStatefulPerInstanceConfigs {
            /**
             * A bit indicating if all of the group's per-instance configs (listed in the output of a listPerInstanceConfigs API call) have status EFFECTIVE or there are no per-instance-configs.
             */
            allEffective?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerStatusVersionTarget {
            /**
             * [Output Only] A bit indicating whether version target has been reached in this managed instance group, i.e. all instances are in their target version. Instances' target version are specified by version field on Instance Group Manager.
             */
            isReached?: pulumi.Input<boolean>;
        }
        interface InstanceGroupManagerUpdatePolicy {
            /**
             * The  instance redistribution policy for regional managed instance groups. Valid values are:
             * - PROACTIVE (default): The group attempts to maintain an even distribution of VM instances across zones in the region.
             * - NONE: For non-autoscaled groups, proactive redistribution is disabled.
             */
            instanceRedistributionType?: pulumi.Input<string>;
            /**
             * The maximum number of instances that can be created above the specified targetSize during the update process. This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxSurge is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxSurge.
             */
            maxSurge?: pulumi.Input<inputs.compute.v1.FixedOrPercent>;
            /**
             * The maximum number of instances that can be unavailable during the update process. An instance is considered available if all of the following conditions are satisfied:
             *
             *
             * - The instance's status is RUNNING.
             * - If there is a health check on the instance group, the instance's health check status must be HEALTHY at least once. If there is no health check on the group, then the instance only needs to have a status of RUNNING to be considered available.  This value can be either a fixed number or, if the group has 10 or more instances, a percentage. If you set a percentage, the number of instances is rounded up if necessary. The default value for maxUnavailable is a fixed value equal to the number of zones in which the managed instance group operates.
             *
             * At least one of either maxSurge or maxUnavailable must be greater than 0. Learn more about maxUnavailable.
             */
            maxUnavailable?: pulumi.Input<inputs.compute.v1.FixedOrPercent>;
            /**
             * Minimal action to be taken on an instance. You can specify either RESTART to restart existing instances or REPLACE to delete and create new instances from the target template. If you specify a RESTART, the Updater will attempt to perform that action only. However, if the Updater determines that the minimal action you specify is not enough to perform the update, it might perform a more disruptive action.
             */
            minimalAction?: pulumi.Input<string>;
            /**
             * What action should be used to replace instances. See minimal_action.REPLACE
             */
            replacementMethod?: pulumi.Input<string>;
            /**
             * The type of update process. You can specify either PROACTIVE so that the instance group manager proactively executes actions in order to bring instances to their target versions or OPPORTUNISTIC so that no action is proactively executed but the update will be performed as part of other actions (for example, resizes or recreateInstances calls).
             */
            type?: pulumi.Input<string>;
        }
        interface InstanceGroupManagerVersion {
            /**
             * The URL of the instance template that is specified for this managed instance group. The group uses this template to create new instances in the managed instance group until the `targetSize` for this version is reached. The templates for existing instances in the group do not change unless you run recreateInstances, run applyUpdatesToInstances, or set the group's updatePolicy.type to PROACTIVE; in those cases, existing instances are updated until the `targetSize` for this version is reached.
             */
            instanceTemplate?: pulumi.Input<string>;
            /**
             * Name of the version. Unique among all versions in the scope of this managed instance group.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies the intended number of instances to be created from the instanceTemplate. The final number of instances created from the template will be equal to:
             * - If expressed as a fixed number, the minimum of either targetSize.fixed or instanceGroupManager.targetSize is used.
             * - if expressed as a percent, the targetSize would be (targetSize.percent/100 * InstanceGroupManager.targetSize) If there is a remainder, the number is rounded up.  If unset, this version will update any remaining instances not updated by another version. Read Starting a canary update for more information.
             */
            targetSize?: pulumi.Input<inputs.compute.v1.FixedOrPercent>;
        }
        interface InstanceProperties {
            /**
             * Controls for advanced machine-related behavior features.
             */
            advancedMachineFeatures?: pulumi.Input<inputs.compute.v1.AdvancedMachineFeatures>;
            /**
             * Enables instances created based on these properties to send packets with source IP addresses other than their own and receive packets with destination IP addresses other than their own. If these instances will be used as an IP gateway or it will be set as the next-hop in a Route resource, specify true. If unsure, leave this set to false. See the Enable IP forwarding documentation for more information.
             */
            canIpForward?: pulumi.Input<boolean>;
            /**
             * Specifies the Confidential Instance options.
             */
            confidentialInstanceConfig?: pulumi.Input<inputs.compute.v1.ConfidentialInstanceConfig>;
            /**
             * An optional text description for the instances that are created from these properties.
             */
            description?: pulumi.Input<string>;
            /**
             * An array of disks that are associated with the instances that are created from these properties.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.compute.v1.AttachedDisk>[]>;
            /**
             * A list of guest accelerator cards' type and count to use for instances created from these properties.
             */
            guestAccelerators?: pulumi.Input<pulumi.Input<inputs.compute.v1.AcceleratorConfig>[]>;
            /**
             * Labels to apply to instances that are created from these properties.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The machine type to use for instances that are created from these properties.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs to assign to instances that are created from these properties. These pairs can consist of custom metadata or predefined keys. See Project and instance metadata for more information.
             */
            metadata?: pulumi.Input<inputs.compute.v1.Metadata>;
            /**
             * Minimum cpu/platform to be used by instances. The instance may be scheduled on the specified or newer cpu/platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: "Intel Haswell" or minCpuPlatform: "Intel Sandy Bridge". For more information, read Specifying a Minimum CPU Platform.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * An array of network access configurations for this interface.
             */
            networkInterfaces?: pulumi.Input<pulumi.Input<inputs.compute.v1.NetworkInterface>[]>;
            /**
             * PostKeyRevocationActionType of the instance.
             */
            postKeyRevocationActionType?: pulumi.Input<string>;
            /**
             * The private IPv6 google access type for VMs. If not specified, use  INHERIT_FROM_SUBNETWORK as default.
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * Specifies the reservations that instances can consume from.
             */
            reservationAffinity?: pulumi.Input<inputs.compute.v1.ReservationAffinity>;
            /**
             * Resource policies (names, not ULRs) applied to instances created from these properties.
             */
            resourcePolicies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies the scheduling options for the instances that are created from these properties.
             */
            scheduling?: pulumi.Input<inputs.compute.v1.Scheduling>;
            /**
             * A list of service accounts with specified scopes. Access tokens for these service accounts are available to the instances that are created from these properties. Use metadata queries to obtain the access tokens for these instances.
             */
            serviceAccounts?: pulumi.Input<pulumi.Input<inputs.compute.v1.ServiceAccount>[]>;
            shieldedInstanceConfig?: pulumi.Input<inputs.compute.v1.ShieldedInstanceConfig>;
            /**
             * A list of tags to apply to the instances that are created from these properties. The tags identify valid sources or targets for network firewalls. The setTags method can modify this list of tags. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<inputs.compute.v1.Tags>;
        }
        /**
         * HttpRouteRuleMatch criteria for field values that must stay within the specified integer range.
         */
        interface Int64RangeMatch {
            /**
             * The end of the range (exclusive) in signed long integer format.
             */
            rangeEnd?: pulumi.Input<string>;
            /**
             * The start of the range (inclusive) in signed long integer format.
             */
            rangeStart?: pulumi.Input<string>;
        }
        /**
         * Informational metadata about Partner attachments from Partners to display to customers. These fields are propagated from PARTNER_PROVIDER attachments to their corresponding PARTNER attachments.
         */
        interface InterconnectAttachmentPartnerMetadata {
            /**
             * Plain text name of the Interconnect this attachment is connected to, as displayed in the Partner's portal. For instance "Chicago 1". This value may be validated to match approved Partner values.
             */
            interconnectName?: pulumi.Input<string>;
            /**
             * Plain text name of the Partner providing this attachment. This value may be validated to match approved Partner values.
             */
            partnerName?: pulumi.Input<string>;
            /**
             * URL of the Partner's portal for this Attachment. Partners may customise this to be a deep link to the specific resource on the Partner portal. This value may be validated to match approved Partner values.
             */
            portalUrl?: pulumi.Input<string>;
        }
        /**
         * Information for an interconnect attachment when this belongs to an interconnect of type DEDICATED.
         */
        interface InterconnectAttachmentPrivateInfo {
            /**
             * [Output Only] 802.1q encapsulation tag to be used for traffic between Google and the customer, going to and from this network and region.
             */
            tag8021q?: pulumi.Input<number>;
        }
        /**
         * Describes a single physical circuit between the Customer and Google. CircuitInfo objects are created by Google, so all fields are output only.
         */
        interface InterconnectCircuitInfo {
            /**
             * Customer-side demarc ID for this circuit.
             */
            customerDemarcId?: pulumi.Input<string>;
            /**
             * Google-assigned unique ID for this circuit. Assigned at circuit turn-up.
             */
            googleCircuitId?: pulumi.Input<string>;
            /**
             * Google-side demarc ID for this circuit. Assigned at circuit turn-up and provided by Google to the customer in the LOA.
             */
            googleDemarcId?: pulumi.Input<string>;
        }
        /**
         * Description of a planned outage on this Interconnect.
         */
        interface InterconnectOutageNotification {
            /**
             * If issue_type is IT_PARTIAL_OUTAGE, a list of the Google-side circuit IDs that will be affected.
             */
            affectedCircuits?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A description about the purpose of the outage.
             */
            description?: pulumi.Input<string>;
            /**
             * Scheduled end time for the outage (milliseconds since Unix epoch).
             */
            endTime?: pulumi.Input<string>;
            /**
             * Form this outage is expected to take, which can take one of the following values:
             * - OUTAGE: The Interconnect may be completely out of service for some or all of the specified window.
             * - PARTIAL_OUTAGE: Some circuits comprising the Interconnect as a whole should remain up, but with reduced bandwidth. Note that the versions of this enum prefixed with "IT_" have been deprecated in favor of the unprefixed values.
             */
            issueType?: pulumi.Input<string>;
            /**
             * Unique identifier for this outage notification.
             */
            name?: pulumi.Input<string>;
            /**
             * The party that generated this notification, which can take the following value:
             * - GOOGLE: this notification as generated by Google. Note that the value of NSRC_GOOGLE has been deprecated in favor of GOOGLE.
             */
            source?: pulumi.Input<string>;
            /**
             * Scheduled start time for the outage (milliseconds since Unix epoch).
             */
            startTime?: pulumi.Input<string>;
            /**
             * State of this notification, which can take one of the following values:
             * - ACTIVE: This outage notification is active. The event could be in the past, present, or future. See start_time and end_time for scheduling.
             * - CANCELLED: The outage associated with this notification was cancelled before the outage was due to start. Note that the versions of this enum prefixed with "NS_" have been deprecated in favor of the unprefixed values.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Commitment for a particular license resource.
         */
        interface LicenseResourceCommitment {
            /**
             * The number of licenses purchased.
             */
            amount?: pulumi.Input<string>;
            /**
             * Specifies the core range of the instance for which this license applies.
             */
            coresPerLicense?: pulumi.Input<string>;
            /**
             * Any applicable license URI.
             */
            license?: pulumi.Input<string>;
        }
        interface LicenseResourceRequirements {
            /**
             * Minimum number of guest cpus required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minGuestCpuCount?: pulumi.Input<number>;
            /**
             * Minimum memory required to use the Instance. Enforced at Instance creation and Instance start.
             */
            minMemoryMb?: pulumi.Input<number>;
        }
        interface LocalDisk {
            /**
             * Specifies the number of such disks.
             */
            diskCount?: pulumi.Input<number>;
            /**
             * Specifies the size of the disk in base-2 GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Specifies the desired disk type on the node. This disk type must be a local storage type (e.g.: local-ssd). Note that for nodeTemplates, this should be the name of the disk type and not its URL.
             */
            diskType?: pulumi.Input<string>;
        }
        /**
         * Specifies what kind of log the caller must write
         */
        interface LogConfig {
            /**
             * Cloud audit options.
             */
            cloudAudit?: pulumi.Input<inputs.compute.v1.LogConfigCloudAuditOptions>;
            /**
             * Counter options.
             */
            counter?: pulumi.Input<inputs.compute.v1.LogConfigCounterOptions>;
            /**
             * Data access options.
             */
            dataAccess?: pulumi.Input<inputs.compute.v1.LogConfigDataAccessOptions>;
        }
        /**
         * Write a Cloud Audit log
         */
        interface LogConfigCloudAuditOptions {
            /**
             * Information used by the Cloud Audit Logging pipeline.
             */
            authorizationLoggingOptions?: pulumi.Input<inputs.compute.v1.AuthorizationLoggingOptions>;
            /**
             * The log_name to populate in the Cloud Audit Record.
             */
            logName?: pulumi.Input<string>;
        }
        /**
         * Increment a streamz counter with the specified metric and field names.
         *
         * Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended.
         *
         * Field names correspond to IAM request parameters and field values are their respective values.
         *
         * Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields.
         *
         * Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/debug_access_count {iam_principal=[value of IAMContext.principal]}
         */
        interface LogConfigCounterOptions {
            /**
             * Custom fields.
             */
            customFields?: pulumi.Input<pulumi.Input<inputs.compute.v1.LogConfigCounterOptionsCustomField>[]>;
            /**
             * The field value to attribute.
             */
            field?: pulumi.Input<string>;
            /**
             * The metric to update.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Custom fields. These can be used to create a counter with arbitrary field/value pairs. See: go/rpcsp-custom-fields.
         */
        interface LogConfigCounterOptionsCustomField {
            /**
             * Name is the field name.
             */
            name?: pulumi.Input<string>;
            /**
             * Value is the field value. It is important that in contrast to the CounterOptions.field, the value here is a constant that is not derived from the IAMContext.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Write a Data Access (Gin) log
         */
        interface LogConfigDataAccessOptions {
            logMode?: pulumi.Input<string>;
        }
        /**
         * A metadata key/value entry.
         */
        interface Metadata {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet.
             *
             * To see the latest fingerprint, make a get() request to retrieve the resource.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * Array of key/value pairs. The total size of all keys and values must be less than 512 KB.
             */
            items?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] Type of the resource. Always compute#metadata for metadata.
             */
            kind?: pulumi.Input<string>;
        }
        /**
         * Opaque filter criteria used by loadbalancers to restrict routing configuration to a limited set of loadbalancing proxies. Proxies and sidecars involved in loadbalancing would typically present metadata to the loadbalancers which need to match criteria specified here. If a match takes place, the relevant configuration is made available to those proxies.
         * For each metadataFilter in this list, if its filterMatchCriteria is set to MATCH_ANY, at least one of the filterLabels must match the corresponding label provided in the metadata. If its filterMatchCriteria is set to MATCH_ALL, then all of its filterLabels must match with corresponding labels provided in the metadata.
         * An example for using metadataFilters would be: if loadbalancing involves  Envoys, they will only receive routing configuration when values in metadataFilters match values supplied in <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/core/base.proto#envoy-api-msg-core-node" Node metadata of their XDS requests to loadbalancers.
         */
        interface MetadataFilter {
            /**
             * The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria
             * This list must not be empty and can have at the most 64 entries.
             */
            filterLabels?: pulumi.Input<pulumi.Input<inputs.compute.v1.MetadataFilterLabelMatch>[]>;
            /**
             * Specifies how individual filterLabel matches within the list of filterLabels contribute towards the overall metadataFilter match.
             * Supported values are:
             * - MATCH_ANY: At least one of the filterLabels must have a matching label in the provided metadata.
             * - MATCH_ALL: All filterLabels must have matching labels in the provided metadata.
             */
            filterMatchCriteria?: pulumi.Input<string>;
        }
        /**
         * MetadataFilter label name value pairs that are expected to match corresponding labels presented as metadata to the loadbalancer.
         */
        interface MetadataFilterLabelMatch {
            /**
             * Name of metadata label.
             * The name can have a maximum length of 1024 characters and must be at least 1 character long.
             */
            name?: pulumi.Input<string>;
            /**
             * The value of the label must match the specified value.
             * value can have a maximum length of 1024 characters.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The named port. For example: .
         */
        interface NamedPort {
            /**
             * The name for this named port. The name must be 1-63 characters long, and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * The port number, which can be a value between 1 and 65535.
             */
            port?: pulumi.Input<number>;
        }
        /**
         * Configuration for an App Engine network endpoint group (NEG). The service is optional, may be provided explicitly or in the URL mask. The version is optional and can only be provided explicitly or in the URL mask when service is present.
         *
         * Note: App Engine service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupAppEngine {
            /**
             * Optional serving service.
             *
             * The service name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "default", "my-service".
             */
            service?: pulumi.Input<string>;
            /**
             * A template to parse service and version fields from a request URL. URL mask allows for routing to multiple App Engine services without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, the request URLs "foo1-dot-appname.appspot.com/v1" and "foo1-dot-appname.appspot.com/v2" can be backed by the same Serverless NEG with URL mask "-dot-appname.appspot.com/". The URL mask will parse them to { service = "foo1", version = "v1" } and { service = "foo1", version = "v2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
            /**
             * Optional serving version.
             *
             * The version name is case-sensitive and must be 1-100 characters long.
             *
             * Example value: "v1", "v2".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Function network endpoint group (NEG). The function must be provided explicitly or in the URL mask.
         *
         * Note: Cloud Function must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudFunction {
            /**
             * A user-defined name of the Cloud Function.
             *
             * The function name is case-sensitive and must be 1-63 characters long.
             *
             * Example value: "func1".
             */
            function?: pulumi.Input<string>;
            /**
             * A template to parse function field from a request URL. URL mask allows for routing to multiple Cloud Functions without having to create multiple Network Endpoint Groups and backend services.
             *
             * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2" can be backed by the same Serverless NEG with URL mask "/". The URL mask will parse them to { function = "function1" } and { function = "function2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * Configuration for a Cloud Run network endpoint group (NEG). The service must be provided explicitly or in the URL mask. The tag is optional, may be provided explicitly or in the URL mask.
         *
         * Note: Cloud Run service must be in the same project and located in the same region as the Serverless NEG.
         */
        interface NetworkEndpointGroupCloudRun {
            /**
             * Cloud Run service is the main resource of Cloud Run.
             *
             * The service must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "run-service".
             */
            service?: pulumi.Input<string>;
            /**
             * Optional Cloud Run tag represents the "named-revision" to provide additional fine-grained traffic routing information.
             *
             * The tag must be 1-63 characters long, and comply with RFC1035.
             *
             * Example value: "revision-0010".
             */
            tag?: pulumi.Input<string>;
            /**
             * A template to parse service and tag fields from a request URL. URL mask allows for routing to multiple Run services without having to create multiple network endpoint groups and backend services.
             *
             * For example, request URLs "foo1.domain.com/bar1" and "foo1.domain.com/bar2" can be backed by the same Serverless Network Endpoint Group (NEG) with URL mask ".domain.com/". The URL mask will parse them to { service="bar1", tag="foo1" } and { service="bar2", tag="foo2" } respectively.
             */
            urlMask?: pulumi.Input<string>;
        }
        /**
         * A network interface resource attached to an instance.
         */
        interface NetworkInterface {
            /**
             * An array of configurations for this interface. Currently, only one access config, ONE_TO_ONE_NAT, is supported. If there are no accessConfigs specified, then this instance will have no external internet access.
             */
            accessConfigs?: pulumi.Input<pulumi.Input<inputs.compute.v1.AccessConfig>[]>;
            /**
             * An array of alias IP ranges for this network interface. You can only specify this field for network interfaces in VPC networks.
             */
            aliasIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.v1.AliasIpRange>[]>;
            /**
             * Fingerprint hash of contents stored in this network interface. This field will be ignored when inserting an Instance or adding a NetworkInterface. An up-to-date fingerprint must be provided in order to update the NetworkInterface. The request will fail with error 400 Bad Request if the fingerprint is not provided, or 412 Precondition Failed if the fingerprint is out of date.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * [Output Only] An IPv6 internal network address for this network interface.
             */
            ipv6Address?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#networkInterface for network interfaces.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] The name of the network interface, which is generated by the server. For network devices, these are eth0, eth1, etc.
             */
            name?: pulumi.Input<string>;
            /**
             * URL of the network resource for this instance. When creating an instance, if neither the network nor the subnetwork is specified, the default network global/networks/default is used; if the network is not specified but the subnetwork is specified, the network is inferred.
             *
             * If you specify this property, you can specify the network as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/global/networks/network
             * - projects/project/global/networks/network
             * - global/networks/default
             */
            network?: pulumi.Input<string>;
            /**
             * An IPv4 internal IP address to assign to the instance for this network interface. If not specified by the user, an unused internal IP is assigned by the system.
             */
            networkIP?: pulumi.Input<string>;
            /**
             * The type of vNIC to be used on this interface. This may be gVNIC or VirtioNet.
             */
            nicType?: pulumi.Input<string>;
            /**
             * The URL of the Subnetwork resource for this instance. If the network resource is in legacy mode, do not specify this field. If the network is in auto subnet mode, specifying the subnetwork is optional. If the network is in custom subnet mode, specifying the subnetwork is required. If you specify this field, you can specify the subnetwork as a full or partial URL. For example, the following are all valid URLs:
             * - https://www.googleapis.com/compute/v1/projects/project/regions/region/subnetworks/subnetwork
             * - regions/region/subnetworks/subnetwork
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
         */
        interface NetworkPeering {
            /**
             * This field will be deprecated soon. Use the exchange_subnet_routes field instead. Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            autoCreateRoutes?: pulumi.Input<boolean>;
            /**
             * Indicates whether full mesh connectivity is created and managed automatically between peered networks. Currently this field should always be true since Google Compute Engine will automatically create and manage subnetwork routes between two networks when peering state is ACTIVE.
             */
            exchangeSubnetRoutes?: pulumi.Input<boolean>;
            /**
             * Whether to export the custom routes to peer network.
             */
            exportCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are exported. The default value is true, all subnet routes are exported. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always exported to peers and are not controlled by this field.
             */
            exportSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Whether to import the custom routes from peer network.
             */
            importCustomRoutes?: pulumi.Input<boolean>;
            /**
             * Whether subnet routes with public IP range are imported. The default value is false. The IPv4 special-use ranges (https://en.wikipedia.org/wiki/IPv4#Special_addresses) are always imported from peers and are not controlled by this field.
             */
            importSubnetRoutesWithPublicIp?: pulumi.Input<boolean>;
            /**
             * Name of this peering. Provided by the client when the peering is created. The name must comply with RFC1035. Specifically, the name must be 1-63 characters long and match regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all the following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * The URL of the peer network. It can be either full URL or partial URL. The peer network may belong to a different project. If the partial URL does not contain project, it is assumed that the peer network is in the same project as the current network.
             */
            network?: pulumi.Input<string>;
            /**
             * Maximum Transmission Unit in bytes.
             */
            peerMtu?: pulumi.Input<number>;
            /**
             * [Output Only] State for the peering, either `ACTIVE` or `INACTIVE`. The peering is `ACTIVE` when there's a matching configuration in the peer network.
             */
            state?: pulumi.Input<string>;
            /**
             * [Output Only] Details about the current state of the peering.
             */
            stateDetails?: pulumi.Input<string>;
        }
        /**
         * A routing configuration attached to a network resource. The message includes the list of routers associated with the network, and a flag indicating the type of routing behavior to enforce network-wide.
         */
        interface NetworkRoutingConfig {
            /**
             * The network-wide routing mode to use. If set to REGIONAL, this network's Cloud Routers will only advertise routes with subnets of this network in the same region as the router. If set to GLOBAL, this network's Cloud Routers will advertise routes with all subnets of this network, across regions.
             */
            routingMode?: pulumi.Input<string>;
        }
        interface NodeGroupAutoscalingPolicy {
            /**
             * The maximum number of nodes that the group should have. Must be set if autoscaling is enabled. Maximum value allowed is 100.
             */
            maxNodes?: pulumi.Input<number>;
            /**
             * The minimum number of nodes that the group should have.
             */
            minNodes?: pulumi.Input<number>;
            /**
             * The autoscaling mode. Set to one of: ON, OFF, or ONLY_SCALE_OUT. For more information, see  Autoscaler modes.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily maintenance operations. GCE's internal maintenance will be performed within this window.
         */
        interface NodeGroupMaintenanceWindow {
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            maintenanceDuration?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        interface NodeTemplateNodeTypeFlexibility {
            cpus?: pulumi.Input<string>;
            localSsd?: pulumi.Input<string>;
            memory?: pulumi.Input<string>;
        }
        /**
         * Represents a gRPC setting that describes one gRPC notification endpoint and the retry duration attempting to send notification to this endpoint.
         */
        interface NotificationEndpointGrpcSettings {
            /**
             * Optional. If specified, this field is used to set the authority header by the sender of notifications. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
             */
            authority?: pulumi.Input<string>;
            /**
             * Endpoint to which gRPC notifications are sent. This must be a valid gRPCLB DNS name.
             */
            endpoint?: pulumi.Input<string>;
            /**
             * Optional. If specified, this field is used to populate the "name" field in gRPC requests.
             */
            payloadName?: pulumi.Input<string>;
            /**
             * Optional. This field is used to configure how often to send a full update of all non-healthy backends. If unspecified, full updates are not sent. If specified, must be in the range between 600 seconds to 3600 seconds. Nanos are disallowed.
             */
            resendInterval?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * How much time (in seconds) is spent attempting notification retries until a successful response is received. Default is 30s. Limit is 20m (1200s). Must be a positive number.
             */
            retryDurationSec?: pulumi.Input<number>;
        }
        /**
         * Settings controlling the eviction of unhealthy hosts from the load balancing pool for the backend service.
         */
        interface OutlierDetection {
            /**
             * The base time that a host is ejected for. The real ejection time is equal to the base ejection time multiplied by the number of times the host has been ejected. Defaults to 30000ms or 30s.
             */
            baseEjectionTime?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * Number of errors before a host is ejected from the connection pool. When the backend host is accessed over HTTP, a 5xx return code qualifies as an error. Defaults to 5.
             */
            consecutiveErrors?: pulumi.Input<number>;
            /**
             * The number of consecutive gateway failures (502, 503, 504 status or connection errors that are mapped to one of those status codes) before a consecutive gateway failure ejection occurs. Defaults to 3.
             */
            consecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0.
             */
            enforcingConsecutiveErrors?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through consecutive gateway failures. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingConsecutiveGatewayFailure?: pulumi.Input<number>;
            /**
             * The percentage chance that a host will be actually ejected when an outlier status is detected through success rate statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
             */
            enforcingSuccessRate?: pulumi.Input<number>;
            /**
             * Time interval between ejection analysis sweeps. This can result in both new ejections as well as hosts being returned to service. Defaults to 1 second.
             */
            interval?: pulumi.Input<inputs.compute.v1.Duration>;
            /**
             * Maximum percentage of hosts in the load balancing pool for the backend service that can be ejected. Defaults to 50%.
             */
            maxEjectionPercent?: pulumi.Input<number>;
            /**
             * The number of hosts in a cluster that must have enough request volume to detect success rate outliers. If the number of hosts is less than this setting, outlier detection via success rate statistics is not performed for any host in the cluster. Defaults to 5.
             */
            successRateMinimumHosts?: pulumi.Input<number>;
            /**
             * The minimum number of total requests that must be collected in one interval (as defined by the interval duration above) to include this host in success rate based outlier detection. If the volume is lower than this setting, outlier detection via success rate statistics is not performed for that host. Defaults to 100.
             */
            successRateRequestVolume?: pulumi.Input<number>;
            /**
             * This factor is used to determine the ejection threshold for success rate outlier ejection. The ejection threshold is the difference between the mean success rate, and the product of this factor and the standard deviation of the mean success rate: mean - (stdev * success_rate_stdev_factor). This factor is divided by a thousand to get a double. That is, if the desired factor is 1.9, the runtime value should be 1900. Defaults to 1900.
             */
            successRateStdevFactor?: pulumi.Input<number>;
        }
        interface PacketMirroringFilter {
            /**
             * Protocols that apply as filter on mirrored traffic. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            IPProtocols?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * IP CIDR ranges that apply as filter on the source (ingress) or destination (egress) IP in the IP header. Only IPv4 is supported. If no ranges are specified, all traffic that matches the specified IPProtocols is mirrored. If neither cidrRanges nor IPProtocols is specified, all traffic is mirrored.
             */
            cidrRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Direction of traffic to mirror, either INGRESS, EGRESS, or BOTH. The default is BOTH.
             */
            direction?: pulumi.Input<string>;
        }
        interface PacketMirroringForwardingRuleInfo {
            /**
             * [Output Only] Unique identifier for the forwarding rule; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the forwarding rule representing the ILB configured as destination of the mirrored traffic.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfo {
            /**
             * A set of virtual machine instances that are being mirrored. They must live in zones contained in the same region as this packetMirroring.
             *
             * Note that this config will apply only to those network interfaces of the Instances that belong to the network specified in this packetMirroring.
             *
             * You may specify a maximum of 50 Instances.
             */
            instances?: pulumi.Input<pulumi.Input<inputs.compute.v1.PacketMirroringMirroredResourceInfoInstanceInfo>[]>;
            /**
             * A set of subnetworks for which traffic from/to all VM instances will be mirrored. They must live in the same region as this packetMirroring.
             *
             * You may specify a maximum of 5 subnetworks.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.v1.PacketMirroringMirroredResourceInfoSubnetInfo>[]>;
            /**
             * A set of mirrored tags. Traffic from/to all VM instances that have one or more of these tags will be mirrored.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface PacketMirroringMirroredResourceInfoInstanceInfo {
            /**
             * [Output Only] Unique identifier for the instance; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the virtual machine instance which is being mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringMirroredResourceInfoSubnetInfo {
            /**
             * [Output Only] Unique identifier for the subnetwork; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * Resource URL to the subnetwork for which traffic from/to all VM instances will be mirrored.
             */
            url?: pulumi.Input<string>;
        }
        interface PacketMirroringNetworkInfo {
            /**
             * [Output Only] Unique identifier for the network; defined by the server.
             */
            canonicalUrl?: pulumi.Input<string>;
            /**
             * URL of the network resource.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * A matcher for the path portion of the URL. The BackendService from the longest-matched rule will serve the URL. If no rule was matched, the default service will be used.
         */
        interface PathMatcher {
            /**
             * defaultRouteAction takes effect when none of the  pathRules or routeRules match. The load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If defaultRouteAction specifies any weightedBackendServices, defaultService must not be set. Conversely if defaultService is set, defaultRouteAction cannot contain any  weightedBackendServices.
             * Only one of defaultRouteAction or defaultUrlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathMatcher's defaultRouteAction.
             */
            defaultRouteAction?: pulumi.Input<inputs.compute.v1.HttpRouteAction>;
            /**
             * The full or partial URL to the BackendService resource. This will be used if none of the pathRules or routeRules defined by this PathMatcher are matched. For example, the following are all valid URLs to a BackendService resource:
             * - https://www.googleapis.com/compute/v1/projects/project/global/backendServices/backendService
             * - compute/v1/projects/project/global/backendServices/backendService
             * - global/backendServices/backendService  If defaultRouteAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if defaultService is specified, defaultRouteAction cannot contain any weightedBackendServices. Conversely, if defaultRouteAction specifies any weightedBackendServices, defaultService must not be specified.
             * Only one of defaultService, defaultUrlRedirect  or defaultRouteAction.weightedBackendService must be set.
             * Authorization requires one or more of the following Google IAM permissions on the specified resource default_service:
             * - compute.backendBuckets.use
             * - compute.backendServices.use
             */
            defaultService?: pulumi.Input<string>;
            /**
             * When none of the specified pathRules or routeRules match, the request is redirected to a URL specified by defaultUrlRedirect.
             * If defaultUrlRedirect is specified, defaultService or defaultRouteAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            defaultUrlRedirect?: pulumi.Input<inputs.compute.v1.HttpRedirectAction>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * HeaderAction specified here are applied after the matching HttpRouteRule HeaderAction and before the HeaderAction in the UrlMap
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.v1.HttpHeaderAction>;
            /**
             * The name to which this PathMatcher is referred by the HostRule.
             */
            name?: pulumi.Input<string>;
            /**
             * The list of path rules. Use this list instead of routeRules when routing based on simple path matching is all that's required. The order by which path rules are specified does not matter. Matches are always done on the longest-path-first basis.
             * For example: a pathRule with a path /a/b/c/* will match before /a/b/* irrespective of the order in which those paths appear in this list.
             * Within a given pathMatcher, only one of pathRules or routeRules must be set.
             */
            pathRules?: pulumi.Input<pulumi.Input<inputs.compute.v1.PathRule>[]>;
            /**
             * The list of HTTP route rules. Use this list instead of pathRules when advanced route matching and routing actions are desired. routeRules are evaluated in order of priority, from the lowest to highest number.
             * Within a given pathMatcher, you can set only one of pathRules or routeRules.
             */
            routeRules?: pulumi.Input<pulumi.Input<inputs.compute.v1.HttpRouteRule>[]>;
        }
        /**
         * A path-matching rule for a URL. If matched, will use the specified BackendService to handle the traffic arriving at this URL.
         */
        interface PathRule {
            /**
             * The list of path patterns to match. Each must start with / and the only place a * is allowed is at the end following a /. The string fed to the path matcher does not include any text after the first ? or #, and those chars are not allowed here.
             */
            paths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * In response to a matching path, the load balancer performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected backend. If routeAction specifies any  weightedBackendServices, service must not be set. Conversely if service is set, routeAction cannot contain any  weightedBackendServices.
             * Only one of routeAction or urlRedirect must be set.
             * UrlMaps for external HTTP(S) load balancers support only the urlRewrite action within a pathRule's routeAction.
             */
            routeAction?: pulumi.Input<inputs.compute.v1.HttpRouteAction>;
            /**
             * The full or partial URL of the backend service resource to which traffic is directed if this rule is matched. If routeAction is additionally specified, advanced routing actions like URL Rewrites, etc. take effect prior to sending the request to the backend. However, if service is specified, routeAction cannot contain any weightedBackendService s. Conversely, if routeAction specifies any  weightedBackendServices, service must not be specified.
             * Only one of urlRedirect, service or routeAction.weightedBackendService must be set.
             */
            service?: pulumi.Input<string>;
            /**
             * When a path pattern is matched, the request is redirected to a URL specified by urlRedirect.
             * If urlRedirect is specified, service or routeAction must not be set.
             * Not supported when the URL map is bound to target gRPC proxy.
             */
            urlRedirect?: pulumi.Input<inputs.compute.v1.HttpRedirectAction>;
        }
        /**
         * Represents a CIDR range which can be used to assign addresses.
         */
        interface PublicAdvertisedPrefixPublicDelegatedPrefix {
            /**
             * The IP address range of the public delegated prefix
             */
            ipRange?: pulumi.Input<string>;
            /**
             * The name of the public delegated prefix
             */
            name?: pulumi.Input<string>;
            /**
             * The project number of the public delegated prefix
             */
            project?: pulumi.Input<string>;
            /**
             * The region of the public delegated prefix if it is regional. If absent, the prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * The status of the public delegated prefix. Possible values are: INITIALIZING: The public delegated prefix is being initialized and addresses cannot be created yet. ANNOUNCED: The public delegated prefix is active.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Represents a sub PublicDelegatedPrefix.
         */
        interface PublicDelegatedPrefixPublicDelegatedSubPrefix {
            /**
             * Name of the project scoping this PublicDelegatedSubPrefix.
             */
            delegateeProject?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * The IPv4 address range, in CIDR format, represented by this sub public delegated prefix.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * Whether the sub prefix is delegated to create Address resources in the delegatee project.
             */
            isAddress?: pulumi.Input<boolean>;
            /**
             * The name of the sub public delegated prefix.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] The region of the sub public delegated prefix if it is regional. If absent, the sub prefix is global.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the sub public delegated prefix.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * A policy that specifies how requests intended for the route's backends are shadowed to a separate mirrored backend service. Loadbalancer does not wait for responses from the shadow service. Prior to sending traffic to the shadow service, the host / authority header is suffixed with -shadow.
         */
        interface RequestMirrorPolicy {
            /**
             * The full or partial URL to the BackendService resource being mirrored to.
             */
            backendService?: pulumi.Input<string>;
        }
        /**
         * Represents a reservation resource. A reservation ensures that capacity is held in a specific zone even if the reserved VMs are not running. For more information, read  Reserving zonal resources. (== resource_for {$api_version}.reservations ==)
         */
        interface Reservation {
            /**
             * [Output Only] Full or partial URL to a parent commitment. This field displays for reservations that are tied to a commitment.
             */
            commitment?: pulumi.Input<string>;
            /**
             * [Output Only] Creation timestamp in RFC3339 text format.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The unique identifier for the resource. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always compute#reservations for reservations.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of the resource, provided by the client when initially creating the resource. The resource name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] Reserved for future use.
             */
            satisfiesPzs?: pulumi.Input<boolean>;
            /**
             * [Output Only] Server-defined fully-qualified URL for this resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * Reservation for instances with specific machine shapes.
             */
            specificReservation?: pulumi.Input<inputs.compute.v1.AllocationSpecificSKUReservation>;
            /**
             * Indicates whether the reservation can be consumed by VMs with affinity for "any" reservation. If the field is set, then only VMs that target the reservation by name can consume from this reservation.
             */
            specificReservationRequired?: pulumi.Input<boolean>;
            /**
             * [Output Only] The status of the reservation.
             */
            status?: pulumi.Input<string>;
            /**
             * Zone in which the reservation resides. A zone must be provided if the reservation is created within a commitment.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Specifies the reservations that this instance can consume from.
         */
        interface ReservationAffinity {
            /**
             * Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See  Consuming reserved instances for examples.
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify googleapis.com/reservation-name as the key and specify the name of your reservation as its value.
             */
            key?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of a reservation resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Commitment for a particular resource (a Commitment is composed of one or more of these).
         */
        interface ResourceCommitment {
            /**
             * Name of the accelerator type resource. Applicable only when the type is ACCELERATOR.
             */
            acceleratorType?: pulumi.Input<string>;
            /**
             * The amount of the resource purchased (in a type-dependent unit, such as bytes). For vCPUs, this can just be an integer. For memory, this must be provided in MB. Memory must be a multiple of 256 MB, with up to 6.5GB of memory per every vCPU.
             */
            amount?: pulumi.Input<string>;
            /**
             * Type of resource for which this commitment applies. Possible values are VCPU and MEMORY
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Time window specified for daily operations.
         */
        interface ResourcePolicyDailyCycle {
            /**
             * Defines a schedule with units measured in months. The value determines how many months pass between the start of each cycle.
             */
            daysInCycle?: pulumi.Input<number>;
            /**
             * [Output only] A predetermined duration for the window, automatically chosen to be the smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Start time of the window. This must be in UTC format that resolves to one of 00:00, 04:00, 08:00, 12:00, 16:00, or 20:00. For example, both 13:00-5 and 08:00 are valid.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * A GroupPlacementPolicy specifies resource placement configuration. It specifies the failure bucket separation as well as network locality
         */
        interface ResourcePolicyGroupPlacementPolicy {
            /**
             * The number of availability domains instances will be spread across. If two instances are in different availability domain, they will not be put in the same low latency network
             */
            availabilityDomainCount?: pulumi.Input<number>;
            /**
             * Specifies network collocation
             */
            collocation?: pulumi.Input<string>;
            /**
             * Number of vms in this placement group
             */
            vmCount?: pulumi.Input<number>;
        }
        /**
         * Time window specified for hourly operations.
         */
        interface ResourcePolicyHourlyCycle {
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Defines a schedule with units measured in hours. The value determines how many hours pass between the start of each cycle.
             */
            hoursInCycle?: pulumi.Input<number>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * An InstanceSchedulePolicy specifies when and how frequent certain operations are performed on the instance.
         */
        interface ResourcePolicyInstanceSchedulePolicy {
            /**
             * The expiration time of the schedule. The timestamp is an RFC3339 string.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * The start time of the schedule. The timestamp is an RFC3339 string.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Specifies the time zone to be used in interpreting Schedule.schedule. The value of this field must be a time zone name from the tz database: http://en.wikipedia.org/wiki/Tz_database.
             */
            timeZone?: pulumi.Input<string>;
            /**
             * Specifies the schedule for starting instances.
             */
            vmStartSchedule?: pulumi.Input<inputs.compute.v1.ResourcePolicyInstanceSchedulePolicySchedule>;
            /**
             * Specifies the schedule for stopping instances.
             */
            vmStopSchedule?: pulumi.Input<inputs.compute.v1.ResourcePolicyInstanceSchedulePolicySchedule>;
        }
        /**
         * Schedule for an instance operation.
         */
        interface ResourcePolicyInstanceSchedulePolicySchedule {
            /**
             * Specifies the frequency for the operation, using the unix-cron format.
             */
            schedule?: pulumi.Input<string>;
        }
        /**
         * Contains output only fields. Use this sub-message for all output fields set on ResourcePolicy. The internal structure of this "status" field should mimic the structure of ResourcePolicy proto specification.
         */
        interface ResourcePolicyResourceStatus {
            /**
             * [Output Only] Specifies a set of output values reffering to the instance_schedule_policy system status. This field should have the same name as corresponding policy field.
             */
            instanceSchedulePolicy?: pulumi.Input<inputs.compute.v1.ResourcePolicyResourceStatusInstanceSchedulePolicyStatus>;
        }
        interface ResourcePolicyResourceStatusInstanceSchedulePolicyStatus {
            /**
             * [Output Only] The last time the schedule successfully ran. The timestamp is an RFC3339 string.
             */
            lastRunStartTime?: pulumi.Input<string>;
            /**
             * [Output Only] The next time the schedule is planned to run. The actual time might be slightly different. The timestamp is an RFC3339 string.
             */
            nextRunStartTime?: pulumi.Input<string>;
        }
        /**
         * A snapshot schedule policy specifies when and how frequently snapshots are to be created for the target disk. Also specifies how many and how long these scheduled snapshots should be retained.
         */
        interface ResourcePolicySnapshotSchedulePolicy {
            /**
             * Retention policy applied to snapshots created by this resource policy.
             */
            retentionPolicy?: pulumi.Input<inputs.compute.v1.ResourcePolicySnapshotSchedulePolicyRetentionPolicy>;
            /**
             * A Vm Maintenance Policy specifies what kind of infrastructure maintenance we are allowed to perform on this VM and when. Schedule that is applied to disks covered by this policy.
             */
            schedule?: pulumi.Input<inputs.compute.v1.ResourcePolicySnapshotSchedulePolicySchedule>;
            /**
             * Properties with which snapshots are created such as labels, encryption keys.
             */
            snapshotProperties?: pulumi.Input<inputs.compute.v1.ResourcePolicySnapshotSchedulePolicySnapshotProperties>;
        }
        /**
         * Policy for retention of scheduled snapshots.
         */
        interface ResourcePolicySnapshotSchedulePolicyRetentionPolicy {
            /**
             * Maximum age of the snapshot that is allowed to be kept.
             */
            maxRetentionDays?: pulumi.Input<number>;
            /**
             * Specifies the behavior to apply to scheduled snapshots when the source disk is deleted.
             */
            onSourceDiskDelete?: pulumi.Input<string>;
        }
        /**
         * A schedule for disks where the schedueled operations are performed.
         */
        interface ResourcePolicySnapshotSchedulePolicySchedule {
            dailySchedule?: pulumi.Input<inputs.compute.v1.ResourcePolicyDailyCycle>;
            hourlySchedule?: pulumi.Input<inputs.compute.v1.ResourcePolicyHourlyCycle>;
            weeklySchedule?: pulumi.Input<inputs.compute.v1.ResourcePolicyWeeklyCycle>;
        }
        /**
         * Specified snapshot properties for scheduled snapshots created by this policy.
         */
        interface ResourcePolicySnapshotSchedulePolicySnapshotProperties {
            /**
             * Chain name that the snapshot is created in.
             */
            chainName?: pulumi.Input<string>;
            /**
             * Indication to perform a 'guest aware' snapshot.
             */
            guestFlush?: pulumi.Input<boolean>;
            /**
             * Labels to apply to scheduled snapshots. These can be later modified by the setLabels method. Label values may be empty.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Cloud Storage bucket storage location of the auto snapshot (regional or multi-regional).
             */
            storageLocations?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Time window specified for weekly operations.
         */
        interface ResourcePolicyWeeklyCycle {
            /**
             * Up to 7 intervals/windows, one for each day of the week.
             */
            dayOfWeeks?: pulumi.Input<pulumi.Input<inputs.compute.v1.ResourcePolicyWeeklyCycleDayOfWeek>[]>;
        }
        interface ResourcePolicyWeeklyCycleDayOfWeek {
            /**
             * Defines a schedule that runs on specific days of the week. Specify one or more days. The following options are available: MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, SUNDAY.
             */
            day?: pulumi.Input<string>;
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Time within the window to start the operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-00] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Description-tagged IP ranges for the router to advertise.
         */
        interface RouterAdvertisedIpRange {
            /**
             * User-specified description for the IP range.
             */
            description?: pulumi.Input<string>;
            /**
             * The IP range to advertise. The value must be a CIDR-formatted string.
             */
            range?: pulumi.Input<string>;
        }
        interface RouterBgp {
            /**
             * User-specified flag to indicate which mode to use for advertisement. The options are DEFAULT or CUSTOM.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These groups will be advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and is advertised to all peers of the router. These IP ranges will be advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.v1.RouterAdvertisedIpRange>[]>;
            /**
             * Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. All VPN tunnels that link to this router will have the same local ASN.
             */
            asn?: pulumi.Input<number>;
        }
        interface RouterBgpPeer {
            /**
             * User-specified flag to indicate which mode to use for advertisement.
             */
            advertiseMode?: pulumi.Input<string>;
            /**
             * User-specified list of prefix groups to advertise in custom mode, which can take one of the following options:
             * - ALL_SUBNETS: Advertises all available subnets, including peer VPC subnets.
             * - ALL_VPC_SUBNETS: Advertises the router's own VPC subnets. Note that this field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These groups are advertised in addition to any specified prefixes. Leave this field blank to advertise no custom groups.
             */
            advertisedGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * User-specified list of individual IP ranges to advertise in custom mode. This field can only be populated if advertise_mode is CUSTOM and overrides the list defined for the router (in the "bgp" message). These IP ranges are advertised in addition to any specified groups. Leave this field blank to advertise no custom IP ranges.
             */
            advertisedIpRanges?: pulumi.Input<pulumi.Input<inputs.compute.v1.RouterAdvertisedIpRange>[]>;
            /**
             * The priority of routes advertised to this BGP peer. Where there is more than one matching route of maximum length, the routes with the lowest priority value win.
             */
            advertisedRoutePriority?: pulumi.Input<number>;
            /**
             * Name of the interface the BGP peer is associated with.
             */
            interfaceName?: pulumi.Input<string>;
            /**
             * IP address of the interface inside Google Cloud Platform. Only IPv4 is supported.
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this BGP peer.
             * - MANAGED_BY_USER is the default value and can be managed by you or other users
             * - MANAGED_BY_ATTACHMENT is a BGP peer that is configured and managed by Cloud Interconnect, specifically by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of BGP peer when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this BGP peer. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
            /**
             * Peer BGP Autonomous System Number (ASN). Each BGP interface may use a different value.
             */
            peerAsn?: pulumi.Input<number>;
            /**
             * IP address of the BGP interface outside Google Cloud Platform. Only IPv4 is supported.
             */
            peerIpAddress?: pulumi.Input<string>;
        }
        interface RouterInterface {
            /**
             * IP address and range of the interface. The IP range must be in the RFC3927 link-local IP address space. The value must be a CIDR-formatted string, for example: 169.254.0.1/30. NOTE: Do not truncate the address as it represents the IP address of the interface.
             */
            ipRange?: pulumi.Input<string>;
            /**
             * URI of the linked Interconnect attachment. It must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedInterconnectAttachment?: pulumi.Input<string>;
            /**
             * URI of the linked VPN tunnel, which must be in the same region as the router. Each interface can have one linked resource, which can be a VPN tunnel, an Interconnect attachment, or a virtual machine instance.
             */
            linkedVpnTunnel?: pulumi.Input<string>;
            /**
             * [Output Only] The resource that configures and manages this interface.
             * - MANAGED_BY_USER is the default value and can be managed directly by users.
             * - MANAGED_BY_ATTACHMENT is an interface that is configured and managed by Cloud Interconnect, specifically, by an InterconnectAttachment of type PARTNER. Google automatically creates, updates, and deletes this type of interface when the PARTNER InterconnectAttachment is created, updated, or deleted.
             */
            managementType?: pulumi.Input<string>;
            /**
             * Name of this interface entry. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Represents a Nat resource. It enables the VMs within the specified subnetworks to access Internet without external IP addresses. It specifies a list of subnetworks (and the ranges within) that want to use NAT. Customers can also provide the external IPs that would be used for NAT. GCP would auto-allocate ephemeral IPs if no external IPs are provided.
         */
        interface RouterNat {
            /**
             * A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT only.
             */
            drainNatIps?: pulumi.Input<pulumi.Input<string>[]>;
            enableEndpointIndependentMapping?: pulumi.Input<boolean>;
            /**
             * Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.
             */
            icmpIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Configure logging on this NAT.
             */
            logConfig?: pulumi.Input<inputs.compute.v1.RouterNatLogConfig>;
            /**
             * Minimum number of ports allocated to a VM from this NAT config. If not set, a default number of ports is allocated to a VM. This is rounded up to the nearest power of 2. For example, if the value of this field is 50, at least 64 ports are allocated to a VM.
             */
            minPortsPerVm?: pulumi.Input<number>;
            /**
             * Unique name of this Nat service. The name must be 1-63 characters long and comply with RFC1035.
             */
            name?: pulumi.Input<string>;
            /**
             * Specify the NatIpAllocateOption, which can take one of the following values:
             * - MANUAL_ONLY: Uses only Nat IP addresses provided by customers. When there are not enough specified Nat IPs, the Nat service fails for new VMs.
             * - AUTO_ONLY: Nat IPs are allocated by Google Cloud Platform; customers can't specify any Nat IPs. When choosing AUTO_ONLY, then nat_ip should be empty.
             */
            natIpAllocateOption?: pulumi.Input<string>;
            /**
             * A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
             */
            natIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specify the Nat option, which can take one of the following values:
             * - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat.
             * - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat.
             * - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
             */
            sourceSubnetworkIpRangesToNat?: pulumi.Input<string>;
            /**
             * A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
             */
            subnetworks?: pulumi.Input<pulumi.Input<inputs.compute.v1.RouterNatSubnetworkToNat>[]>;
            /**
             * Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
             */
            tcpEstablishedIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
             */
            tcpTransitoryIdleTimeoutSec?: pulumi.Input<number>;
            /**
             * Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
             */
            udpIdleTimeoutSec?: pulumi.Input<number>;
        }
        /**
         * Configuration of logging on a NAT.
         */
        interface RouterNatLogConfig {
            /**
             * Indicates whether or not to export logs. This is false by default.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Specify the desired filtering of logs on this NAT. If unspecified, logs are exported for all connections handled by this NAT. This option can take one of the following values:
             * - ERRORS_ONLY: Export logs only for connection failures.
             * - TRANSLATIONS_ONLY: Export logs only for successful connections.
             * - ALL: Export logs for all connections, successful and unsuccessful.
             */
            filter?: pulumi.Input<string>;
        }
        /**
         * Defines the IP ranges that want to use NAT for a subnetwork.
         */
        interface RouterNatSubnetworkToNat {
            /**
             * URL for the subnetwork resource that will use NAT.
             */
            name?: pulumi.Input<string>;
            /**
             * A list of the secondary ranges of the Subnetwork that are allowed to use NAT. This can be populated only if "LIST_OF_SECONDARY_IP_RANGES" is one of the values in source_ip_ranges_to_nat.
             */
            secondaryIpRangeNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specify the options for NAT ranges in the Subnetwork. All options of a single value are valid except NAT_IP_RANGE_OPTION_UNSPECIFIED. The only valid option with multiple values is: ["PRIMARY_IP_RANGE", "LIST_OF_SECONDARY_IP_RANGES"] Default: [ALL_IP_RANGES]
             */
            sourceIpRangesToNat?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A rule to be applied in a Policy.
         */
        interface Rule {
            /**
             * Required
             */
            action?: pulumi.Input<string>;
            /**
             * Additional restrictions that must be met. All conditions must pass for the rule to match.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.compute.v1.Condition>[]>;
            /**
             * Human-readable description of the rule.
             */
            description?: pulumi.Input<string>;
            /**
             * If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
             */
            ins?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
             */
            logConfigs?: pulumi.Input<pulumi.Input<inputs.compute.v1.LogConfig>[]>;
            /**
             * If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
             */
            notIns?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
             */
            permissions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface SSLHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 443. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, SSL health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the SSL connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * Sets the scheduling options for an Instance. NextID: 20
         */
        interface Scheduling {
            /**
             * Specifies whether the instance should be automatically restarted if it is terminated by Compute Engine (not terminated by a user). You can only set the automatic restart option for standard instances. Preemptible instances cannot be automatically restarted.
             *
             * By default, this is set to true so an instance is automatically restarted if it is terminated by Compute Engine.
             */
            automaticRestart?: pulumi.Input<boolean>;
            /**
             * An opaque location hint used to place the instance close to other resources. This field is for use by internal tools that use the public API.
             */
            locationHint?: pulumi.Input<string>;
            /**
             * The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node.
             */
            minNodeCpus?: pulumi.Input<number>;
            /**
             * A set of node affinity and anti-affinity configurations. Refer to Configuring node affinity for more information. Overrides reservationAffinity.
             */
            nodeAffinities?: pulumi.Input<pulumi.Input<inputs.compute.v1.SchedulingNodeAffinity>[]>;
            /**
             * Defines the maintenance behavior for this instance. For standard instances, the default behavior is MIGRATE. For preemptible instances, the default and only possible behavior is TERMINATE. For more information, see Setting Instance Scheduling Options.
             */
            onHostMaintenance?: pulumi.Input<string>;
            /**
             * Defines whether the instance is preemptible. This can only be set during instance creation or while the instance is stopped and therefore, in a `TERMINATED` state. See Instance Life Cycle for more information on the possible instance states.
             */
            preemptible?: pulumi.Input<boolean>;
        }
        /**
         * Node Affinity: the configuration of desired nodes onto which this Instance could be scheduled.
         */
        interface SchedulingNodeAffinity {
            /**
             * Corresponds to the label key of Node resource.
             */
            key?: pulumi.Input<string>;
            /**
             * Defines the operation of node selection. Valid operators are IN for affinity and NOT_IN for anti-affinity.
             */
            operator?: pulumi.Input<string>;
            /**
             * Corresponds to the label values of Node resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
         */
        interface SecurityPolicyRule {
            /**
             * The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.
             */
            action?: pulumi.Input<string>;
            /**
             * An optional description of this resource. Provide this property when you create the resource.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output only] Type of the resource. Always compute#securityPolicyRule for security policy rules
             */
            kind?: pulumi.Input<string>;
            /**
             * A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
             */
            match?: pulumi.Input<inputs.compute.v1.SecurityPolicyRuleMatcher>;
            /**
             * If set to true, the specified action is not enforced.
             */
            preview?: pulumi.Input<boolean>;
            /**
             * An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
             */
            priority?: pulumi.Input<number>;
        }
        /**
         * Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
         */
        interface SecurityPolicyRuleMatcher {
            /**
             * The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified.
             */
            config?: pulumi.Input<inputs.compute.v1.SecurityPolicyRuleMatcherConfig>;
            /**
             * User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
             */
            expr?: pulumi.Input<inputs.compute.v1.Expr>;
            /**
             * Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding src_ip_range field in config.
             */
            versionedExpr?: pulumi.Input<string>;
        }
        interface SecurityPolicyRuleMatcherConfig {
            /**
             * CIDR IP address range. Maximum number of src_ip_ranges allowed is 10.
             */
            srcIpRanges?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The authentication and authorization settings for a BackendService.
         */
        interface SecuritySettings {
            /**
             * Optional. A URL referring to a networksecurity.ClientTlsPolicy resource that describes how clients should authenticate with this service's backends.
             * clientTlsPolicy only applies to a global BackendService with the loadBalancingScheme set to INTERNAL_SELF_MANAGED.
             * If left blank, communications are not encrypted.
             * Note: This field currently has no impact.
             */
            clientTlsPolicy?: pulumi.Input<string>;
            /**
             * Optional. A list of Subject Alternative Names (SANs) that the client verifies during a mutual TLS handshake with an server/endpoint for this BackendService. When the server presents its X.509 certificate to the client, the client inspects the certificate's subjectAltName field. If the field contains one of the specified values, the communication continues. Otherwise, it fails. This additional check enables the client to verify that the server is authorized to run the requested service.
             * Note that the contents of the server certificate's subjectAltName field are configured by the Public Key Infrastructure which provisions server identities.
             * Only applies to a global BackendService with loadBalancingScheme set to INTERNAL_SELF_MANAGED. Only applies when BackendService has an attached clientTlsPolicy with clientCertificate (mTLS mode).
             * Note: This field currently has no impact.
             */
            subjectAltNames?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface ServerBinding {
            type?: pulumi.Input<string>;
        }
        /**
         * A service account.
         */
        interface ServiceAccount {
            /**
             * Email address of the service account.
             */
            email?: pulumi.Input<string>;
            /**
             * The list of scopes to be made available for this service account.
             */
            scopes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A set of Shielded Instance options.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enabled by default.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Disabled by default.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled. Enabled by default.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The policy describes the baseline against which Instance boot integrity is measured.
         */
        interface ShieldedInstanceIntegrityPolicy {
            /**
             * Updates the integrity policy baseline using the measurements from the VM instance's most recent boot.
             */
            updateAutoLearnPolicy?: pulumi.Input<boolean>;
        }
        /**
         * A specification of the parameters to use when creating the instance template from a source instance.
         */
        interface SourceInstanceParams {
            /**
             * Attached disks configuration. If not provided, defaults are applied: For boot disk and any other R/W disks, new custom images will be created from each disk. For read-only disks, they will be attached in read-only mode. Local SSD disks will be created as blank volumes.
             */
            diskConfigs?: pulumi.Input<pulumi.Input<inputs.compute.v1.DiskInstantiationConfig>[]>;
        }
        /**
         * Configuration and status of a managed SSL certificate.
         */
        interface SslCertificateManagedSslCertificate {
            /**
             * [Output only] Detailed statuses of the domains specified for managed certificate resource.
             */
            domainStatus?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The domains for which a managed SSL certificate will be generated. Each Google-managed SSL certificate supports up to the [maximum number of domains per Google-managed SSL certificate](/load-balancing/docs/quotas#ssl_certificates).
             */
            domains?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * [Output only] Status of the managed certificate resource.
             */
            status?: pulumi.Input<string>;
        }
        /**
         * Configuration and status of a self-managed SSL certificate.
         */
        interface SslCertificateSelfManagedSslCertificate {
            /**
             * A local certificate file. The certificate must be in PEM format. The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert.
             */
            certificate?: pulumi.Input<string>;
            /**
             * A write-only private key in PEM format. Only insert requests will include this field.
             */
            privateKey?: pulumi.Input<string>;
        }
        interface StatefulPolicy {
            preservedState?: pulumi.Input<inputs.compute.v1.StatefulPolicyPreservedState>;
        }
        /**
         * Configuration of preserved resources.
         */
        interface StatefulPolicyPreservedState {
            /**
             * Disks created on the instances that will be preserved on instance delete, update, etc. This map is keyed with the device names of the disks.
             */
            disks?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * The available logging options for this subnetwork.
         */
        interface SubnetworkLogConfig {
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Default is an interval of 5 seconds per connection.
             */
            aggregationInterval?: pulumi.Input<string>;
            /**
             * Whether to enable flow logging for this subnetwork. If this field is not explicitly set, it will not appear in get listings. If not set the default behavior is to disable flow logging.
             */
            enable?: pulumi.Input<boolean>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Export filter used to define which VPC flow logs should be logged.
             */
            filterExpr?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logging for this subnetwork is enabled. The value of the field must be in [0, 1]. Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. Default is 0.5, which means half of all collected logs are reported.
             */
            flowSampling?: pulumi.Input<number>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled. Configures whether all, none or a subset of metadata fields should be added to the reported VPC flow logs. Default is EXCLUDE_ALL_METADATA.
             */
            metadata?: pulumi.Input<string>;
            /**
             * Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" was set to CUSTOM_METADATA.
             */
            metadataFields?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a secondary IP range of a subnetwork.
         */
        interface SubnetworkSecondaryRange {
            /**
             * The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported. The range can be any range listed in the Valid ranges list.
             */
            ipCidrRange?: pulumi.Input<string>;
            /**
             * The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.
             */
            rangeName?: pulumi.Input<string>;
        }
        interface TCPHealthCheck {
            /**
             * The TCP port number for the health check request. The default value is 80. Valid values are 1 through 65535.
             */
            port?: pulumi.Input<number>;
            /**
             * Port name as defined in InstanceGroup#NamedPort#name. If both port and port_name are defined, port takes precedence.
             */
            portName?: pulumi.Input<string>;
            /**
             * Specifies how port is selected for health checking, can be one of following values:
             * USE_FIXED_PORT: The port number in port is used for health checking.
             * USE_NAMED_PORT: The portName is used for health checking.
             * USE_SERVING_PORT: For NetworkEndpointGroup, the port specified for each network endpoint is used for health checking. For other backends, the port or named port specified in the Backend Service is used for health checking.
             *
             *
             * If not specified, TCP health check follows behavior specified in port and portName fields.
             */
            portSpecification?: pulumi.Input<string>;
            /**
             * Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
             */
            proxyHeader?: pulumi.Input<string>;
            /**
             * The application data to send once the TCP connection has been established (default value is empty). If both request and response are empty, the connection establishment alone will indicate health. The request data can only be ASCII.
             */
            request?: pulumi.Input<string>;
            /**
             * The bytes to match against the beginning of the response data. If left empty (the default value), any response will indicate health. The response data can only be ASCII.
             */
            response?: pulumi.Input<string>;
        }
        /**
         * A set of instance tags.
         */
        interface Tags {
            /**
             * Specifies a fingerprint for this request, which is essentially a hash of the tags' contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update tags. You must always provide an up-to-date fingerprint hash in order to update or change tags.
             *
             * To see the latest fingerprint, make get() request to the instance.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * An array of tags. Each tag must be 1-63 characters long, and comply with RFC1035.
             */
            items?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Message for the expected URL mappings.
         */
        interface UrlMapTest {
            /**
             * Description of this test case.
             */
            description?: pulumi.Input<string>;
            /**
             * The expected output URL evaluated by load balancer containing the scheme, host, path and query parameters.
             * For rules that forward requests to backends, the test passes only when expectedOutputUrl matches the request forwarded by load balancer to backends. For rules with urlRewrite, the test verifies that the forwarded request matches hostRewrite and pathPrefixRewrite in the urlRewrite action. When service is specified, expectedOutputUrl`s scheme is ignored.
             * For rules with urlRedirect, the test passes only if expectedOutputUrl matches the URL in the load balancer's redirect response. If urlRedirect specifies https_redirect, the test passes only if the scheme in expectedOutputUrl is also set to https. If urlRedirect specifies strip_query, the test passes only if expectedOutputUrl does not contain any query parameters.
             * expectedOutputUrl is optional when service is specified.
             */
            expectedOutputUrl?: pulumi.Input<string>;
            /**
             * For rules with urlRedirect, the test passes only if expectedRedirectResponseCode matches the HTTP status code in load balancer's redirect response.
             * expectedRedirectResponseCode cannot be set when service is set.
             */
            expectedRedirectResponseCode?: pulumi.Input<number>;
            /**
             * HTTP headers for this request. If headers contains a host header, then host must also match the header value.
             */
            headers?: pulumi.Input<pulumi.Input<inputs.compute.v1.UrlMapTestHeader>[]>;
            /**
             * Host portion of the URL. If headers contains a host header, then host must also match the header value.
             */
            host?: pulumi.Input<string>;
            /**
             * Path portion of the URL.
             */
            path?: pulumi.Input<string>;
            /**
             * Expected BackendService or BackendBucket resource the given URL should be mapped to.
             * service cannot be set if expectedRedirectResponseCode is set.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * HTTP headers used in UrlMapTests.
         */
        interface UrlMapTestHeader {
            /**
             * Header name.
             */
            name?: pulumi.Input<string>;
            /**
             * Header value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * The spec for modifying the path before sending the request to the matched backend service.
         */
        interface UrlRewrite {
            /**
             * Prior to forwarding the request to the selected service, the request's host header is replaced with contents of hostRewrite.
             * The value must be between 1 and 255 characters.
             */
            hostRewrite?: pulumi.Input<string>;
            /**
             * Prior to forwarding the request to the selected backend service, the matching portion of the request's path is replaced by pathPrefixRewrite.
             * The value must be between 1 and 1024 characters.
             */
            pathPrefixRewrite?: pulumi.Input<string>;
        }
        /**
         * A VPN gateway interface.
         */
        interface VpnGatewayVpnGatewayInterface {
            /**
             * The numeric ID of this VPN gateway interface.
             */
            id?: pulumi.Input<number>;
            /**
             * URL of the interconnect attachment resource. When the value of this field is present, the VPN Gateway will be used for IPsec-encrypted Cloud Interconnect; all Egress or Ingress traffic for this VPN Gateway interface will go through the specified interconnect attachment resource.
             * Not currently available in all Interconnect locations.
             */
            interconnectAttachment?: pulumi.Input<string>;
            /**
             * [Output Only] The external IP address for this VPN gateway interface.
             */
            ipAddress?: pulumi.Input<string>;
        }
        /**
         * In contrast to a single BackendService in  HttpRouteAction to which all matching traffic is directed to, WeightedBackendService allows traffic to be split across multiple BackendServices. The volume of traffic for each BackendService is proportional to the weight specified in each WeightedBackendService
         */
        interface WeightedBackendService {
            /**
             * The full or partial URL to the default BackendService resource. Before forwarding the request to backendService, the loadbalancer applies any relevant headerActions specified as part of this backendServiceWeight.
             */
            backendService?: pulumi.Input<string>;
            /**
             * Specifies changes to request and response headers that need to take effect for the selected backendService.
             * headerAction specified here take effect before headerAction in the enclosing HttpRouteRule, PathMatcher and UrlMap.
             * Note that headerAction is not supported for Loadbalancers that have their loadBalancingScheme set to EXTERNAL.
             * Not supported when the URL map is bound to target gRPC proxy that has validateForProxyless field set to true.
             */
            headerAction?: pulumi.Input<inputs.compute.v1.HttpHeaderAction>;
            /**
             * Specifies the fraction of traffic sent to backendService, computed as weight / (sum of all weightedBackendService weights in routeAction) .
             * The selection of a backend service is determined only for new traffic. Once a user's request has been directed to a backendService, subsequent requests will be sent to the same backendService as determined by the BackendService's session affinity policy.
             * The value must be between 0 and 1000
             */
            weight?: pulumi.Input<number>;
        }
    }
}
export declare namespace container {
    namespace v1 {
        /**
         * AcceleratorConfig represents a Hardware Accelerator request.
         */
        interface AcceleratorConfig {
            /**
             * The number of the accelerator cards exposed to an instance.
             */
            acceleratorCount?: pulumi.Input<string>;
            /**
             * The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality.
         */
        interface AddonsConfig {
            /**
             * Configuration for the Cloud Run addon, which allows the user to use a managed Knative service.
             */
            cloudRunConfig?: pulumi.Input<inputs.container.v1.CloudRunConfig>;
            /**
             * Configuration for the ConfigConnector add-on, a Kubernetes extension to manage hosted GCP services through the Kubernetes API
             */
            configConnectorConfig?: pulumi.Input<inputs.container.v1.ConfigConnectorConfig>;
            /**
             * Configuration for NodeLocalDNS, a dns cache running on cluster nodes
             */
            dnsCacheConfig?: pulumi.Input<inputs.container.v1.DnsCacheConfig>;
            /**
             * Configuration for the Compute Engine Persistent Disk CSI driver.
             */
            gcePersistentDiskCsiDriverConfig?: pulumi.Input<inputs.container.v1.GcePersistentDiskCsiDriverConfig>;
            /**
             * Configuration for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.
             */
            horizontalPodAutoscaling?: pulumi.Input<inputs.container.v1.HorizontalPodAutoscaling>;
            /**
             * Configuration for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.
             */
            httpLoadBalancing?: pulumi.Input<inputs.container.v1.HttpLoadBalancing>;
            /**
             * Configuration for the Kubernetes Dashboard. This addon is deprecated, and will be disabled in 1.15. It is recommended to use the Cloud Console to manage and monitor your Kubernetes clusters, workloads and applications. For more information, see: https://cloud.google.com/kubernetes-engine/docs/concepts/dashboards
             */
            kubernetesDashboard?: pulumi.Input<inputs.container.v1.KubernetesDashboard>;
            /**
             * Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.
             */
            networkPolicyConfig?: pulumi.Input<inputs.container.v1.NetworkPolicyConfig>;
        }
        /**
         * Configuration for returning group information from authenticators.
         */
        interface AuthenticatorGroupsConfig {
            /**
             * Whether this cluster should return group membership lookups during authentication using a group of security groups.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The name of the security group-of-groups to be used. Only relevant if enabled = true.
             */
            securityGroup?: pulumi.Input<string>;
        }
        /**
         * AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.
         */
        interface AutoUpgradeOptions {
            /**
             * [Output only] This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
             */
            autoUpgradeStartTime?: pulumi.Input<string>;
            /**
             * [Output only] This field is set when upgrades are about to commence with the description of the upgrade.
             */
            description?: pulumi.Input<string>;
        }
        /**
         * Autopilot is the configuration for Autopilot settings on the cluster.
         */
        interface Autopilot {
            /**
             * Enable Autopilot
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.
         */
        interface AutoprovisioningNodePoolDefaults {
            /**
             * The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             */
            bootDiskKmsKey?: pulumi.Input<string>;
            /**
             * Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
             */
            diskType?: pulumi.Input<string>;
            /**
             * Specifies the node management options for NAP created node-pools.
             */
            management?: pulumi.Input<inputs.container.v1.NodeManagement>;
            /**
             * Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: Intel Haswell or minCpuPlatform: Intel Sandy Bridge. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform) To unset the min cpu platform field pass "automatic" as field value.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Scopes that are used by NAP when creating node pools.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The Google Cloud Platform Service Account to be used by the node VMs.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Shielded Instance options.
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.container.v1.ShieldedInstanceConfig>;
            /**
             * Specifies the upgrade settings for NAP created node pools
             */
            upgradeSettings?: pulumi.Input<inputs.container.v1.UpgradeSettings>;
        }
        /**
         * Parameters for using BigQuery as the destination of resource usage export.
         */
        interface BigQueryDestination {
            /**
             * The ID of a BigQuery Dataset.
             */
            datasetId?: pulumi.Input<string>;
        }
        /**
         * Configuration for Binary Authorization.
         */
        interface BinaryAuthorization {
            /**
             * Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Binary Authorization.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * CidrBlock contains an optional name and one CIDR block.
         */
        interface CidrBlock {
            /**
             * cidr_block must be specified in CIDR notation.
             */
            cidrBlock?: pulumi.Input<string>;
            /**
             * display_name is an optional field for users to identify CIDR blocks.
             */
            displayName?: pulumi.Input<string>;
        }
        /**
         * Configuration for client certificates on the cluster.
         */
        interface ClientCertificateConfig {
            /**
             * Issue a client certificate.
             */
            issueClientCertificate?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the Cloud Run feature.
         */
        interface CloudRunConfig {
            /**
             * Whether Cloud Run addon is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Which load balancer type is installed for Cloud Run.
             */
            loadBalancerType?: pulumi.Input<string>;
        }
        /**
         * ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs.
         */
        interface ClusterAutoscaling {
            /**
             * The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes can be created by NAP.
             */
            autoprovisioningLocations?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.
             */
            autoprovisioningNodePoolDefaults?: pulumi.Input<inputs.container.v1.AutoprovisioningNodePoolDefaults>;
            /**
             * Enables automatic node pool creation and deletion.
             */
            enableNodeAutoprovisioning?: pulumi.Input<boolean>;
            /**
             * Contains global constraints regarding minimum and maximum amount of resources in the cluster.
             */
            resourceLimits?: pulumi.Input<pulumi.Input<inputs.container.v1.ResourceLimit>[]>;
        }
        /**
         * Configuration options for the Config Connector add-on.
         */
        interface ConfigConnectorConfig {
            /**
             * Whether Cloud Connector is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters for controlling consumption metering.
         */
        interface ConsumptionMeteringConfig {
            /**
             * Whether to enable consumption metering for this cluster. If enabled, a second BigQuery table will be created to hold resource consumption records.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Time window specified for daily maintenance operations.
         */
        interface DailyMaintenanceWindow {
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario. Duration will be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format "PTnHnMnS".
             */
            duration?: pulumi.Input<string>;
            /**
             * Time within the maintenance window to start the maintenance operations. Time format should be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format "HH:MM", where HH : [00-23] and MM : [00-59] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Configuration of etcd encryption.
         */
        interface DatabaseEncryption {
            /**
             * Name of CloudKMS key to use for the encryption of secrets in etcd. Ex. projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key
             */
            keyName?: pulumi.Input<string>;
            /**
             * Denotes the state of etcd encryption.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster.
         */
        interface DefaultSnatStatus {
            /**
             * Disables cluster default sNAT rules.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for NodeLocal DNSCache
         */
        interface DnsCacheConfig {
            /**
             * Whether NodeLocal DNSCache is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the Compute Engine PD CSI driver.
         */
        interface GcePersistentDiskCsiDriverConfig {
            /**
             * Whether the Compute Engine PD CSI driver is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.
         */
        interface HorizontalPodAutoscaling {
            /**
             * Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.
         */
        interface HttpLoadBalancing {
            /**
             * Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for controlling how IPs are allocated in the cluster.
         */
        interface IPAllocationPolicy {
            /**
             * This field is deprecated, use cluster_ipv4_cidr_block.
             */
            clusterIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range for the cluster pod IPs. If this field is set, then `cluster.cluster_ipv4_cidr` must be left blank. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            clusterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The name of the secondary range to be used for the cluster CIDR block. The secondary range will be used for pod IP addresses. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.
             */
            clusterSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Whether a new subnetwork will be created automatically for the cluster. This field is only applicable when `use_ip_aliases` is true.
             */
            createSubnetwork?: pulumi.Input<boolean>;
            /**
             * This field is deprecated, use node_ipv4_cidr_block.
             */
            nodeIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range of the instance IPs in this cluster. This is applicable only if `create_subnetwork` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            nodeIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * This field is deprecated, use services_ipv4_cidr_block.
             */
            servicesIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range of the services IPs in this cluster. If blank, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            servicesIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The name of the secondary range to be used as for the services CIDR block. The secondary range will be used for service ClusterIPs. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.
             */
            servicesSecondaryRangeName?: pulumi.Input<string>;
            /**
             * A custom subnetwork name to be used if `create_subnetwork` is true. If this field is empty, then an automatic name will be chosen for the new subnetwork.
             */
            subnetworkName?: pulumi.Input<string>;
            /**
             * The IP address range of the Cloud TPUs in this cluster. If unspecified, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. If unspecified, the range will use the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            tpuIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Whether alias IPs will be used for pod IPs in the cluster. This is used in conjunction with use_routes. It cannot be true if use_routes is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode
             */
            useIpAliases?: pulumi.Input<boolean>;
            /**
             * Whether routes will be used for pod IPs in the cluster. This is used in conjunction with use_ip_aliases. It cannot be true if use_ip_aliases is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode
             */
            useRoutes?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the Kubernetes Dashboard.
         */
        interface KubernetesDashboard {
            /**
             * Whether the Kubernetes Dashboard is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the legacy Attribute Based Access Control authorization mode.
         */
        interface LegacyAbac {
            /**
             * Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters that can be configured on Linux nodes.
         */
        interface LinuxNodeConfig {
            /**
             * The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.netdev_max_backlog net.core.rmem_max net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse
             */
            sysctls?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * MaintenancePolicy defines the maintenance policy to be used for the cluster.
         */
        interface MaintenancePolicy {
            /**
             * A hash identifying the version of this policy, so that updates to fields of the policy won't accidentally undo intermediate changes (and so that users of the API unaware of some fields won't accidentally remove other fields). Make a `get()` request to the cluster to get the current resource version and include it with requests to set the policy.
             */
            resourceVersion?: pulumi.Input<string>;
            /**
             * Specifies the maintenance window in which maintenance may be performed.
             */
            window?: pulumi.Input<inputs.container.v1.MaintenanceWindow>;
        }
        /**
         * MaintenanceWindow defines the maintenance window to be used for the cluster.
         */
        interface MaintenanceWindow {
            /**
             * DailyMaintenanceWindow specifies a daily maintenance operation window.
             */
            dailyMaintenanceWindow?: pulumi.Input<inputs.container.v1.DailyMaintenanceWindow>;
            /**
             * Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.
             */
            maintenanceExclusions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * RecurringWindow specifies some number of recurring time periods for maintenance to occur. The time windows may be overlapping. If no maintenance windows are set, maintenance can occur at any time.
             */
            recurringWindow?: pulumi.Input<inputs.container.v1.RecurringTimeWindow>;
        }
        /**
         * The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.
         */
        interface MasterAuth {
            /**
             * [Output only] Base64-encoded public certificate used by clients to authenticate to the cluster endpoint.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * Configuration for client certificate authentication on the cluster. For clusters before v1.12, if no configuration is specified, a client certificate is issued.
             */
            clientCertificateConfig?: pulumi.Input<inputs.container.v1.ClientCertificateConfig>;
            /**
             * [Output only] Base64-encoded private key used by clients to authenticate to the cluster endpoint.
             */
            clientKey?: pulumi.Input<string>;
            /**
             * [Output only] Base64-encoded public certificate that is the root of trust for the cluster.
             */
            clusterCaCertificate?: pulumi.Input<string>;
            /**
             * The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
             */
            password?: pulumi.Input<string>;
            /**
             * The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.
         */
        interface MasterAuthorizedNetworksConfig {
            /**
             * cidr_blocks define up to 50 external networks that could access Kubernetes master through HTTPS.
             */
            cidrBlocks?: pulumi.Input<pulumi.Input<inputs.container.v1.CidrBlock>[]>;
            /**
             * Whether or not master authorized networks is enabled.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Constraints applied to pods.
         */
        interface MaxPodsConstraint {
            /**
             * Constraint enforced on the max num of pods per node.
             */
            maxPodsPerNode?: pulumi.Input<string>;
        }
        /**
         * NetworkConfig reports the relative names of network & subnetwork.
         */
        interface NetworkConfig {
            /**
             * Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when default_snat_status is disabled. When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic.
             */
            defaultSnatStatus?: pulumi.Input<inputs.container.v1.DefaultSnatStatus>;
            /**
             * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
             */
            enableIntraNodeVisibility?: pulumi.Input<boolean>;
            /**
             * The relative name of the Google Compute Engine network(https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. Example: projects/my-project/global/networks/my-network
             */
            network?: pulumi.Input<string>;
            /**
             * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4)
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * The relative name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/vpc) to which the cluster is connected. Example: projects/my-project/regions/us-central1/subnetworks/my-subnet
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * Configuration options for the NetworkPolicy feature. https://kubernetes.io/docs/concepts/services-networking/networkpolicies/
         */
        interface NetworkPolicy {
            /**
             * Whether network policy is enabled on the cluster.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The selected network policy provider.
             */
            provider?: pulumi.Input<string>;
        }
        /**
         * Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.
         */
        interface NetworkPolicyConfig {
            /**
             * Whether NetworkPolicy is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters that describe the nodes in a cluster.
         */
        interface NodeConfig {
            /**
             * A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.
             */
            accelerators?: pulumi.Input<pulumi.Input<inputs.container.v1.AcceleratorConfig>[]>;
            /**
             *  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             */
            bootDiskKmsKey?: pulumi.Input<string>;
            /**
             * Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
             */
            diskType?: pulumi.Input<string>;
            /**
             * The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             */
            imageType?: pulumi.Input<string>;
            /**
             * Node kubelet configs.
             */
            kubeletConfig?: pulumi.Input<inputs.container.v1.NodeKubeletConfig>;
            /**
             * The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Parameters that can be configured on Linux nodes.
             */
            linuxNodeConfig?: pulumi.Input<inputs.container.v1.LinuxNodeConfig>;
            /**
             * The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.
             */
            localSsdCount?: pulumi.Input<number>;
            /**
             * The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types) If unspecified, the default machine type is `e2-medium`.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - "cluster-location" - "cluster-name" - "cluster-uid" - "configure-sh" - "containerd-configure-sh" - "enable-os-login" - "gci-ensure-gke-docker" - "gci-metrics-enabled" - "gci-update-strategy" - "instance-template" - "kube-env" - "startup-script" - "user-data" - "disable-address-manager" - "windows-startup-script-ps1" - "common-psm1" - "k8s-node-setup-psm1" - "install-ssh-psm1" - "user-profile-psm1" The following keys are reserved for Windows nodes: - "serial-port-logging-enable" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: "Intel Haswell"` or `minCpuPlatform: "Intel Sandy Bridge"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).
             */
            nodeGroup?: pulumi.Input<string>;
            /**
             * The set of Google API scopes to be made available on all of the node VMs under the "default" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Google Container Registry](https://cloud.google.com/container-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more information about preemptible VM instances.
             */
            preemptible?: pulumi.Input<boolean>;
            /**
             * The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool.
             */
            reservationAffinity?: pulumi.Input<inputs.container.v1.ReservationAffinity>;
            /**
             * Sandbox configuration for this node.
             */
            sandboxConfig?: pulumi.Input<inputs.container.v1.SandboxConfig>;
            /**
             * The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the "default" service account is used.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Shielded Instance options.
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.container.v1.ShieldedInstanceConfig>;
            /**
             * The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
             */
            taints?: pulumi.Input<pulumi.Input<inputs.container.v1.NodeTaint>[]>;
            /**
             * The workload metadata configuration for this node.
             */
            workloadMetadataConfig?: pulumi.Input<inputs.container.v1.WorkloadMetadataConfig>;
        }
        /**
         * Node kubelet configs.
         */
        interface NodeKubeletConfig {
            /**
             * Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
             */
            cpuCfsQuota?: pulumi.Input<boolean>;
            /**
             * Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration.
             */
            cpuCfsQuotaPeriod?: pulumi.Input<string>;
            /**
             * Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. - "none": the default, which represents the existing scheduling behavior. - "static": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.
             */
            cpuManagerPolicy?: pulumi.Input<string>;
        }
        /**
         * NodeManagement defines the set of node management services turned on for the node pool.
         */
        interface NodeManagement {
            /**
             * A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.
             */
            autoRepair?: pulumi.Input<boolean>;
            /**
             * A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.
             */
            autoUpgrade?: pulumi.Input<boolean>;
            /**
             * Specifies the Auto Upgrade knobs for the node pool.
             */
            upgradeOptions?: pulumi.Input<inputs.container.v1.AutoUpgradeOptions>;
        }
        /**
         * NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload.
         */
        interface NodePool {
            /**
             * Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present.
             */
            autoscaling?: pulumi.Input<inputs.container.v1.NodePoolAutoscaling>;
            /**
             * Which conditions caused the current node pool state.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.container.v1.StatusCondition>[]>;
            /**
             * The node configuration of the pool.
             */
            config?: pulumi.Input<inputs.container.v1.NodeConfig>;
            /**
             * The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.
             */
            initialNodeCount?: pulumi.Input<number>;
            /**
             * [Output only] The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool.
             */
            instanceGroupUrls?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.
             */
            locations?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * NodeManagement configuration for this NodePool.
             */
            management?: pulumi.Input<inputs.container.v1.NodeManagement>;
            /**
             * The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool.
             */
            maxPodsConstraint?: pulumi.Input<inputs.container.v1.MaxPodsConstraint>;
            /**
             * The name of the node pool.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output only] The pod CIDR block size per node in this node pool.
             */
            podIpv4CidrSize?: pulumi.Input<number>;
            /**
             * [Output only] Server-defined URL for the resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output only] The status of the nodes in this pool instance.
             */
            status?: pulumi.Input<string>;
            /**
             * Upgrade settings control disruption and speed of the upgrade.
             */
            upgradeSettings?: pulumi.Input<inputs.container.v1.UpgradeSettings>;
            /**
             * The version of the Kubernetes of this node.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.
         */
        interface NodePoolAutoscaling {
            /**
             * Can this node pool be deleted automatically.
             */
            autoprovisioned?: pulumi.Input<boolean>;
            /**
             * Is autoscaling enabled for this node pool.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * Maximum number of nodes in the NodePool. Must be >= min_node_count. There has to enough quota to scale up the cluster.
             */
            maxNodeCount?: pulumi.Input<number>;
            /**
             * Minimum number of nodes in the NodePool. Must be >= 1 and <= max_node_count.
             */
            minNodeCount?: pulumi.Input<number>;
        }
        /**
         * Kubernetes taint is comprised of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.
         */
        interface NodeTaint {
            /**
             * Effect for taint.
             */
            effect?: pulumi.Input<string>;
            /**
             * Key for taint.
             */
            key?: pulumi.Input<string>;
            /**
             * Value for taint.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * NotificationConfig is the configuration of notifications.
         */
        interface NotificationConfig {
            /**
             * Notification config for Pub/Sub.
             */
            pubsub?: pulumi.Input<inputs.container.v1.PubSub>;
        }
        /**
         * Configuration options for private clusters.
         */
        interface PrivateClusterConfig {
            /**
             * Whether the master's internal IP address is used as the cluster endpoint.
             */
            enablePrivateEndpoint?: pulumi.Input<boolean>;
            /**
             * Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking.
             */
            enablePrivateNodes?: pulumi.Input<boolean>;
            /**
             * Controls master global access settings.
             */
            masterGlobalAccessConfig?: pulumi.Input<inputs.container.v1.PrivateClusterMasterGlobalAccessConfig>;
            /**
             * The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network.
             */
            masterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The peering name in the customer VPC used by this cluster.
             */
            peeringName?: pulumi.Input<string>;
            /**
             * The internal IP address of this cluster's master endpoint.
             */
            privateEndpoint?: pulumi.Input<string>;
            /**
             * The external IP address of this cluster's master endpoint.
             */
            publicEndpoint?: pulumi.Input<string>;
        }
        /**
         * Configuration for controlling master global access settings.
         */
        interface PrivateClusterMasterGlobalAccessConfig {
            /**
             * Whenever master is accessible globally or not.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Pub/Sub specific notification config.
         */
        interface PubSub {
            /**
             * Enable notifications for Pub/Sub.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The desired Pub/Sub topic to which notifications will be sent by GKE. Format is `projects/{project}/topics/{topic}`.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Represents an arbitrary window of time that recurs.
         */
        interface RecurringTimeWindow {
            /**
             * An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how this window reccurs. They go on for the span of time between the start and end time. For example, to have something repeat every weekday, you'd use: `FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR` To repeat some window daily (equivalent to the DailyMaintenanceWindow): `FREQ=DAILY` For the first weekend of every month: `FREQ=MONTHLY;BYSETPOS=1;BYDAY=SA,SU` This specifies how frequently the window starts. Eg, if you wanted to have a 9-5 UTC-4 window every weekday, you'd use something like: ``` start time = 2019-01-01T09:00:00-0400 end time = 2019-01-01T17:00:00-0400 recurrence = FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR ``` Windows can span multiple days. Eg, to make the window encompass every weekend from midnight Saturday till the last minute of Sunday UTC: ``` start time = 2019-01-05T00:00:00Z end time = 2019-01-07T23:59:00Z recurrence = FREQ=WEEKLY;BYDAY=SA ``` Note the start and end time's specific dates are largely arbitrary except to specify duration of the window and when it first starts. The FREQ values of HOURLY, MINUTELY, and SECONDLY are not supported.
             */
            recurrence?: pulumi.Input<string>;
            /**
             * The window of the first recurrence.
             */
            window?: pulumi.Input<inputs.container.v1.TimeWindow>;
        }
        /**
         * ReleaseChannel indicates which release channel a cluster is subscribed to. Release channels are arranged in order of risk. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade defaults to true and cannot be disabled.
         */
        interface ReleaseChannel {
            /**
             * channel specifies which release channel the cluster is subscribed to.
             */
            channel?: pulumi.Input<string>;
        }
        /**
         * [ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.
         */
        interface ReservationAffinity {
            /**
             * Corresponds to the type of reservation consumption.
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify "googleapis.com/reservation-name" as the key and specify the name of your reservation as its value.
             */
            key?: pulumi.Input<string>;
            /**
             * Corresponds to the label value(s) of reservation resource(s).
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Contains information about amount of some resource in the cluster. For memory, value should be in GB.
         */
        interface ResourceLimit {
            /**
             * Maximum amount of the resource in the cluster.
             */
            maximum?: pulumi.Input<string>;
            /**
             * Minimum amount of the resource in the cluster.
             */
            minimum?: pulumi.Input<string>;
            /**
             * Resource name "cpu", "memory" or gpu-specific string.
             */
            resourceType?: pulumi.Input<string>;
        }
        /**
         * Configuration for exporting cluster resource usages.
         */
        interface ResourceUsageExportConfig {
            /**
             * Configuration to use BigQuery as usage export destination.
             */
            bigqueryDestination?: pulumi.Input<inputs.container.v1.BigQueryDestination>;
            /**
             * Configuration to enable resource consumption metering.
             */
            consumptionMeteringConfig?: pulumi.Input<inputs.container.v1.ConsumptionMeteringConfig>;
            /**
             * Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.
             */
            enableNetworkEgressMetering?: pulumi.Input<boolean>;
        }
        /**
         * SandboxConfig contains configurations of the sandbox to use for the node.
         */
        interface SandboxConfig {
            /**
             * Type of the sandbox to use for the node.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
        }
        /**
         * Configuration of Shielded Nodes feature.
         */
        interface ShieldedNodes {
            /**
             * Whether Shielded Nodes features are enabled on all nodes in this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).
         */
        interface StatusCondition {
            /**
             * Canonical code of the condition.
             */
            canonicalCode?: pulumi.Input<string>;
            /**
             * Human-friendly representation of the condition
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Represents an arbitrary window of time.
         */
        interface TimeWindow {
            /**
             * The time that the window ends. The end time should take place after the start time.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The time that the window first starts.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available.
         */
        interface UpgradeSettings {
            /**
             * The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.
             */
            maxSurge?: pulumi.Input<number>;
            /**
             * The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.
             */
            maxUnavailable?: pulumi.Input<number>;
        }
        /**
         * VerticalPodAutoscaling contains global, per-cluster information required by Vertical Pod Autoscaler to automatically adjust the resources of pods controlled by it.
         */
        interface VerticalPodAutoscaling {
            /**
             * Enables vertical pod autoscaling.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.
         */
        interface WorkloadIdentityConfig {
            /**
             * The workload pool to attach all Kubernetes service accounts to.
             */
            workloadPool?: pulumi.Input<string>;
        }
        /**
         * WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.
         */
        interface WorkloadMetadataConfig {
            /**
             * Mode is the configuration for how to expose metadata to workloads running on the node pool.
             */
            mode?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * AcceleratorConfig represents a Hardware Accelerator request.
         */
        interface AcceleratorConfig {
            /**
             * The number of the accelerator cards exposed to an instance.
             */
            acceleratorCount?: pulumi.Input<string>;
            /**
             * The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality.
         */
        interface AddonsConfig {
            /**
             * Configuration for the Cloud Run addon. The `IstioConfig` addon must be enabled in order to enable Cloud Run addon. This option can only be enabled at cluster creation time.
             */
            cloudRunConfig?: pulumi.Input<inputs.container.v1beta1.CloudRunConfig>;
            /**
             * Configuration for the ConfigConnector add-on, a Kubernetes extension to manage hosted GCP services through the Kubernetes API
             */
            configConnectorConfig?: pulumi.Input<inputs.container.v1beta1.ConfigConnectorConfig>;
            /**
             * Configuration for NodeLocalDNS, a dns cache running on cluster nodes
             */
            dnsCacheConfig?: pulumi.Input<inputs.container.v1beta1.DnsCacheConfig>;
            /**
             * Configuration for the Compute Engine Persistent Disk CSI driver.
             */
            gcePersistentDiskCsiDriverConfig?: pulumi.Input<inputs.container.v1beta1.GcePersistentDiskCsiDriverConfig>;
            /**
             * Configuration for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.
             */
            horizontalPodAutoscaling?: pulumi.Input<inputs.container.v1beta1.HorizontalPodAutoscaling>;
            /**
             * Configuration for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.
             */
            httpLoadBalancing?: pulumi.Input<inputs.container.v1beta1.HttpLoadBalancing>;
            /**
             * Configuration for Istio, an open platform to connect, manage, and secure microservices.
             */
            istioConfig?: pulumi.Input<inputs.container.v1beta1.IstioConfig>;
            /**
             * Configuration for the KALM addon, which manages the lifecycle of k8s applications.
             */
            kalmConfig?: pulumi.Input<inputs.container.v1beta1.KalmConfig>;
            /**
             * Configuration for the Kubernetes Dashboard. This addon is deprecated, and will be disabled in 1.15. It is recommended to use the Cloud Console to manage and monitor your Kubernetes clusters, workloads and applications. For more information, see: https://cloud.google.com/kubernetes-engine/docs/concepts/dashboards
             */
            kubernetesDashboard?: pulumi.Input<inputs.container.v1beta1.KubernetesDashboard>;
            /**
             * Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.
             */
            networkPolicyConfig?: pulumi.Input<inputs.container.v1beta1.NetworkPolicyConfig>;
        }
        /**
         * Configuration for returning group information from authenticators.
         */
        interface AuthenticatorGroupsConfig {
            /**
             * Whether this cluster should return group membership lookups during authentication using a group of security groups.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The name of the security group-of-groups to be used. Only relevant if enabled = true.
             */
            securityGroup?: pulumi.Input<string>;
        }
        /**
         * AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.
         */
        interface AutoUpgradeOptions {
            /**
             * [Output only] This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
             */
            autoUpgradeStartTime?: pulumi.Input<string>;
            /**
             * [Output only] This field is set when upgrades are about to commence with the description of the upgrade.
             */
            description?: pulumi.Input<string>;
        }
        /**
         * Autopilot is the configuration for Autopilot settings on the cluster.
         */
        interface Autopilot {
            /**
             * Enable Autopilot
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.
         */
        interface AutoprovisioningNodePoolDefaults {
            /**
             *  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             */
            bootDiskKmsKey?: pulumi.Input<string>;
            /**
             * Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
             */
            diskType?: pulumi.Input<string>;
            /**
             * NodeManagement configuration for this NodePool.
             */
            management?: pulumi.Input<inputs.container.v1beta1.NodeManagement>;
            /**
             * Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: "Intel Haswell"` or `minCpuPlatform: "Intel Sandy Bridge"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform) To unset the min cpu platform field pass "automatic" as field value.
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * The set of Google API scopes to be made available on all of the node VMs under the "default" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Google Container Registry](https://cloud.google.com/container-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the "default" service account is used.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Shielded Instance options.
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.container.v1beta1.ShieldedInstanceConfig>;
            /**
             * Upgrade settings control disruption and speed of the upgrade.
             */
            upgradeSettings?: pulumi.Input<inputs.container.v1beta1.UpgradeSettings>;
        }
        /**
         * Parameters for using BigQuery as the destination of resource usage export.
         */
        interface BigQueryDestination {
            /**
             * The ID of a BigQuery Dataset.
             */
            datasetId?: pulumi.Input<string>;
        }
        /**
         * Configuration for Binary Authorization.
         */
        interface BinaryAuthorization {
            /**
             * Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binauthz.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * CidrBlock contains an optional name and one CIDR block.
         */
        interface CidrBlock {
            /**
             * cidr_block must be specified in CIDR notation.
             */
            cidrBlock?: pulumi.Input<string>;
            /**
             * display_name is an optional field for users to identify CIDR blocks.
             */
            displayName?: pulumi.Input<string>;
        }
        /**
         * Configuration for client certificates on the cluster.
         */
        interface ClientCertificateConfig {
            /**
             * Issue a client certificate.
             */
            issueClientCertificate?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the Cloud Run feature.
         */
        interface CloudRunConfig {
            /**
             * Whether Cloud Run addon is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Which load balancer type is installed for Cloud Run.
             */
            loadBalancerType?: pulumi.Input<string>;
        }
        /**
         * ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs.
         */
        interface ClusterAutoscaling {
            /**
             * The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes can be created by NAP.
             */
            autoprovisioningLocations?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.
             */
            autoprovisioningNodePoolDefaults?: pulumi.Input<inputs.container.v1beta1.AutoprovisioningNodePoolDefaults>;
            /**
             * Defines autoscaling behaviour.
             */
            autoscalingProfile?: pulumi.Input<string>;
            /**
             * Enables automatic node pool creation and deletion.
             */
            enableNodeAutoprovisioning?: pulumi.Input<boolean>;
            /**
             * Contains global constraints regarding minimum and maximum amount of resources in the cluster.
             */
            resourceLimits?: pulumi.Input<pulumi.Input<inputs.container.v1beta1.ResourceLimit>[]>;
        }
        /**
         * Telemetry integration for the cluster.
         */
        interface ClusterTelemetry {
            /**
             * Type of the integration.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * ConfidentialNodes is configuration for the confidential nodes feature, which makes nodes run on confidential VMs.
         */
        interface ConfidentialNodes {
            /**
             * Whether Confidential Nodes feature is enabled for all nodes in this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the Config Connector add-on.
         */
        interface ConfigConnectorConfig {
            /**
             * Whether Cloud Connector is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters for controlling consumption metering.
         */
        interface ConsumptionMeteringConfig {
            /**
             * Whether to enable consumption metering for this cluster. If enabled, a second BigQuery table will be created to hold resource consumption records.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Time window specified for daily maintenance operations.
         */
        interface DailyMaintenanceWindow {
            /**
             * [Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario.
             */
            duration?: pulumi.Input<string>;
            /**
             * Time within the maintenance window to start the maintenance operations. It must be in format "HH:MM", where HH : [00-23] and MM : [00-59] GMT.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Configuration of etcd encryption.
         */
        interface DatabaseEncryption {
            /**
             * Name of CloudKMS key to use for the encryption of secrets in etcd. Ex. projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key
             */
            keyName?: pulumi.Input<string>;
            /**
             * Denotes the state of etcd encryption.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster.
         */
        interface DefaultSnatStatus {
            /**
             * Disables cluster default sNAT rules.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for NodeLocal DNSCache
         */
        interface DnsCacheConfig {
            /**
             * Whether NodeLocal DNSCache is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * EphemeralStorageConfig contains configuration for the ephemeral storage filesystem.
         */
        interface EphemeralStorageConfig {
            /**
             * Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
             */
            localSsdCount?: pulumi.Input<number>;
        }
        /**
         * Configuration for the Compute Engine PD CSI driver.
         */
        interface GcePersistentDiskCsiDriverConfig {
            /**
             * Whether the Compute Engine PD CSI driver is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.
         */
        interface HorizontalPodAutoscaling {
            /**
             * Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.
         */
        interface HttpLoadBalancing {
            /**
             * Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for controlling how IPs are allocated in the cluster.
         */
        interface IPAllocationPolicy {
            /**
             * If true, allow allocation of cluster CIDR ranges that overlap with certain kinds of network routes. By default we do not allow cluster CIDR ranges to intersect with any user declared routes. With allow_route_overlap == true, we allow overlapping with CIDR ranges that are larger than the cluster CIDR range. If this field is set to true, then cluster and services CIDRs must be fully-specified (e.g. `10.96.0.0/14`, but not `/14`), which means: 1) When `use_ip_aliases` is true, `cluster_ipv4_cidr_block` and `services_ipv4_cidr_block` must be fully-specified. 2) When `use_ip_aliases` is false, `cluster.cluster_ipv4_cidr` muse be fully-specified.
             */
            allowRouteOverlap?: pulumi.Input<boolean>;
            /**
             * This field is deprecated, use cluster_ipv4_cidr_block.
             */
            clusterIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range for the cluster pod IPs. If this field is set, then `cluster.cluster_ipv4_cidr` must be left blank. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            clusterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The name of the secondary range to be used for the cluster CIDR block. The secondary range will be used for pod IP addresses. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases and create_subnetwork is false.
             */
            clusterSecondaryRangeName?: pulumi.Input<string>;
            /**
             * Whether a new subnetwork will be created automatically for the cluster. This field is only applicable when `use_ip_aliases` is true.
             */
            createSubnetwork?: pulumi.Input<boolean>;
            /**
             * This field is deprecated, use node_ipv4_cidr_block.
             */
            nodeIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range of the instance IPs in this cluster. This is applicable only if `create_subnetwork` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            nodeIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * This field is deprecated, use services_ipv4_cidr_block.
             */
            servicesIpv4Cidr?: pulumi.Input<string>;
            /**
             * The IP address range of the services IPs in this cluster. If blank, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.
             */
            servicesIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The name of the secondary range to be used as for the services CIDR block. The secondary range will be used for service ClusterIPs. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases and create_subnetwork is false.
             */
            servicesSecondaryRangeName?: pulumi.Input<string>;
            /**
             * A custom subnetwork name to be used if `create_subnetwork` is true. If this field is empty, then an automatic name will be chosen for the new subnetwork.
             */
            subnetworkName?: pulumi.Input<string>;
            /**
             * The IP address range of the Cloud TPUs in this cluster. If unspecified, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. If unspecified, the range will use the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. This field is deprecated, use cluster.tpu_config.ipv4_cidr_block instead.
             */
            tpuIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * Whether alias IPs will be used for pod IPs in the cluster. This is used in conjunction with use_routes. It cannot be true if use_routes is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode
             */
            useIpAliases?: pulumi.Input<boolean>;
            /**
             * Whether routes will be used for pod IPs in the cluster. This is used in conjunction with use_ip_aliases. It cannot be true if use_ip_aliases is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode
             */
            useRoutes?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for Istio addon.
         */
        interface IstioConfig {
            /**
             * The specified Istio auth mode, either none, or mutual TLS.
             */
            auth?: pulumi.Input<string>;
            /**
             * Whether Istio is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for the KALM addon.
         */
        interface KalmConfig {
            /**
             * Whether KALM is enabled for this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the Kubernetes Dashboard.
         */
        interface KubernetesDashboard {
            /**
             * Whether the Kubernetes Dashboard is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the legacy Attribute Based Access Control authorization mode.
         */
        interface LegacyAbac {
            /**
             * Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters that can be configured on Linux nodes.
         */
        interface LinuxNodeConfig {
            /**
             * The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.netdev_max_backlog net.core.rmem_max net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse
             */
            sysctls?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * MaintenancePolicy defines the maintenance policy to be used for the cluster.
         */
        interface MaintenancePolicy {
            /**
             * A hash identifying the version of this policy, so that updates to fields of the policy won't accidentally undo intermediate changes (and so that users of the API unaware of some fields won't accidentally remove other fields). Make a `get()` request to the cluster to get the current resource version and include it with requests to set the policy.
             */
            resourceVersion?: pulumi.Input<string>;
            /**
             * Specifies the maintenance window in which maintenance may be performed.
             */
            window?: pulumi.Input<inputs.container.v1beta1.MaintenanceWindow>;
        }
        /**
         * MaintenanceWindow defines the maintenance window to be used for the cluster.
         */
        interface MaintenanceWindow {
            /**
             * DailyMaintenanceWindow specifies a daily maintenance operation window.
             */
            dailyMaintenanceWindow?: pulumi.Input<inputs.container.v1beta1.DailyMaintenanceWindow>;
            /**
             * Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.
             */
            maintenanceExclusions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * RecurringWindow specifies some number of recurring time periods for maintenance to occur. The time windows may be overlapping. If no maintenance windows are set, maintenance can occur at any time.
             */
            recurringWindow?: pulumi.Input<inputs.container.v1beta1.RecurringTimeWindow>;
        }
        /**
         * Master is the configuration for components on master.
         */
        interface Master {
        }
        /**
         * The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.
         */
        interface MasterAuth {
            /**
             * [Output only] Base64-encoded public certificate used by clients to authenticate to the cluster endpoint.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * Configuration for client certificate authentication on the cluster. For clusters before v1.12, if no configuration is specified, a client certificate is issued.
             */
            clientCertificateConfig?: pulumi.Input<inputs.container.v1beta1.ClientCertificateConfig>;
            /**
             * [Output only] Base64-encoded private key used by clients to authenticate to the cluster endpoint.
             */
            clientKey?: pulumi.Input<string>;
            clusterCaCertificate?: pulumi.Input<string>;
            /**
             * The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
             */
            password?: pulumi.Input<string>;
            /**
             * The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.
         */
        interface MasterAuthorizedNetworksConfig {
            /**
             * cidr_blocks define up to 10 external networks that could access Kubernetes master through HTTPS.
             */
            cidrBlocks?: pulumi.Input<pulumi.Input<inputs.container.v1beta1.CidrBlock>[]>;
            /**
             * Whether or not master authorized networks is enabled.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Constraints applied to pods.
         */
        interface MaxPodsConstraint {
            /**
             * Constraint enforced on the max num of pods per node.
             */
            maxPodsPerNode?: pulumi.Input<string>;
        }
        /**
         * NetworkConfig reports the relative names of network & subnetwork.
         */
        interface NetworkConfig {
            /**
             * The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation.
             */
            datapathProvider?: pulumi.Input<string>;
            /**
             * Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when default_snat_status is disabled. When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic.
             */
            defaultSnatStatus?: pulumi.Input<inputs.container.v1beta1.DefaultSnatStatus>;
            /**
             * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
             */
            enableIntraNodeVisibility?: pulumi.Input<boolean>;
            /**
             * Whether L4ILB Subsetting is enabled for this cluster.
             */
            enableL4ilbSubsetting?: pulumi.Input<boolean>;
            /**
             * The relative name of the Google Compute Engine network(https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. Example: projects/my-project/global/networks/my-network
             */
            network?: pulumi.Input<string>;
            /**
             * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4)
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * The relative name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/vpc) to which the cluster is connected. Example: projects/my-project/regions/us-central1/subnetworks/my-subnet
             */
            subnetwork?: pulumi.Input<string>;
        }
        /**
         * Configuration options for the NetworkPolicy feature. https://kubernetes.io/docs/concepts/services-networking/networkpolicies/
         */
        interface NetworkPolicy {
            /**
             * Whether network policy is enabled on the cluster.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The selected network policy provider.
             */
            provider?: pulumi.Input<string>;
        }
        /**
         * Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.
         */
        interface NetworkPolicyConfig {
            /**
             * Whether NetworkPolicy is enabled for this cluster.
             */
            disabled?: pulumi.Input<boolean>;
        }
        /**
         * Parameters that describe the nodes in a cluster.
         */
        interface NodeConfig {
            /**
             * A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.
             */
            accelerators?: pulumi.Input<pulumi.Input<inputs.container.v1beta1.AcceleratorConfig>[]>;
            /**
             *  The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
             */
            bootDiskKmsKey?: pulumi.Input<string>;
            /**
             * Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'
             */
            diskType?: pulumi.Input<string>;
            /**
             * Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk.
             */
            ephemeralStorageConfig?: pulumi.Input<inputs.container.v1beta1.EphemeralStorageConfig>;
            /**
             * The image type to use for this node. Note that for a given image type, the latest version of it will be used.
             */
            imageType?: pulumi.Input<string>;
            /**
             * Node kubelet configs.
             */
            kubeletConfig?: pulumi.Input<inputs.container.v1beta1.NodeKubeletConfig>;
            /**
             * The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Parameters that can be configured on Linux nodes.
             */
            linuxNodeConfig?: pulumi.Input<inputs.container.v1beta1.LinuxNodeConfig>;
            /**
             * The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.
             */
            localSsdCount?: pulumi.Input<number>;
            /**
             * The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types). If unspecified, the default machine type is `e2-medium`.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - "cluster-location" - "cluster-name" - "cluster-uid" - "configure-sh" - "containerd-configure-sh" - "enable-oslogin" - "gci-ensure-gke-docker" - "gci-metrics-enabled" - "gci-update-strategy" - "instance-template" - "kube-env" - "startup-script" - "user-data" - "disable-address-manager" - "windows-startup-script-ps1" - "common-psm1" - "k8s-node-setup-psm1" - "install-ssh-psm1" - "user-profile-psm1" The following keys are reserved for Windows nodes: - "serial-port-logging-enable" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: "Intel Haswell"` or `minCpuPlatform: "Intel Sandy Bridge"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).
             */
            nodeGroup?: pulumi.Input<string>;
            /**
             * The set of Google API scopes to be made available on all of the node VMs under the "default" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Google Container Registry](https://cloud.google.com/container-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more inforamtion about preemptible VM instances.
             */
            preemptible?: pulumi.Input<boolean>;
            /**
             * The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool.
             */
            reservationAffinity?: pulumi.Input<inputs.container.v1beta1.ReservationAffinity>;
            /**
             * Sandbox configuration for this node.
             */
            sandboxConfig?: pulumi.Input<inputs.container.v1beta1.SandboxConfig>;
            /**
             * The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the "default" service account is used.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Shielded Instance options.
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.container.v1beta1.ShieldedInstanceConfig>;
            /**
             * The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
             */
            taints?: pulumi.Input<pulumi.Input<inputs.container.v1beta1.NodeTaint>[]>;
            /**
             * The workload metadata configuration for this node.
             */
            workloadMetadataConfig?: pulumi.Input<inputs.container.v1beta1.WorkloadMetadataConfig>;
        }
        /**
         * Node kubelet configs.
         */
        interface NodeKubeletConfig {
            /**
             * Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.
             */
            cpuCfsQuota?: pulumi.Input<boolean>;
            /**
             * Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration.
             */
            cpuCfsQuotaPeriod?: pulumi.Input<string>;
            /**
             * Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. - "none": the default, which represents the existing scheduling behavior. - "static": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.
             */
            cpuManagerPolicy?: pulumi.Input<string>;
        }
        /**
         * NodeManagement defines the set of node management services turned on for the node pool.
         */
        interface NodeManagement {
            /**
             * Whether the nodes will be automatically repaired.
             */
            autoRepair?: pulumi.Input<boolean>;
            /**
             * Whether the nodes will be automatically upgraded.
             */
            autoUpgrade?: pulumi.Input<boolean>;
            /**
             * Specifies the Auto Upgrade knobs for the node pool.
             */
            upgradeOptions?: pulumi.Input<inputs.container.v1beta1.AutoUpgradeOptions>;
        }
        /**
         * Parameters for node pool-level network config. Only applicable if `ip_allocation_policy.use_ip_aliases` is true.
         */
        interface NodeNetworkConfig {
            /**
             * Input only. Whether to create a new range for pod IPs in this node pool. Defaults are provided for `pod_range` and `pod_ipv4_cidr_block` if they are not specified. If neither `create_pod_range` or `pod_range` are specified, the cluster-level default (`ip_allocation_policy.cluster_ipv4_cidr_block`) is used.
             */
            createPodRange?: pulumi.Input<boolean>;
            /**
             * The IP address range for pod IPs in this node pool. Only applicable if `create_pod_range` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) to pick a specific range to use.
             */
            podIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The ID of the secondary range for pod IPs. If `create_pod_range` is true, this ID is used for the new range. If `create_pod_range` is false, uses an existing secondary range with this ID.
             */
            podRange?: pulumi.Input<string>;
        }
        /**
         * NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload.
         */
        interface NodePool {
            /**
             * Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present.
             */
            autoscaling?: pulumi.Input<inputs.container.v1beta1.NodePoolAutoscaling>;
            /**
             * Which conditions caused the current node pool state.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.container.v1beta1.StatusCondition>[]>;
            /**
             * The node configuration of the pool.
             */
            config?: pulumi.Input<inputs.container.v1beta1.NodeConfig>;
            /**
             * The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.
             */
            initialNodeCount?: pulumi.Input<number>;
            /**
             * [Output only] The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool.
             */
            instanceGroupUrls?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.
             */
            locations?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * NodeManagement configuration for this NodePool.
             */
            management?: pulumi.Input<inputs.container.v1beta1.NodeManagement>;
            /**
             * The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool.
             */
            maxPodsConstraint?: pulumi.Input<inputs.container.v1beta1.MaxPodsConstraint>;
            /**
             * The name of the node pool.
             */
            name?: pulumi.Input<string>;
            /**
             * Networking configuration for this NodePool. If specified, it overrides the cluster-level defaults.
             */
            networkConfig?: pulumi.Input<inputs.container.v1beta1.NodeNetworkConfig>;
            /**
             * [Output only] The pod CIDR block size per node in this node pool.
             */
            podIpv4CidrSize?: pulumi.Input<number>;
            /**
             * [Output only] Server-defined URL for the resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output only] The status of the nodes in this pool instance.
             */
            status?: pulumi.Input<string>;
            /**
             * Upgrade settings control disruption and speed of the upgrade.
             */
            upgradeSettings?: pulumi.Input<inputs.container.v1beta1.UpgradeSettings>;
            /**
             * The version of the Kubernetes of this node.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.
         */
        interface NodePoolAutoscaling {
            /**
             * Can this node pool be deleted automatically.
             */
            autoprovisioned?: pulumi.Input<boolean>;
            /**
             * Is autoscaling enabled for this node pool.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * Maximum number of nodes in the NodePool. Must be >= min_node_count. There has to enough quota to scale up the cluster.
             */
            maxNodeCount?: pulumi.Input<number>;
            /**
             * Minimum number of nodes in the NodePool. Must be >= 1 and <= max_node_count.
             */
            minNodeCount?: pulumi.Input<number>;
        }
        /**
         * Kubernetes taint is comprised of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.
         */
        interface NodeTaint {
            /**
             * Effect for taint.
             */
            effect?: pulumi.Input<string>;
            /**
             * Key for taint.
             */
            key?: pulumi.Input<string>;
            /**
             * Value for taint.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * NotificationConfig is the configuration of notifications.
         */
        interface NotificationConfig {
            /**
             * Notification config for Pub/Sub.
             */
            pubsub?: pulumi.Input<inputs.container.v1beta1.PubSub>;
        }
        /**
         * Configuration for the PodSecurityPolicy feature.
         */
        interface PodSecurityPolicyConfig {
            /**
             * Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration options for private clusters.
         */
        interface PrivateClusterConfig {
            /**
             * Whether the master's internal IP address is used as the cluster endpoint.
             */
            enablePrivateEndpoint?: pulumi.Input<boolean>;
            /**
             * Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking.
             */
            enablePrivateNodes?: pulumi.Input<boolean>;
            /**
             * Controls master global access settings.
             */
            masterGlobalAccessConfig?: pulumi.Input<inputs.container.v1beta1.PrivateClusterMasterGlobalAccessConfig>;
            /**
             * The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network.
             */
            masterIpv4CidrBlock?: pulumi.Input<string>;
            /**
             * The peering name in the customer VPC used by this cluster.
             */
            peeringName?: pulumi.Input<string>;
            /**
             * The internal IP address of this cluster's master endpoint.
             */
            privateEndpoint?: pulumi.Input<string>;
            /**
             * The external IP address of this cluster's master endpoint.
             */
            publicEndpoint?: pulumi.Input<string>;
        }
        /**
         * Configuration for controlling master global access settings.
         */
        interface PrivateClusterMasterGlobalAccessConfig {
            /**
             * Whenever master is accessible globally or not.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Pub/Sub specific notification config.
         */
        interface PubSub {
            /**
             * Enable notifications for Pub/Sub.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * The desired Pub/Sub topic to which notifications will be sent by GKE. Format is `projects/{project}/topics/{topic}`.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Represents an arbitrary window of time that recurs.
         */
        interface RecurringTimeWindow {
            /**
             * An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how this window reccurs. They go on for the span of time between the start and end time. For example, to have something repeat every weekday, you'd use: `FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR` To repeat some window daily (equivalent to the DailyMaintenanceWindow): `FREQ=DAILY` For the first weekend of every month: `FREQ=MONTHLY;BYSETPOS=1;BYDAY=SA,SU` This specifies how frequently the window starts. Eg, if you wanted to have a 9-5 UTC-4 window every weekday, you'd use something like: ``` start time = 2019-01-01T09:00:00-0400 end time = 2019-01-01T17:00:00-0400 recurrence = FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR ``` Windows can span multiple days. Eg, to make the window encompass every weekend from midnight Saturday till the last minute of Sunday UTC: ``` start time = 2019-01-05T00:00:00Z end time = 2019-01-07T23:59:00Z recurrence = FREQ=WEEKLY;BYDAY=SA ``` Note the start and end time's specific dates are largely arbitrary except to specify duration of the window and when it first starts. The FREQ values of HOURLY, MINUTELY, and SECONDLY are not supported.
             */
            recurrence?: pulumi.Input<string>;
            /**
             * The window of the first recurrence.
             */
            window?: pulumi.Input<inputs.container.v1beta1.TimeWindow>;
        }
        /**
         * ReleaseChannel indicates which release channel a cluster is subscribed to. Release channels are arranged in order of risk. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade defaults to true and cannot be disabled.
         */
        interface ReleaseChannel {
            /**
             * channel specifies which release channel the cluster is subscribed to.
             */
            channel?: pulumi.Input<string>;
        }
        /**
         * [ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.
         */
        interface ReservationAffinity {
            /**
             * Corresponds to the type of reservation consumption.
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify "googleapis.com/reservation-name" as the key and specify the name of your reservation as its value.
             */
            key?: pulumi.Input<string>;
            /**
             * Corresponds to the label value(s) of reservation resource(s).
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Contains information about amount of some resource in the cluster. For memory, value should be in GB.
         */
        interface ResourceLimit {
            /**
             * Maximum amount of the resource in the cluster.
             */
            maximum?: pulumi.Input<string>;
            /**
             * Minimum amount of the resource in the cluster.
             */
            minimum?: pulumi.Input<string>;
            /**
             * Resource name "cpu", "memory" or gpu-specific string.
             */
            resourceType?: pulumi.Input<string>;
        }
        /**
         * Configuration for exporting cluster resource usages.
         */
        interface ResourceUsageExportConfig {
            /**
             * Configuration to use BigQuery as usage export destination.
             */
            bigqueryDestination?: pulumi.Input<inputs.container.v1beta1.BigQueryDestination>;
            /**
             * Configuration to enable resource consumption metering.
             */
            consumptionMeteringConfig?: pulumi.Input<inputs.container.v1beta1.ConsumptionMeteringConfig>;
            /**
             * Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.
             */
            enableNetworkEgressMetering?: pulumi.Input<boolean>;
        }
        /**
         * SandboxConfig contains configurations of the sandbox to use for the node.
         */
        interface SandboxConfig {
            /**
             * Type of the sandbox to use for the node (e.g. 'gvisor')
             */
            sandboxType?: pulumi.Input<string>;
            /**
             * Type of the sandbox to use for the node.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
        }
        /**
         * Configuration of Shielded Nodes feature.
         */
        interface ShieldedNodes {
            /**
             * Whether Shielded Nodes features are enabled on all nodes in this cluster.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).
         */
        interface StatusCondition {
            /**
             * Canonical code of the condition.
             */
            canonicalCode?: pulumi.Input<string>;
            /**
             * Human-friendly representation of the condition
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Represents an arbitrary window of time.
         */
        interface TimeWindow {
            /**
             * The time that the window ends. The end time should take place after the start time.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The time that the window first starts.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Configuration for Cloud TPU.
         */
        interface TpuConfig {
            /**
             * Whether Cloud TPU integration is enabled or not.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * IPv4 CIDR block reserved for Cloud TPU in the VPC.
             */
            ipv4CidrBlock?: pulumi.Input<string>;
            /**
             * Whether to use service networking for Cloud TPU or not.
             */
            useServiceNetworking?: pulumi.Input<boolean>;
        }
        /**
         * These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available.
         */
        interface UpgradeSettings {
            /**
             * The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.
             */
            maxSurge?: pulumi.Input<number>;
            /**
             * The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.
             */
            maxUnavailable?: pulumi.Input<number>;
        }
        /**
         * VerticalPodAutoscaling contains global, per-cluster information required by Vertical Pod Autoscaler to automatically adjust the resources of pods controlled by it.
         */
        interface VerticalPodAutoscaling {
            /**
             * Enables vertical pod autoscaling.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.
         */
        interface WorkloadIdentityConfig {
            /**
             * IAM Identity Namespace to attach all Kubernetes Service Accounts to.
             */
            identityNamespace?: pulumi.Input<string>;
            /**
             * identity provider is the third party identity provider.
             */
            identityProvider?: pulumi.Input<string>;
            /**
             * The workload pool to attach all Kubernetes service accounts to.
             */
            workloadPool?: pulumi.Input<string>;
        }
        /**
         * WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.
         */
        interface WorkloadMetadataConfig {
            /**
             * Mode is the configuration for how to expose metadata to workloads running on the node pool.
             */
            mode?: pulumi.Input<string>;
            /**
             * NodeMetadata is the configuration for how to expose metadata to the workloads running on the node.
             */
            nodeMetadata?: pulumi.Input<string>;
        }
    }
}
export declare namespace containeranalysis {
    namespace v1alpha1 {
        /**
         * Artifact describes a build product.
         */
        interface Artifact {
            /**
             * Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.
             */
            checksum?: pulumi.Input<string>;
            /**
             * Artifact ID, if any; for container images, this will be a URL by digest like gcr.io/projectID/imagename@sha256:123456
             */
            id?: pulumi.Input<string>;
            /**
             * Name of the artifact. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to `docker push`. This field is deprecated in favor of the plural `names` field; it continues to exist here to allow existing BuildProvenance serialized to json in google.devtools.containeranalysis.v1alpha1.BuildDetails.provenance_bytes to deserialize back into proto.
             */
            name?: pulumi.Input<string>;
            /**
             * Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to `docker push`. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.
             */
            names?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Occurrence that represents a single "attestation". The authenticity of an Attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the AttestationAuthority to which this Attestation is attached is primarily useful for look-up (how to find this Attestation if you already know the Authority and artifact to be verified) and intent (which authority was this attestation intended to sign for).
         */
        interface Attestation {
            pgpSignedAttestation?: pulumi.Input<inputs.containeranalysis.v1alpha1.PgpSignedAttestation>;
        }
        /**
         * Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one `AttestationAuthority` for "QA" and one for "build". This Note is intended to act strictly as a grouping mechanism for the attached Occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an Occurrence to a given Note. It also provides a single point of lookup to find all attached Attestation Occurrences, even if they don't all live in the same project.
         */
        interface AttestationAuthority {
            hint?: pulumi.Input<inputs.containeranalysis.v1alpha1.AttestationAuthorityHint>;
        }
        /**
         * This submessage provides human-readable hints about the purpose of the AttestationAuthority. Because the name of a Note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should NOT be used to look up AttestationAuthorities in security sensitive contexts, such as when looking up Attestations to verify.
         */
        interface AttestationAuthorityHint {
            /**
             * The human readable name of this Attestation Authority, for example "qa".
             */
            humanReadableName?: pulumi.Input<string>;
        }
        /**
         * Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM Or an equivalent reference, e.g. a tag of the resource_url.
         */
        interface Basis {
            /**
             * The fingerprint of the base image.
             */
            fingerprint?: pulumi.Input<inputs.containeranalysis.v1alpha1.Fingerprint>;
            /**
             * The resource_url for the resource representing the basis of associated occurrence images.
             */
            resourceUrl?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.containeranalysis.v1alpha1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Message encapsulating build provenance details.
         */
        interface BuildDetails {
            /**
             * The actual provenance
             */
            provenance?: pulumi.Input<inputs.containeranalysis.v1alpha1.BuildProvenance>;
            /**
             * Serialized JSON representation of the provenance, used in generating the `BuildSignature` in the corresponding Result. After verifying the signature, `provenance_bytes` can be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification. The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.
             */
            provenanceBytes?: pulumi.Input<string>;
        }
        /**
         * Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.
         */
        interface BuildProvenance {
            /**
             * Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.
             */
            buildOptions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Version string of the builder at the time this build was executed.
             */
            builderVersion?: pulumi.Input<string>;
            /**
             * Output of the build.
             */
            builtArtifacts?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Artifact>[]>;
            /**
             * Commands requested by the build.
             */
            commands?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Command>[]>;
            /**
             * Time at which the build was created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * E-mail address of the user who initiated this build. Note that this was the user's e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.
             */
            creator?: pulumi.Input<string>;
            /**
             * Time at which execution of the build was finished.
             */
            finishTime?: pulumi.Input<string>;
            /**
             * Unique identifier of the build.
             */
            id?: pulumi.Input<string>;
            /**
             * Google Cloud Storage bucket where logs were written.
             */
            logsBucket?: pulumi.Input<string>;
            /**
             * ID of the project.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Details of the Source input to the build.
             */
            sourceProvenance?: pulumi.Input<inputs.containeranalysis.v1alpha1.Source>;
            /**
             * Time at which execution of the build was started.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Trigger identifier if the build was triggered automatically; empty if not.
             */
            triggerId?: pulumi.Input<string>;
        }
        /**
         * Message encapsulating the signature of the verified build.
         */
        interface BuildSignature {
            /**
             * An Id for the key used to sign. This could be either an Id for the key stored in `public_key` (such as the Id or fingerprint for a PGP key, or the CN for a cert), or a reference to an external key (such as a reference to a key in Cloud Key Management Service).
             */
            keyId?: pulumi.Input<string>;
            /**
             * The type of the key, either stored in `public_key` or referenced in `key_id`
             */
            keyType?: pulumi.Input<string>;
            /**
             * Public key of the builder which can be used to verify that the related findings are valid and unchanged. If `key_type` is empty, this defaults to PEM encoded public keys. This field may be empty if `key_id` references an external key. For Cloud Build based signatures, this is a PEM encoded public key. To verify the Cloud Build signature, place the contents of this field into a file (public.pem). The signature field is base64-decoded into its binary representation in signature.bin, and the provenance bytes from `BuildDetails` are base64-decoded into a binary representation in signed.bin. OpenSSL can then verify the signature: `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
             */
            publicKey?: pulumi.Input<string>;
            /**
             * Signature of the related `BuildProvenance`, encoded in a base64 string.
             */
            signature?: pulumi.Input<string>;
        }
        /**
         * Note holding the version of the provider's builder and the signature of the provenance message in linked BuildDetails.
         */
        interface BuildType {
            /**
             * Version of the builder which produced this Note.
             */
            builderVersion?: pulumi.Input<string>;
            /**
             * Signature of the build in Occurrences pointing to the Note containing this `BuilderDetails`.
             */
            signature?: pulumi.Input<inputs.containeranalysis.v1alpha1.BuildSignature>;
        }
        /**
         * Command describes a step performed as part of the build pipeline.
         */
        interface Command {
            /**
             * Command-line arguments used when executing this Command.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Working directory (relative to project source root) used when running this Command.
             */
            dir?: pulumi.Input<string>;
            /**
             * Environment variables set before running this Command.
             */
            env?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional unique identifier for this Command, used in wait_for to reference this Command as a dependency.
             */
            id?: pulumi.Input<string>;
            /**
             * Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to `docker pull`.
             */
            name?: pulumi.Input<string>;
            /**
             * The ID(s) of the Command(s) that this Command depends on.
             */
            waitFor?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * An artifact that can be deployed in some runtime.
         */
        interface Deployable {
            /**
             * Resource URI for the artifact being deployed.
             */
            resourceUri?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The period during which some deployable was active in a runtime.
         */
        interface Deployment {
            /**
             * Address of the runtime element hosting this deployment.
             */
            address?: pulumi.Input<string>;
            /**
             * Configuration used to create this deployment.
             */
            config?: pulumi.Input<string>;
            /**
             * Beginning of the lifetime of this deployment.
             */
            deployTime?: pulumi.Input<string>;
            /**
             * Platform hosting this deployment.
             */
            platform?: pulumi.Input<string>;
            /**
             * Resource URI for the artifact being deployed taken from the deployable field with the same name.
             */
            resourceUri?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * End of the lifetime of this deployment.
             */
            undeployTime?: pulumi.Input<string>;
            /**
             * Identity of the user that triggered this deployment.
             */
            userEmail?: pulumi.Input<string>;
        }
        /**
         * Derived describes the derived image portion (Occurrence) of the DockerImage relationship. This image would be produced from a Dockerfile with FROM .
         */
        interface Derived {
            /**
             * This contains the base image URL for the derived image occurrence.
             */
            baseResourceUrl?: pulumi.Input<string>;
            /**
             * The number of layers by which this image differs from the associated image basis.
             */
            distance?: pulumi.Input<number>;
            /**
             * The fingerprint of the derived image.
             */
            fingerprint?: pulumi.Input<inputs.containeranalysis.v1alpha1.Fingerprint>;
            /**
             * This contains layer-specific metadata, if populated it has length "distance" and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.
             */
            layerInfo?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Layer>[]>;
        }
        /**
         * Identifies all occurrences of this vulnerability in the package for a specific distro/location For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
         */
        interface Detail {
            /**
             * The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in which the vulnerability manifests. Examples include distro or storage location for vulnerable jar. This field can be used as a filter in list requests.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * A vendor-specific description of this note.
             */
            description?: pulumi.Input<string>;
            /**
             * The fix for this specific package version.
             */
            fixedLocation?: pulumi.Input<inputs.containeranalysis.v1alpha1.VulnerabilityLocation>;
            /**
             * Whether this Detail is obsolete. Occurrences are expected not to point to obsolete details.
             */
            isObsolete?: pulumi.Input<boolean>;
            /**
             * The max version of the package in which the vulnerability exists.
             */
            maxAffectedVersion?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
            /**
             * The min version of the package in which the vulnerability exists.
             */
            minAffectedVersion?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
            /**
             * The name of the package where the vulnerability was found. This field can be used as a filter in list requests.
             */
            package?: pulumi.Input<string>;
            /**
             * The type of package; whether native or non native(ruby gems, node.js packages etc)
             */
            packageType?: pulumi.Input<string>;
            /**
             * The severity (eg: distro assigned severity) for this vulnerability.
             */
            severityName?: pulumi.Input<string>;
            /**
             * The source from which the information in this Detail was obtained.
             */
            source?: pulumi.Input<string>;
        }
        /**
         * Provides information about the scan status of a discovered resource.
         */
        interface Discovered {
            /**
             * The status of discovery for the resource.
             */
            analysisStatus?: pulumi.Input<string>;
            /**
             * When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage output only and populated by the API.
             */
            analysisStatusError?: pulumi.Input<inputs.containeranalysis.v1alpha1.Status>;
            /**
             * Whether the resource is continuously analyzed.
             */
            continuousAnalysis?: pulumi.Input<string>;
            /**
             * The CPE of the resource being scanned.
             */
            cpe?: pulumi.Input<string>;
            /**
             * An operation that indicates the status of the current scan. This field is deprecated, do not use.
             */
            operation?: pulumi.Input<inputs.containeranalysis.v1alpha1.Operation>;
        }
        /**
         * A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A `Discovery` occurrence is created in a consumer's project at the start of analysis. The occurrence's operation will indicate the status of the analysis. Absence of an occurrence linked to this note for a resource indicates that analysis hasn't started.
         */
        interface Discovery {
            /**
             * The kind of analysis that is handled by this discovery.
             */
            analysisKind?: pulumi.Input<string>;
        }
        /**
         * This represents a particular channel of distribution for a given package. e.g. Debian's jessie-backports dpkg mirror
         */
        interface Distribution {
            /**
             * The CPU architecture for which packages in this distribution channel were built
             */
            architecture?: pulumi.Input<string>;
            /**
             * The cpe_uri in [cpe format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The distribution channel-specific description of this package.
             */
            description?: pulumi.Input<string>;
            /**
             * The latest available version of this package in this distribution channel.
             */
            latestVersion?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
            /**
             * A freeform string denoting the maintainer of this package.
             */
            maintainer?: pulumi.Input<string>;
            /**
             * The distribution channel-specific homepage for this package.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A set of properties that uniquely identify a given Docker image.
         */
        interface Fingerprint {
            /**
             * The layer-id of the final layer in the Docker image's v1 representation. This field can be used as a filter in list requests.
             */
            v1Name?: pulumi.Input<string>;
            /**
             * The ordered list of v2 blobs that represent a given image.
             */
            v2Blob?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the image's v2 blobs computed via: [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1]) Only the name of the final blob is kept. This field can be used as a filter in list requests.
             */
            v2Name?: pulumi.Input<string>;
        }
        /**
         * An alias to a repo revision.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1AliasContext {
            /**
             * The alias kind.
             */
            kind?: pulumi.Input<string>;
            /**
             * The alias name.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1CloudRepoSourceContext {
            /**
             * An alias, which may be a branch or tag.
             */
            aliasContext?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1AliasContext>;
            /**
             * The ID of the repo.
             */
            repoId?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1RepoId>;
            /**
             * A revision ID.
             */
            revisionId?: pulumi.Input<string>;
        }
        /**
         * A SourceContext referring to a Gerrit project.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1GerritSourceContext {
            /**
             * An alias, which may be a branch or tag.
             */
            aliasContext?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1AliasContext>;
            /**
             * The full project name within the host. Projects may be nested, so "project/subproject" is a valid project name. The "repo name" is the hostURI/project.
             */
            gerritProject?: pulumi.Input<string>;
            /**
             * The URI of a running Gerrit instance.
             */
            hostUri?: pulumi.Input<string>;
            /**
             * A revision (commit) ID.
             */
            revisionId?: pulumi.Input<string>;
        }
        /**
         * A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1GitSourceContext {
            /**
             * Required. Git commit hash.
             */
            revisionId?: pulumi.Input<string>;
            /**
             * Git repository URL.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1ProjectRepoId {
            /**
             * The ID of the project.
             */
            projectId?: pulumi.Input<string>;
            /**
             * The name of the repo. Leave empty for the default repo.
             */
            repoName?: pulumi.Input<string>;
        }
        /**
         * A unique identifier for a Cloud Repo.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1RepoId {
            /**
             * A combination of a project ID and a repo name.
             */
            projectRepoId?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1ProjectRepoId>;
            /**
             * A server-assigned, globally unique identifier.
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.
         */
        interface GoogleDevtoolsContaineranalysisV1alpha1SourceContext {
            /**
             * A SourceContext referring to a revision in a Google Cloud Source Repo.
             */
            cloudRepo?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1CloudRepoSourceContext>;
            /**
             * A SourceContext referring to a Gerrit project.
             */
            gerrit?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1GerritSourceContext>;
            /**
             * A SourceContext referring to any third party Git repo (e.g., GitHub).
             */
            git?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1GitSourceContext>;
            /**
             * Labels with user defined metadata.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Container message for hash values.
         */
        interface Hash {
            /**
             * The type of hash that was performed.
             */
            type?: pulumi.Input<string>;
            /**
             * The hash value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * This represents how a particular software package may be installed on a system.
         */
        interface Installation {
            /**
             * All of the places within the filesystem versions of this package have been found.
             */
            location?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Location>[]>;
            /**
             * The name of the installed package.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Layer holds metadata specific to a layer of a Docker image.
         */
        interface Layer {
            /**
             * The recovered arguments to the Dockerfile directive.
             */
            arguments?: pulumi.Input<string>;
            /**
             * The recovered Dockerfile directive used to construct this layer.
             */
            directive?: pulumi.Input<string>;
        }
        /**
         * An occurrence of a particular package installation found within a system's filesystem. e.g. glibc was found in /var/lib/dpkg/status
         */
        interface Location {
            /**
             * The cpe_uri in [cpe format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The path from which we gathered that this package/version is installed.
             */
            path?: pulumi.Input<string>;
            /**
             * The version installed at this location.
             */
            version?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
        }
        /**
         * This resource represents a long-running operation that is the result of a network API call.
         */
        interface Operation {
            /**
             * If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
             */
            done?: pulumi.Input<boolean>;
            /**
             * The error result of the operation in case of failure or cancellation.
             */
            error?: pulumi.Input<inputs.containeranalysis.v1alpha1.Status>;
            /**
             * Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
             */
            name?: pulumi.Input<string>;
            /**
             * The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
             */
            response?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * This represents a particular package that is distributed over various channels. e.g. glibc (aka libc6) is distributed by many, at various versions.
         */
        interface Package {
            /**
             * The various channels by which a package is distributed.
             */
            distribution?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Distribution>[]>;
            /**
             * The name of the package.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * This message wraps a location affected by a vulnerability and its associated fix (if one is available).
         */
        interface PackageIssue {
            /**
             * The location of the vulnerability.
             */
            affectedLocation?: pulumi.Input<inputs.containeranalysis.v1alpha1.VulnerabilityLocation>;
            /**
             * The location of the available fix for vulnerability.
             */
            fixedLocation?: pulumi.Input<inputs.containeranalysis.v1alpha1.VulnerabilityLocation>;
            severityName?: pulumi.Input<string>;
        }
        /**
         * An attestation wrapper with a PGP-compatible signature. This message only supports `ATTACHED` signatures, where the payload that is signed is included alongside the signature itself in the same file.
         */
        interface PgpSignedAttestation {
            /**
             * Type (for example schema) of the attestation payload that was signed. The verifier must ensure that the provided type is one that the verifier supports, and that the attestation payload is a valid instantiation of that type (for example by validating a JSON schema).
             */
            contentType?: pulumi.Input<string>;
            /**
             * The cryptographic fingerprint of the key used to generate the signature, as output by, e.g. `gpg --list-keys`. This should be the version 4, full 160-bit fingerprint, expressed as a 40 character hexadecimal string. See https://tools.ietf.org/html/rfc4880#section-12.2 for details. Implementations may choose to acknowledge "LONG", "SHORT", or other abbreviated key IDs, but only the full fingerprint is guaranteed to work. In gpg, the full fingerprint can be retrieved from the `fpr` field returned when calling --list-keys with --with-colons. For example: ``` gpg --with-colons --with-fingerprint --force-v4-certs \ --list-keys attester@example.com tru::1:1513631572:0:3:1:5 pub:...... fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB: ``` Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
             */
            pgpKeyId?: pulumi.Input<string>;
            /**
             * The raw content of the signature, as output by GNU Privacy Guard (GPG) or equivalent. Since this message only supports attached signatures, the payload that was signed must be attached. While the signature format supported is dependent on the verification implementation, currently only ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor --output=signature.gpg payload.json` will create the signature content expected in this field in `signature.gpg` for the `payload.json` attestation payload.
             */
            signature?: pulumi.Input<string>;
        }
        /**
         * Metadata for any related URL information
         */
        interface RelatedUrl {
            /**
             * Label to describe usage of the URL
             */
            label?: pulumi.Input<string>;
            /**
             * Specific URL to associate with the note
             */
            url?: pulumi.Input<string>;
        }
        /**
         * RepoSource describes the location of the source in a Google Cloud Source Repository.
         */
        interface RepoSource {
            /**
             * Name of the branch to build.
             */
            branchName?: pulumi.Input<string>;
            /**
             * Explicit commit SHA to build.
             */
            commitSha?: pulumi.Input<string>;
            /**
             * ID of the project that owns the repo.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Name of the repo.
             */
            repoName?: pulumi.Input<string>;
            /**
             * Name of the tag to build.
             */
            tagName?: pulumi.Input<string>;
        }
        /**
         *  Resource is an entity that can have metadata. E.g., a Docker image.
         */
        interface Resource {
            /**
             * The hash of the resource content. E.g., the Docker digest.
             */
            contentHash?: pulumi.Input<inputs.containeranalysis.v1alpha1.Hash>;
            /**
             * The name of the resource. E.g., the name of a Docker image - "Debian".
             */
            name?: pulumi.Input<string>;
            /**
             * The unique URI of the resource. E.g., "https://gcr.io/project/image@sha256:foo" for a Docker image.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Source describes the location of the source used for the build.
         */
        interface Source {
            /**
             * If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.
             */
            additionalContexts?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1SourceContext>[]>;
            /**
             * If provided, the input binary artifacts for the build came from this location.
             */
            artifactStorageSource?: pulumi.Input<inputs.containeranalysis.v1alpha1.StorageSource>;
            /**
             * If provided, the source code used for the build came from this location.
             */
            context?: pulumi.Input<inputs.containeranalysis.v1alpha1.GoogleDevtoolsContaineranalysisV1alpha1SourceContext>;
            /**
             * Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build. The keys to this map are file paths used as build source and the values contain the hash values for those files. If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.
             */
            fileHashes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * If provided, get source from this location in a Cloud Repo.
             */
            repoSource?: pulumi.Input<inputs.containeranalysis.v1alpha1.RepoSource>;
            /**
             * If provided, get the source from this location in in Google Cloud Storage.
             */
            storageSource?: pulumi.Input<inputs.containeranalysis.v1alpha1.StorageSource>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * StorageSource describes the location of the source in an archive file in Google Cloud Storage.
         */
        interface StorageSource {
            /**
             * Google Cloud Storage bucket containing source (see [Bucket Name Requirements] (https://cloud.google.com/storage/docs/bucket-naming#requirements)).
             */
            bucket?: pulumi.Input<string>;
            /**
             * Google Cloud Storage generation for the object.
             */
            generation?: pulumi.Input<string>;
            /**
             * Google Cloud Storage object containing source.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * The Upgrade Distribution represents metadata about the Upgrade for each operating system (CPE). Some distributions have additional metadata around updates, classifying them into various categories and severities.
         */
        interface UpgradeDistribution {
            /**
             * The operating system classification of this Upgrade, as specified by the upstream operating system upgrade feed.
             */
            classification?: pulumi.Input<string>;
            /**
             * Required - The specific operating system this metadata applies to. See https://cpe.mitre.org/specification/.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The cve that would be resolved by this upgrade.
             */
            cve?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The severity as specified by the upstream operating system.
             */
            severity?: pulumi.Input<string>;
        }
        /**
         * An Upgrade Note represents a potential upgrade of a package to a given version. For each package version combination (i.e. bash 4.0, bash 4.1, bash 4.1.2), there will be a Upgrade Note.
         */
        interface UpgradeNote {
            /**
             * Metadata about the upgrade for each specific operating system.
             */
            distributions?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.UpgradeDistribution>[]>;
            /**
             * Required - The package this Upgrade is for.
             */
            package?: pulumi.Input<string>;
            /**
             * Required - The version of the package in machine + human readable form.
             */
            version?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
        }
        /**
         * An Upgrade Occurrence represents that a specific resource_url could install a specific upgrade. This presence is supplied via local sources (i.e. it is present in the mirror and the running system has noticed its availability).
         */
        interface UpgradeOccurrence {
            /**
             * Metadata about the upgrade for available for the specific operating system for the resource_url. This allows efficient filtering, as well as making it easier to use the occurrence.
             */
            distribution?: pulumi.Input<inputs.containeranalysis.v1alpha1.UpgradeDistribution>;
            /**
             * Required - The package this Upgrade is for.
             */
            package?: pulumi.Input<string>;
            /**
             * Required - The version of the package in a machine + human readable form.
             */
            parsedVersion?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
        }
        /**
         * Version contains structured information about the version of the package. For a discussion of this in Debian/Ubuntu: http://serverfault.com/questions/604541/debian-packages-version-convention For a discussion of this in Redhat/Fedora/Centos: http://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
         */
        interface Version {
            /**
             * Used to correct mistakes in the version numbering scheme.
             */
            epoch?: pulumi.Input<number>;
            /**
             * Whether this version is vulnerable, when defining the version bounds. For example, if the minimum version is 2.0, inclusive=true would say 2.0 is vulnerable, while inclusive=false would say it's not
             */
            inclusive?: pulumi.Input<boolean>;
            /**
             * Distinguish between sentinel MIN/MAX versions and normal versions. If kind is not NORMAL, then the other fields are ignored.
             */
            kind?: pulumi.Input<string>;
            /**
             * The main part of the version name.
             */
            name?: pulumi.Input<string>;
            /**
             * The iteration of the package build from the above version.
             */
            revision?: pulumi.Input<string>;
        }
        /**
         * Used by Occurrence to point to where the vulnerability exists and how to fix it.
         */
        interface VulnerabilityDetails {
            /**
             * The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
             */
            cvssScore?: pulumi.Input<number>;
            /**
             * The distro assigned severity for this vulnerability when that is available and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
             */
            effectiveSeverity?: pulumi.Input<string>;
            /**
             * The set of affected locations and their fixes (if available) within the associated resource.
             */
            packageIssue?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.PackageIssue>[]>;
            /**
             * The note provider assigned Severity of the vulnerability.
             */
            severity?: pulumi.Input<string>;
            /**
             * The type of package; whether native or non native(ruby gems, node.js packages etc)
             */
            type?: pulumi.Input<string>;
        }
        /**
         * The location of the vulnerability
         */
        interface VulnerabilityLocation {
            /**
             * The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar. This field can be used as a filter in list requests.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The package being described.
             */
            package?: pulumi.Input<string>;
            /**
             * The version of the package being described. This field can be used as a filter in list requests.
             */
            version?: pulumi.Input<inputs.containeranalysis.v1alpha1.Version>;
        }
        /**
         * VulnerabilityType provides metadata about a security vulnerability.
         */
        interface VulnerabilityType {
            /**
             * The CVSS score for this Vulnerability.
             */
            cvssScore?: pulumi.Input<number>;
            /**
             * All information about the package to specifically identify this vulnerability. One entry per (version range and cpe_uri) the package vulnerability has manifested in.
             */
            details?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1alpha1.Detail>[]>;
            /**
             * Note provider assigned impact of the vulnerability
             */
            severity?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * An alias to a repo revision.
         */
        interface AliasContext {
            /**
             * The alias kind.
             */
            kind?: pulumi.Input<string>;
            /**
             * The alias name.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Artifact describes a build product.
         */
        interface Artifact {
            /**
             * Hash or checksum value of a binary, or Docker Registry 2.0 digest of a container.
             */
            checksum?: pulumi.Input<string>;
            /**
             * Artifact ID, if any; for container images, this will be a URL by digest like `gcr.io/projectID/imagename@sha256:123456`.
             */
            id?: pulumi.Input<string>;
            /**
             * Related artifact names. This may be the path to a binary or jar file, or in the case of a container build, the name used to push the container image to Google Container Registry, as presented to `docker push`. Note that a single Artifact ID can have multiple names, for example if two tags are applied to one image.
             */
            names?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Defines a hash object for use in Materials and Products.
         */
        interface ArtifactHashes {
            sha256?: pulumi.Input<string>;
        }
        /**
         * Defines an object to declare an in-toto artifact rule
         */
        interface ArtifactRule {
            artifactRule?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for look-up (how to find this attestation if you already know the authority and artifact to be verified) and intent (which authority was this attestation intended to sign for).
         */
        interface Attestation {
            genericSignedAttestation?: pulumi.Input<inputs.containeranalysis.v1beta1.GenericSignedAttestation>;
            /**
             * A PGP signed attestation.
             */
            pgpSignedAttestation?: pulumi.Input<inputs.containeranalysis.v1beta1.PgpSignedAttestation>;
        }
        /**
         * Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one `Authority` for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.
         */
        interface Authority {
            /**
             * Hint hints at the purpose of the attestation authority.
             */
            hint?: pulumi.Input<inputs.containeranalysis.v1beta1.Hint>;
        }
        /**
         * Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM Or an equivalent reference, e.g. a tag of the resource_url.
         */
        interface Basis {
            /**
             * Required. Immutable. The fingerprint of the base image.
             */
            fingerprint?: pulumi.Input<inputs.containeranalysis.v1beta1.Fingerprint>;
            /**
             * Required. Immutable. The resource_url for the resource representing the basis of associated occurrence images.
             */
            resourceUrl?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.containeranalysis.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.
         */
        interface Build {
            /**
             * Required. Immutable. Version of the builder which produced this build.
             */
            builderVersion?: pulumi.Input<string>;
            /**
             * Signature of the build in occurrences pointing to this build note containing build details.
             */
            signature?: pulumi.Input<inputs.containeranalysis.v1beta1.BuildSignature>;
        }
        /**
         * Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.
         */
        interface BuildProvenance {
            /**
             * Special options applied to this build. This is a catch-all field where build providers can enter any desired additional details.
             */
            buildOptions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Version string of the builder at the time this build was executed.
             */
            builderVersion?: pulumi.Input<string>;
            /**
             * Output of the build.
             */
            builtArtifacts?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Artifact>[]>;
            /**
             * Commands requested by the build.
             */
            commands?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Command>[]>;
            /**
             * Time at which the build was created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * E-mail address of the user who initiated this build. Note that this was the user's e-mail address at the time the build was initiated; this address may not represent the same end-user for all time.
             */
            creator?: pulumi.Input<string>;
            /**
             * Time at which execution of the build was finished.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Required. Unique identifier of the build.
             */
            id?: pulumi.Input<string>;
            /**
             * URI where any logs for this provenance were written.
             */
            logsUri?: pulumi.Input<string>;
            /**
             * ID of the project.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Details of the Source input to the build.
             */
            sourceProvenance?: pulumi.Input<inputs.containeranalysis.v1beta1.Source>;
            /**
             * Time at which execution of the build was started.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Trigger identifier if the build was triggered automatically; empty if not.
             */
            triggerId?: pulumi.Input<string>;
        }
        /**
         * Message encapsulating the signature of the verified build.
         */
        interface BuildSignature {
            /**
             * An ID for the key used to sign. This could be either an ID for the key stored in `public_key` (such as the ID or fingerprint for a PGP key, or the CN for a cert), or a reference to an external key (such as a reference to a key in Cloud Key Management Service).
             */
            keyId?: pulumi.Input<string>;
            /**
             * The type of the key, either stored in `public_key` or referenced in `key_id`.
             */
            keyType?: pulumi.Input<string>;
            /**
             * Public key of the builder which can be used to verify that the related findings are valid and unchanged. If `key_type` is empty, this defaults to PEM encoded public keys. This field may be empty if `key_id` references an external key. For Cloud Build based signatures, this is a PEM encoded public key. To verify the Cloud Build signature, place the contents of this field into a file (public.pem). The signature field is base64-decoded into its binary representation in signature.bin, and the provenance bytes from `BuildDetails` are base64-decoded into a binary representation in signed.bin. OpenSSL can then verify the signature: `openssl sha256 -verify public.pem -signature signature.bin signed.bin`
             */
            publicKey?: pulumi.Input<string>;
            /**
             * Required. Signature of the related `BuildProvenance`. In JSON, this is base-64 encoded.
             */
            signature?: pulumi.Input<string>;
        }
        /**
         * Defines an object for the byproducts field in in-toto links. The suggested fields are "stderr", "stdout", and "return-value".
         */
        interface ByProducts {
            customValues?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document
         */
        interface CVSSv3 {
            attackComplexity?: pulumi.Input<string>;
            /**
             * Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
             */
            attackVector?: pulumi.Input<string>;
            availabilityImpact?: pulumi.Input<string>;
            /**
             * The base score is a function of the base metric scores.
             */
            baseScore?: pulumi.Input<number>;
            confidentialityImpact?: pulumi.Input<string>;
            exploitabilityScore?: pulumi.Input<number>;
            impactScore?: pulumi.Input<number>;
            integrityImpact?: pulumi.Input<string>;
            privilegesRequired?: pulumi.Input<string>;
            scope?: pulumi.Input<string>;
            userInteraction?: pulumi.Input<string>;
        }
        /**
         * A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.
         */
        interface CloudRepoSourceContext {
            /**
             * An alias, which may be a branch or tag.
             */
            aliasContext?: pulumi.Input<inputs.containeranalysis.v1beta1.AliasContext>;
            /**
             * The ID of the repo.
             */
            repoId?: pulumi.Input<inputs.containeranalysis.v1beta1.RepoId>;
            /**
             * A revision ID.
             */
            revisionId?: pulumi.Input<string>;
        }
        /**
         * Command describes a step performed as part of the build pipeline.
         */
        interface Command {
            /**
             * Command-line arguments used when executing this command.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Working directory (relative to project source root) used when running this command.
             */
            dir?: pulumi.Input<string>;
            /**
             * Environment variables set before running this command.
             */
            env?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional unique identifier for this command, used in wait_for to reference this command as a dependency.
             */
            id?: pulumi.Input<string>;
            /**
             * Required. Name of the command, as presented on the command line, or if the command is packaged as a Docker container, as presented to `docker pull`.
             */
            name?: pulumi.Input<string>;
            /**
             * The ID(s) of the command(s) that this command depends on.
             */
            waitFor?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * An artifact that can be deployed in some runtime.
         */
        interface Deployable {
            /**
             * Required. Resource URI for the artifact being deployed.
             */
            resourceUri?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The period during which some deployable was active in a runtime.
         */
        interface Deployment {
            /**
             * Address of the runtime element hosting this deployment.
             */
            address?: pulumi.Input<string>;
            /**
             * Configuration used to create this deployment.
             */
            config?: pulumi.Input<string>;
            /**
             * Required. Beginning of the lifetime of this deployment.
             */
            deployTime?: pulumi.Input<string>;
            /**
             * Platform hosting this deployment.
             */
            platform?: pulumi.Input<string>;
            /**
             * Resource URI for the artifact being deployed taken from the deployable field with the same name.
             */
            resourceUri?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * End of the lifetime of this deployment.
             */
            undeployTime?: pulumi.Input<string>;
            /**
             * Identity of the user that triggered this deployment.
             */
            userEmail?: pulumi.Input<string>;
        }
        /**
         * Derived describes the derived image portion (Occurrence) of the DockerImage relationship. This image would be produced from a Dockerfile with FROM .
         */
        interface Derived {
            /**
             * This contains the base image URL for the derived image occurrence.
             */
            baseResourceUrl?: pulumi.Input<string>;
            /**
             * The number of layers by which this image differs from the associated image basis.
             */
            distance?: pulumi.Input<number>;
            /**
             * Required. The fingerprint of the derived image.
             */
            fingerprint?: pulumi.Input<inputs.containeranalysis.v1beta1.Fingerprint>;
            /**
             * This contains layer-specific metadata, if populated it has length "distance" and is ordered with [distance] being the layer immediately following the base image and [1] being the final layer.
             */
            layerInfo?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Layer>[]>;
        }
        /**
         * Identifies all appearances of this vulnerability in the package for a specific distro/location. For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2
         */
        interface Detail {
            /**
             * Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) in which the vulnerability manifests. Examples include distro or storage location for vulnerable jar.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * A vendor-specific description of this note.
             */
            description?: pulumi.Input<string>;
            /**
             * The fix for this specific package version.
             */
            fixedLocation?: pulumi.Input<inputs.containeranalysis.v1beta1.VulnerabilityLocation>;
            /**
             * Whether this detail is obsolete. Occurrences are expected not to point to obsolete details.
             */
            isObsolete?: pulumi.Input<boolean>;
            /**
             * The max version of the package in which the vulnerability exists.
             */
            maxAffectedVersion?: pulumi.Input<inputs.containeranalysis.v1beta1.Version>;
            /**
             * The min version of the package in which the vulnerability exists.
             */
            minAffectedVersion?: pulumi.Input<inputs.containeranalysis.v1beta1.Version>;
            /**
             * Required. The name of the package where the vulnerability was found.
             */
            package?: pulumi.Input<string>;
            /**
             * The type of package; whether native or non native(ruby gems, node.js packages etc).
             */
            packageType?: pulumi.Input<string>;
            /**
             * The severity (eg: distro assigned severity) for this vulnerability.
             */
            severityName?: pulumi.Input<string>;
            /**
             * The source from which the information in this Detail was obtained.
             */
            source?: pulumi.Input<string>;
            /**
             * The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
             */
            sourceUpdateTime?: pulumi.Input<string>;
            /**
             * The name of the vendor of the product.
             */
            vendor?: pulumi.Input<string>;
        }
        /**
         * Details of an attestation occurrence.
         */
        interface Details {
            /**
             * Required. Attestation for the resource.
             */
            attestation?: pulumi.Input<inputs.containeranalysis.v1beta1.Attestation>;
        }
        /**
         * Provides information about the analysis status of a discovered resource.
         */
        interface Discovered {
            /**
             * The status of discovery for the resource.
             */
            analysisStatus?: pulumi.Input<string>;
            /**
             * When an error is encountered this will contain a LocalizedMessage under details to show to the user. The LocalizedMessage is output only and populated by the API.
             */
            analysisStatusError?: pulumi.Input<inputs.containeranalysis.v1beta1.Status>;
            /**
             * Whether the resource is continuously analyzed.
             */
            continuousAnalysis?: pulumi.Input<string>;
            /**
             * The last time continuous analysis was done for this resource. Deprecated, do not use.
             */
            lastAnalysisTime?: pulumi.Input<string>;
        }
        /**
         * A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A `Discovery` occurrence is created in a consumer's project at the start of analysis.
         */
        interface Discovery {
            /**
             * Required. Immutable. The kind of analysis that is handled by this discovery.
             */
            analysisKind?: pulumi.Input<string>;
        }
        /**
         * This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.
         */
        interface Distribution {
            /**
             * The CPU architecture for which packages in this distribution channel were built.
             */
            architecture?: pulumi.Input<string>;
            /**
             * Required. The cpe_uri in [CPE format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The distribution channel-specific description of this package.
             */
            description?: pulumi.Input<string>;
            /**
             * The latest available version of this package in this distribution channel.
             */
            latestVersion?: pulumi.Input<inputs.containeranalysis.v1beta1.Version>;
            /**
             * A freeform string denoting the maintainer of this package.
             */
            maintainer?: pulumi.Input<string>;
            /**
             * The distribution channel-specific homepage for this package.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Defines an object for the environment field in in-toto links. The suggested fields are "variables", "filesystem", and "workdir".
         */
        interface Environment {
            customValues?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A set of properties that uniquely identify a given Docker image.
         */
        interface Fingerprint {
            /**
             * Required. The layer ID of the final layer in the Docker image's v1 representation.
             */
            v1Name?: pulumi.Input<string>;
            /**
             * Required. The ordered list of v2 blobs that represent a given image.
             */
            v2Blob?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the image's v2 blobs computed via: [bottom] := v2_blobbottom := sha256(v2_blob[N] + " " + v2_name[N+1]) Only the name of the final blob is kept.
             */
            v2Name?: pulumi.Input<string>;
        }
        /**
         * An attestation wrapper that uses the Grafeas `Signature` message. This attestation must define the `serialized_payload` that the `signatures` verify and any metadata necessary to interpret that plaintext. The signatures should always be over the `serialized_payload` bytestring.
         */
        interface GenericSignedAttestation {
            /**
             * Type (for example schema) of the attestation payload that was signed. The verifier must ensure that the provided type is one that the verifier supports, and that the attestation payload is a valid instantiation of that type (for example by validating a JSON schema).
             */
            contentType?: pulumi.Input<string>;
            /**
             * The serialized payload that is verified by one or more `signatures`. The encoding and semantic meaning of this payload must match what is set in `content_type`.
             */
            serializedPayload?: pulumi.Input<string>;
            /**
             * One or more signatures over `serialized_payload`. Verifier implementations should consider this attestation message verified if at least one `signature` verifies `serialized_payload`. See `Signature` in common.proto for more details on signature structure and verification.
             */
            signatures?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Signature>[]>;
        }
        /**
         * A SourceContext referring to a Gerrit project.
         */
        interface GerritSourceContext {
            /**
             * An alias, which may be a branch or tag.
             */
            aliasContext?: pulumi.Input<inputs.containeranalysis.v1beta1.AliasContext>;
            /**
             * The full project name within the host. Projects may be nested, so "project/subproject" is a valid project name. The "repo name" is the hostURI/project.
             */
            gerritProject?: pulumi.Input<string>;
            /**
             * The URI of a running Gerrit instance.
             */
            hostUri?: pulumi.Input<string>;
            /**
             * A revision (commit) ID.
             */
            revisionId?: pulumi.Input<string>;
        }
        /**
         * A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).
         */
        interface GitSourceContext {
            /**
             * Git commit hash.
             */
            revisionId?: pulumi.Input<string>;
            /**
             * Git repository URL.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Details of a build occurrence.
         */
        interface GrafeasV1beta1BuildDetails {
            /**
             * Required. The actual provenance for the build.
             */
            provenance?: pulumi.Input<inputs.containeranalysis.v1beta1.BuildProvenance>;
            /**
             * Serialized JSON representation of the provenance, used in generating the build signature in the corresponding build note. After verifying the signature, `provenance_bytes` can be unmarshalled and compared to the provenance to confirm that it is unchanged. A base64-encoded string representation of the provenance bytes is used for the signature in order to interoperate with openssl which expects this format for signature verification. The serialized form is captured both to avoid ambiguity in how the provenance is marshalled to json as well to prevent incompatibilities with future changes.
             */
            provenanceBytes?: pulumi.Input<string>;
        }
        /**
         * Details of a deployment occurrence.
         */
        interface GrafeasV1beta1DeploymentDetails {
            /**
             * Required. Deployment history for the resource.
             */
            deployment?: pulumi.Input<inputs.containeranalysis.v1beta1.Deployment>;
        }
        /**
         * Details of a discovery occurrence.
         */
        interface GrafeasV1beta1DiscoveryDetails {
            /**
             * Required. Analysis status for the discovered resource.
             */
            discovered?: pulumi.Input<inputs.containeranalysis.v1beta1.Discovered>;
        }
        /**
         * Details of an image occurrence.
         */
        interface GrafeasV1beta1ImageDetails {
            /**
             * Required. Immutable. The child image derived from the base image.
             */
            derivedImage?: pulumi.Input<inputs.containeranalysis.v1beta1.Derived>;
        }
        interface GrafeasV1beta1IntotoArtifact {
            hashes?: pulumi.Input<inputs.containeranalysis.v1beta1.ArtifactHashes>;
            resourceUri?: pulumi.Input<string>;
        }
        /**
         * This corresponds to a signed in-toto link - it is made up of one or more signatures and the in-toto link itself. This is used for occurrences of a Grafeas in-toto note.
         */
        interface GrafeasV1beta1IntotoDetails {
            signatures?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.GrafeasV1beta1IntotoSignature>[]>;
            signed?: pulumi.Input<inputs.containeranalysis.v1beta1.Link>;
        }
        /**
         * A signature object consists of the KeyID used and the signature itself.
         */
        interface GrafeasV1beta1IntotoSignature {
            keyid?: pulumi.Input<string>;
            sig?: pulumi.Input<string>;
        }
        /**
         * Details of a package occurrence.
         */
        interface GrafeasV1beta1PackageDetails {
            /**
             * Required. Where the package was installed.
             */
            installation?: pulumi.Input<inputs.containeranalysis.v1beta1.Installation>;
        }
        /**
         * Details of a vulnerability Occurrence.
         */
        interface GrafeasV1beta1VulnerabilityDetails {
            /**
             * The CVSS score of this vulnerability. CVSS score is on a scale of 0-10 where 0 indicates low severity and 10 indicates high severity.
             */
            cvssScore?: pulumi.Input<number>;
            /**
             * The distro assigned severity for this vulnerability when it is available, and note provider assigned severity when distro has not yet assigned a severity for this vulnerability.
             */
            effectiveSeverity?: pulumi.Input<string>;
            /**
             * A detailed description of this vulnerability.
             */
            longDescription?: pulumi.Input<string>;
            /**
             * Required. The set of affected locations and their fixes (if available) within the associated resource.
             */
            packageIssue?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.PackageIssue>[]>;
            /**
             * URLs related to this vulnerability.
             */
            relatedUrls?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.RelatedUrl>[]>;
            /**
             * The note provider assigned Severity of the vulnerability.
             */
            severity?: pulumi.Input<string>;
            /**
             * A one sentence description of this vulnerability.
             */
            shortDescription?: pulumi.Input<string>;
            /**
             * The type of package; whether native or non native(ruby gems, node.js packages etc)
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Container message for hash values.
         */
        interface Hash {
            /**
             * Required. The type of hash that was performed.
             */
            type?: pulumi.Input<string>;
            /**
             * Required. The hash value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.
         */
        interface Hint {
            /**
             * Required. The human readable name of this attestation authority, for example "qa".
             */
            humanReadableName?: pulumi.Input<string>;
        }
        /**
         * This contains the fields corresponding to the definition of a software supply chain step in an in-toto layout. This information goes into a Grafeas note.
         */
        interface InToto {
            /**
             * This field contains the expected command used to perform the step.
             */
            expectedCommand?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The following fields contain in-toto artifact rules identifying the artifacts that enter this supply chain step, and exit the supply chain step, i.e. materials and products of the step.
             */
            expectedMaterials?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.ArtifactRule>[]>;
            expectedProducts?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.ArtifactRule>[]>;
            /**
             * This field contains the public keys that can be used to verify the signatures on the step metadata.
             */
            signingKeys?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.SigningKey>[]>;
            /**
             * This field identifies the name of the step in the supply chain.
             */
            stepName?: pulumi.Input<string>;
            /**
             * This field contains a value that indicates the minimum number of keys that need to be used to sign the step's in-toto link.
             */
            threshold?: pulumi.Input<string>;
        }
        /**
         * This represents how a particular software package may be installed on a system.
         */
        interface Installation {
            /**
             * Required. All of the places within the filesystem versions of this package have been found.
             */
            location?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Location>[]>;
            /**
             * The name of the installed package.
             */
            name?: pulumi.Input<string>;
        }
        interface KnowledgeBase {
            /**
             * The KB name (generally of the form KB[0-9]+ i.e. KB123456).
             */
            name?: pulumi.Input<string>;
            /**
             * A link to the KB in the Windows update catalog - https://www.catalog.update.microsoft.com/
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Layer holds metadata specific to a layer of a Docker image.
         */
        interface Layer {
            /**
             * The recovered arguments to the Dockerfile directive.
             */
            arguments?: pulumi.Input<string>;
            /**
             * Required. The recovered Dockerfile directive used to construct this layer.
             */
            directive?: pulumi.Input<string>;
        }
        /**
         * This corresponds to an in-toto link.
         */
        interface Link {
            /**
             * ByProducts are data generated as part of a software supply chain step, but are not the actual result of the step.
             */
            byproducts?: pulumi.Input<inputs.containeranalysis.v1beta1.ByProducts>;
            /**
             * This field contains the full command executed for the step. This can also be empty if links are generated for operations that aren't directly mapped to a specific command. Each term in the command is an independent string in the list. An example of a command in the in-toto metadata field is: "command": ["git", "clone", "https://github.com/in-toto/demo-project.git"]
             */
            command?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * This is a field that can be used to capture information about the environment. It is suggested for this field to contain information that details environment variables, filesystem information, and the present working directory. The recommended structure of this field is: "environment": { "custom_values": { "variables": "", "filesystem": "", "workdir": "", "": "..." } }
             */
            environment?: pulumi.Input<inputs.containeranalysis.v1beta1.Environment>;
            /**
             * Materials are the supply chain artifacts that go into the step and are used for the operation performed. The key of the map is the path of the artifact and the structure contains the recorded hash information. An example is: "materials": [ { "resource_uri": "foo/bar", "hashes": { "sha256": "ebebf...", : } } ]
             */
            materials?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.GrafeasV1beta1IntotoArtifact>[]>;
            /**
             * Products are the supply chain artifacts generated as a result of the step. The structure is identical to that of materials.
             */
            products?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.GrafeasV1beta1IntotoArtifact>[]>;
        }
        /**
         * An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in `/var/lib/dpkg/status`.
         */
        interface Location {
            /**
             * Required. The CPE URI in [CPE format](https://cpe.mitre.org/specification/) denoting the package manager version distributing a package.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The path from which we gathered that this package/version is installed.
             */
            path?: pulumi.Input<string>;
            /**
             * The version installed at this location.
             */
            version?: pulumi.Input<inputs.containeranalysis.v1beta1.Version>;
        }
        /**
         * This represents a particular package that is distributed over various channels. E.g., glibc (aka libc6) is distributed by many, at various versions.
         */
        interface Package {
            /**
             * The various channels by which a package is distributed.
             */
            distribution?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Distribution>[]>;
            /**
             * Required. Immutable. The name of the package.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * This message wraps a location affected by a vulnerability and its associated fix (if one is available).
         */
        interface PackageIssue {
            /**
             * Required. The location of the vulnerability.
             */
            affectedLocation?: pulumi.Input<inputs.containeranalysis.v1beta1.VulnerabilityLocation>;
            /**
             * The location of the available fix for vulnerability.
             */
            fixedLocation?: pulumi.Input<inputs.containeranalysis.v1beta1.VulnerabilityLocation>;
            /**
             * Deprecated, use Details.effective_severity instead The severity (e.g., distro assigned severity) for this vulnerability.
             */
            severityName?: pulumi.Input<string>;
        }
        /**
         * An attestation wrapper with a PGP-compatible signature. This message only supports `ATTACHED` signatures, where the payload that is signed is included alongside the signature itself in the same file.
         */
        interface PgpSignedAttestation {
            /**
             * Type (for example schema) of the attestation payload that was signed. The verifier must ensure that the provided type is one that the verifier supports, and that the attestation payload is a valid instantiation of that type (for example by validating a JSON schema).
             */
            contentType?: pulumi.Input<string>;
            /**
             * The cryptographic fingerprint of the key used to generate the signature, as output by, e.g. `gpg --list-keys`. This should be the version 4, full 160-bit fingerprint, expressed as a 40 character hexidecimal string. See https://tools.ietf.org/html/rfc4880#section-12.2 for details. Implementations may choose to acknowledge "LONG", "SHORT", or other abbreviated key IDs, but only the full fingerprint is guaranteed to work. In gpg, the full fingerprint can be retrieved from the `fpr` field returned when calling --list-keys with --with-colons. For example: ``` gpg --with-colons --with-fingerprint --force-v4-certs \ --list-keys attester@example.com tru::1:1513631572:0:3:1:5 pub:...... fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB: ``` Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
             */
            pgpKeyId?: pulumi.Input<string>;
            /**
             * Required. The raw content of the signature, as output by GNU Privacy Guard (GPG) or equivalent. Since this message only supports attached signatures, the payload that was signed must be attached. While the signature format supported is dependent on the verification implementation, currently only ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor --output=signature.gpg payload.json` will create the signature content expected in this field in `signature.gpg` for the `payload.json` attestation payload.
             */
            signature?: pulumi.Input<string>;
        }
        /**
         * Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.
         */
        interface ProjectRepoId {
            /**
             * The ID of the project.
             */
            projectId?: pulumi.Input<string>;
            /**
             * The name of the repo. Leave empty for the default repo.
             */
            repoName?: pulumi.Input<string>;
        }
        /**
         * Metadata for any related URL information.
         */
        interface RelatedUrl {
            /**
             * Label to describe usage of the URL.
             */
            label?: pulumi.Input<string>;
            /**
             * Specific URL associated with the resource.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * A unique identifier for a Cloud Repo.
         */
        interface RepoId {
            /**
             * A combination of a project ID and a repo name.
             */
            projectRepoId?: pulumi.Input<inputs.containeranalysis.v1beta1.ProjectRepoId>;
            /**
             * A server-assigned, globally unique identifier.
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * An entity that can have metadata. For example, a Docker image.
         */
        interface Resource {
            /**
             * Deprecated, do not use. Use uri instead. The hash of the resource content. For example, the Docker digest.
             */
            contentHash?: pulumi.Input<inputs.containeranalysis.v1beta1.Hash>;
            /**
             * Deprecated, do not use. Use uri instead. The name of the resource. For example, the name of a Docker image - "Debian".
             */
            name?: pulumi.Input<string>;
            /**
             * Required. The unique URI of the resource. For example, `https://gcr.io/project/image@sha256:foo` for a Docker image.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from `public_key_id` to public key material (and any required parameters, e.g. signing algorithm). In particular, verification implementations MUST NOT treat the signature `public_key_id` as anything more than a key lookup hint. The `public_key_id` DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances: * The `public_key_id` is not recognized by the verifier. * The public key that `public_key_id` refers to does not verify the signature with respect to the payload. The `signature` contents SHOULD NOT be "attached" (where the payload is included with the serialized `signature` bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a `payload` field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).
         */
        interface Signature {
            /**
             * The identifier for the public key that verifies this signature. * The `public_key_id` is required. * The `public_key_id` SHOULD be an RFC3986 conformant URI. * When possible, the `public_key_id` SHOULD be an immutable reference, such as a cryptographic digest. Examples of valid `public_key_id`s: OpenPGP V4 public key fingerprint: * "openpgp4fpr:74FAF3B861BDA0870C7B6DEF607E48D2A663AEEA" See https://www.iana.org/assignments/uri-schemes/prov/openpgp4fpr for more details on this scheme. RFC6920 digest-named SubjectPublicKeyInfo (digest of the DER serialization): * "ni:///sha-256;cD9o9Cq6LG3jD0iKXqEi_vdjJGecm_iXkbqVoScViaU" * "nih:///sha-256;703f68f42aba2c6de30f488a5ea122fef76324679c9bf89791ba95a1271589a5"
             */
            publicKeyId?: pulumi.Input<string>;
            /**
             * The content of the signature, an opaque bytestring. The payload that this signature verifies MUST be unambiguously provided with the Signature during verification. A wrapper message might provide the payload explicitly. Alternatively, a message might have a canonical serialization that can always be unambiguously computed to derive the payload.
             */
            signature?: pulumi.Input<string>;
        }
        /**
         * This defines the format used to record keys used in the software supply chain. An in-toto link is attested using one or more keys defined in the in-toto layout. An example of this is: { "key_id": "776a00e29f3559e0141b3b096f696abc6cfb0c657ab40f441132b345b0...", "key_type": "rsa", "public_key_value": "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0B...", "key_scheme": "rsassa-pss-sha256" } The format for in-toto's key definition can be found in section 4.2 of the in-toto specification.
         */
        interface SigningKey {
            /**
             * key_id is an identifier for the signing key.
             */
            keyId?: pulumi.Input<string>;
            /**
             * This field contains the corresponding signature scheme. Eg: "rsassa-pss-sha256".
             */
            keyScheme?: pulumi.Input<string>;
            /**
             * This field identifies the specific signing method. Eg: "rsa", "ed25519", and "ecdsa".
             */
            keyType?: pulumi.Input<string>;
            /**
             * This field contains the actual public key.
             */
            publicKeyValue?: pulumi.Input<string>;
        }
        /**
         * Source describes the location of the source used for the build.
         */
        interface Source {
            /**
             * If provided, some of the source code used for the build may be found in these locations, in the case where the source repository had multiple remotes or submodules. This list will not include the context specified in the context field.
             */
            additionalContexts?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.SourceContext>[]>;
            /**
             * If provided, the input binary artifacts for the build came from this location.
             */
            artifactStorageSourceUri?: pulumi.Input<string>;
            /**
             * If provided, the source code used for the build came from this location.
             */
            context?: pulumi.Input<inputs.containeranalysis.v1beta1.SourceContext>;
            /**
             * Hash(es) of the build source, which can be used to verify that the original source integrity was maintained in the build. The keys to this map are file paths used as build source and the values contain the hash values for those files. If the build source came in a single package such as a gzipped tarfile (.tar.gz), the FileHash will be for the single path to that file.
             */
            fileHashes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.
         */
        interface SourceContext {
            /**
             * A SourceContext referring to a revision in a Google Cloud Source Repo.
             */
            cloudRepo?: pulumi.Input<inputs.containeranalysis.v1beta1.CloudRepoSourceContext>;
            /**
             * A SourceContext referring to a Gerrit project.
             */
            gerrit?: pulumi.Input<inputs.containeranalysis.v1beta1.GerritSourceContext>;
            /**
             * A SourceContext referring to any third party Git repo (e.g., GitHub).
             */
            git?: pulumi.Input<inputs.containeranalysis.v1beta1.GitSourceContext>;
            /**
             * Labels with user defined metadata.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Version contains structured information about the version of a package.
         */
        interface Version {
            /**
             * Used to correct mistakes in the version numbering scheme.
             */
            epoch?: pulumi.Input<number>;
            /**
             * Whether this version is specifying part of an inclusive range. Grafeas does not have the capability to specify version ranges; instead we have fields that specify start version and end versions. At times this is insufficient - we also need to specify whether the version is included in the range or is excluded from the range. This boolean is expected to be set to true when the version is included in a range.
             */
            inclusive?: pulumi.Input<boolean>;
            /**
             * Required. Distinguishes between sentinel MIN/MAX versions and normal versions.
             */
            kind?: pulumi.Input<string>;
            /**
             * Required only when version kind is NORMAL. The main part of the version name.
             */
            name?: pulumi.Input<string>;
            /**
             * The iteration of the package build from the above version.
             */
            revision?: pulumi.Input<string>;
        }
        /**
         * Vulnerability provides metadata about a security vulnerability in a Note.
         */
        interface Vulnerability {
            /**
             * The CVSS score for this vulnerability.
             */
            cvssScore?: pulumi.Input<number>;
            /**
             * The full description of the CVSSv3.
             */
            cvssV3?: pulumi.Input<inputs.containeranalysis.v1beta1.CVSSv3>;
            /**
             * All information about the package to specifically identify this vulnerability. One entry per (version range and cpe_uri) the package vulnerability has manifested in.
             */
            details?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.Detail>[]>;
            /**
             * Note provider assigned impact of the vulnerability.
             */
            severity?: pulumi.Input<string>;
            /**
             * The time this information was last changed at the source. This is an upstream timestamp from the underlying information source - e.g. Ubuntu security tracker.
             */
            sourceUpdateTime?: pulumi.Input<string>;
            /**
             * Windows details get their own format because the information format and model don't match a normal detail. Specifically Windows updates are done as patches, thus Windows vulnerabilities really are a missing package, rather than a package being at an incorrect version.
             */
            windowsDetails?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.WindowsDetail>[]>;
        }
        /**
         * The location of the vulnerability.
         */
        interface VulnerabilityLocation {
            /**
             * Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) format. Examples include distro or storage location for vulnerable jar.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * Required. The package being described.
             */
            package?: pulumi.Input<string>;
            /**
             * Required. The version of the package being described.
             */
            version?: pulumi.Input<inputs.containeranalysis.v1beta1.Version>;
        }
        interface WindowsDetail {
            /**
             * Required. The CPE URI in [cpe format](https://cpe.mitre.org/specification/) in which the vulnerability manifests. Examples include distro or storage location for vulnerable jar.
             */
            cpeUri?: pulumi.Input<string>;
            /**
             * The description of the vulnerability.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. The names of the KBs which have hotfixes to mitigate this vulnerability. Note that there may be multiple hotfixes (and thus multiple KBs) that mitigate a given vulnerability. Currently any listed kb's presence is considered a fix.
             */
            fixingKbs?: pulumi.Input<pulumi.Input<inputs.containeranalysis.v1beta1.KnowledgeBase>[]>;
            /**
             * Required. The name of the vulnerability.
             */
            name?: pulumi.Input<string>;
        }
    }
}
export declare namespace datacatalog {
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.datacatalog.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Spec for a group of BigQuery tables with name pattern `[prefix]YYYYMMDD`. Context: https://cloud.google.com/bigquery/docs/partitioned-tables#partitioning_versus_sharding
         */
        interface GoogleCloudDatacatalogV1beta1BigQueryDateShardedSpec {
        }
        /**
         * Describes a BigQuery table.
         */
        interface GoogleCloudDatacatalogV1beta1BigQueryTableSpec {
            /**
             * Spec of a BigQuery table. This field should only be populated if `table_source_type` is `BIGQUERY_TABLE`.
             */
            tableSpec?: pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1TableSpec>;
            /**
             * Table view specification. This field should only be populated if `table_source_type` is `BIGQUERY_VIEW`.
             */
            viewSpec?: pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1ViewSpec>;
        }
        /**
         * Representation of a column within a schema. Columns could be nested inside other columns.
         */
        interface GoogleCloudDatacatalogV1beta1ColumnSchema {
            /**
             * Required. Name of the column.
             */
            column?: pulumi.Input<string>;
            /**
             * Optional. Description of the column. Default value is an empty string.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. A column's mode indicates whether the values in this column are required, nullable, etc. Only `NULLABLE`, `REQUIRED` and `REPEATED` are supported. Default mode is `NULLABLE`.
             */
            mode?: pulumi.Input<string>;
            /**
             * Optional. Schema of sub-columns. A column can have zero or more sub-columns.
             */
            subcolumns?: pulumi.Input<pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1ColumnSchema>[]>;
            /**
             * Required. Type of the column.
             */
            type?: pulumi.Input<string>;
        }
        interface GoogleCloudDatacatalogV1beta1FieldType {
            /**
             * Represents an enum type.
             */
            enumType?: pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1FieldTypeEnumType>;
            /**
             * Represents primitive types - string, bool etc.
             */
            primitiveType?: pulumi.Input<string>;
        }
        interface GoogleCloudDatacatalogV1beta1FieldTypeEnumType {
            allowedValues?: pulumi.Input<pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1FieldTypeEnumTypeEnumValue>[]>;
        }
        interface GoogleCloudDatacatalogV1beta1FieldTypeEnumTypeEnumValue {
            /**
             * Required. The display name of the enum value. Must not be an empty string.
             */
            displayName?: pulumi.Input<string>;
        }
        /**
         * Describes a Cloud Storage fileset entry.
         */
        interface GoogleCloudDatacatalogV1beta1GcsFilesetSpec {
            /**
             * Required. Patterns to identify a set of files in Google Cloud Storage. See [Cloud Storage documentation](https://cloud.google.com/storage/docs/gsutil/addlhelp/WildcardNames) for more information. Note that bucket wildcards are currently not supported. Examples of valid file_patterns: * `gs://bucket_name/dir/*`: matches all files within `bucket_name/dir` directory. * `gs://bucket_name/dir/**`: matches all files in `bucket_name/dir` spanning all subdirectories. * `gs://bucket_name/file*`: matches files prefixed by `file` in `bucket_name` * `gs://bucket_name/??.txt`: matches files with two characters followed by `.txt` in `bucket_name` * `gs://bucket_name/[aeiou].txt`: matches files that contain a single vowel character followed by `.txt` in `bucket_name` * `gs://bucket_name/[a-m].txt`: matches files that contain `a`, `b`, ... or `m` followed by `.txt` in `bucket_name` * `gs://bucket_name/a/*&#47;b`: matches all files in `bucket_name` that match `a/*&#47;b` pattern, such as `a/c/b`, `a/d/b` * `gs://another_bucket/a.txt`: matches `gs://another_bucket/a.txt` You can combine wildcards to provide more powerful matches, for example: * `gs://bucket_name/[a-m]??.j*g`
             */
            filePatterns?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a schema (e.g. BigQuery, GoogleSQL, Avro schema).
         */
        interface GoogleCloudDatacatalogV1beta1Schema {
            /**
             * Required. Schema of columns. A maximum of 10,000 columns and sub-columns can be specified.
             */
            columns?: pulumi.Input<pulumi.Input<inputs.datacatalog.v1beta1.GoogleCloudDatacatalogV1beta1ColumnSchema>[]>;
        }
        /**
         * Normal BigQuery table spec.
         */
        interface GoogleCloudDatacatalogV1beta1TableSpec {
        }
        /**
         * Table view specification.
         */
        interface GoogleCloudDatacatalogV1beta1ViewSpec {
        }
    }
}
export declare namespace dataflow {
    namespace v1b3 {
        /**
         * Settings for WorkerPool autoscaling.
         */
        interface AutoscalingSettings {
            /**
             * The algorithm to use for autoscaling.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * The maximum number of workers to cap scaling at.
             */
            maxNumWorkers?: pulumi.Input<number>;
        }
        /**
         * Metadata for a BigQuery connector used by the job.
         */
        interface BigQueryIODetails {
            /**
             * Dataset accessed in the connection.
             */
            dataset?: pulumi.Input<string>;
            /**
             * Project accessed in the connection.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Query used to access data in the connection.
             */
            query?: pulumi.Input<string>;
            /**
             * Table accessed in the connection.
             */
            table?: pulumi.Input<string>;
        }
        /**
         * Metadata for a Cloud BigTable connector used by the job.
         */
        interface BigTableIODetails {
            /**
             * InstanceId accessed in the connection.
             */
            instanceId?: pulumi.Input<string>;
            /**
             * ProjectId accessed in the connection.
             */
            projectId?: pulumi.Input<string>;
            /**
             * TableId accessed in the connection.
             */
            tableId?: pulumi.Input<string>;
        }
        /**
         * Description of an interstitial value between transforms in an execution stage.
         */
        interface ComponentSource {
            /**
             * Dataflow service generated name for this source.
             */
            name?: pulumi.Input<string>;
            /**
             * User name for the original user transform or collection with which this source is most closely associated.
             */
            originalTransformOrCollection?: pulumi.Input<string>;
            /**
             * Human-readable name for this transform; may be user or system generated.
             */
            userName?: pulumi.Input<string>;
        }
        /**
         * Description of a transform executed as part of an execution stage.
         */
        interface ComponentTransform {
            /**
             * Dataflow service generated name for this source.
             */
            name?: pulumi.Input<string>;
            /**
             * User name for the original user transform with which this transform is most closely associated.
             */
            originalTransform?: pulumi.Input<string>;
            /**
             * Human-readable name for this transform; may be user or system generated.
             */
            userName?: pulumi.Input<string>;
        }
        /**
         * Metadata for a Datastore connector used by the job.
         */
        interface DatastoreIODetails {
            /**
             * Namespace used in the connection.
             */
            namespace?: pulumi.Input<string>;
            /**
             * ProjectId accessed in the connection.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Describes any options that have an effect on the debugging of pipelines.
         */
        interface DebugOptions {
            /**
             * When true, enables the logging of the literal hot key to the user's Cloud Logging.
             */
            enableHotKeyLogging?: pulumi.Input<boolean>;
        }
        /**
         * Describes the data disk used by a workflow job.
         */
        interface Disk {
            /**
             * Disk storage type, as defined by Google Compute Engine. This must be a disk type appropriate to the project and zone in which the workers will run. If unknown or unspecified, the service will attempt to choose a reasonable default. For example, the standard persistent disk type is a resource name typically ending in "pd-standard". If SSD persistent disks are available, the resource name typically ends with "pd-ssd". The actual valid values are defined the Google Compute Engine API, not by the Cloud Dataflow API; consult the Google Compute Engine documentation for more information about determining the set of available disk types for a particular project and zone. Google Compute Engine Disk types are local to a particular project in a particular zone, and so the resource name will typically look something like this: compute.googleapis.com/projects/project-id/zones/zone/diskTypes/pd-standard
             */
            diskType?: pulumi.Input<string>;
            /**
             * Directory in a VM where disk is mounted.
             */
            mountPoint?: pulumi.Input<string>;
            /**
             * Size of disk in GB. If zero or unspecified, the service will attempt to choose a reasonable default.
             */
            sizeGb?: pulumi.Input<number>;
        }
        /**
         * Data provided with a pipeline or transform to provide descriptive info.
         */
        interface DisplayData {
            /**
             * Contains value if the data is of a boolean type.
             */
            boolValue?: pulumi.Input<boolean>;
            /**
             * Contains value if the data is of duration type.
             */
            durationValue?: pulumi.Input<string>;
            /**
             * Contains value if the data is of float type.
             */
            floatValue?: pulumi.Input<number>;
            /**
             * Contains value if the data is of int64 type.
             */
            int64Value?: pulumi.Input<string>;
            /**
             * Contains value if the data is of java class type.
             */
            javaClassValue?: pulumi.Input<string>;
            /**
             * The key identifying the display data. This is intended to be used as a label for the display data when viewed in a dax monitoring system.
             */
            key?: pulumi.Input<string>;
            /**
             * An optional label to display in a dax UI for the element.
             */
            label?: pulumi.Input<string>;
            /**
             * The namespace for the key. This is usually a class name or programming language namespace (i.e. python module) which defines the display data. This allows a dax monitoring system to specially handle the data and perform custom rendering.
             */
            namespace?: pulumi.Input<string>;
            /**
             * A possible additional shorter value to display. For example a java_class_name_value of com.mypackage.MyDoFn will be stored with MyDoFn as the short_str_value and com.mypackage.MyDoFn as the java_class_name value. short_str_value can be displayed and java_class_name_value will be displayed as a tooltip.
             */
            shortStrValue?: pulumi.Input<string>;
            /**
             * Contains value if the data is of string type.
             */
            strValue?: pulumi.Input<string>;
            /**
             * Contains value if the data is of timestamp type.
             */
            timestampValue?: pulumi.Input<string>;
            /**
             * An optional full URL.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Describes the environment in which a Dataflow Job runs.
         */
        interface Environment {
            /**
             * The type of cluster manager API to use. If unknown or unspecified, the service will attempt to choose a reasonable default. This should be in the form of the API service name, e.g. "compute.googleapis.com".
             */
            clusterManagerApiService?: pulumi.Input<string>;
            /**
             * The dataset for the current project where various workflow related tables are stored. The supported resource type is: Google BigQuery: bigquery.googleapis.com/{dataset}
             */
            dataset?: pulumi.Input<string>;
            /**
             * Any debugging options to be supplied to the job.
             */
            debugOptions?: pulumi.Input<inputs.dataflow.v1b3.DebugOptions>;
            /**
             * The list of experiments to enable. This field should be used for SDK related experiments and not for service related experiments. The proper field for service related experiments is service_options. For more details see the rationale at go/user-specified-service-options.
             */
            experiments?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Which Flexible Resource Scheduling mode to run in.
             */
            flexResourceSchedulingGoal?: pulumi.Input<string>;
            /**
             * Experimental settings.
             */
            internalExperiments?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The Cloud Dataflow SDK pipeline options specified by the user. These options are passed through the service and are used to recreate the SDK pipeline options on the worker in a language agnostic and platform independent way.
             */
            sdkPipelineOptions?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Identity to run virtual machines as. Defaults to the default account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
            /**
             * If set, contains the Cloud KMS key identifier used to encrypt data at rest, AKA a Customer Managed Encryption Key (CMEK). Format: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY
             */
            serviceKmsKeyName?: pulumi.Input<string>;
            /**
             * The list of service options to enable. This field should be used for service related experiments only. These experiments, when graduating to GA, should be replaced by dedicated fields or become default (i.e. always on). For more details see the rationale at go/user-specified-service-options.
             */
            serviceOptions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The prefix of the resources the system should use for temporary storage. The system will append the suffix "/temp-{JOBNAME} to this resource prefix, where {JOBNAME} is the value of the job_name field. The resulting bucket and object prefix is used as the prefix of the resources used to store temporary data needed during the job execution. NOTE: This will override the value in taskrunner_settings. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}
             */
            tempStoragePrefix?: pulumi.Input<string>;
            /**
             * A description of the process that generated the request.
             */
            userAgent?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * A structure describing which components and their versions of the service are required in order to run the job.
             */
            version?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The worker pools. At least one "harness" worker pool must be specified in order for the job to have workers.
             */
            workerPools?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.WorkerPool>[]>;
            /**
             * The Compute Engine region (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1". Mutually exclusive with worker_zone. If neither worker_region nor worker_zone is specified, default to the control plane's region.
             */
            workerRegion?: pulumi.Input<string>;
            /**
             * The Compute Engine zone (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1-a". Mutually exclusive with worker_region. If neither worker_region nor worker_zone is specified, a zone in the control plane's region is chosen based on available capacity.
             */
            workerZone?: pulumi.Input<string>;
        }
        /**
         * A message describing the state of a particular execution stage.
         */
        interface ExecutionStageState {
            /**
             * The time at which the stage transitioned to this state.
             */
            currentStateTime?: pulumi.Input<string>;
            /**
             * The name of the execution stage.
             */
            executionStageName?: pulumi.Input<string>;
            /**
             * Executions stage states allow the same set of values as JobState.
             */
            executionStageState?: pulumi.Input<string>;
        }
        /**
         * Description of the composing transforms, names/ids, and input/outputs of a stage of execution. Some composing transforms and sources may have been generated by the Dataflow service during execution planning.
         */
        interface ExecutionStageSummary {
            /**
             * Collections produced and consumed by component transforms of this stage.
             */
            componentSource?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.ComponentSource>[]>;
            /**
             * Transforms that comprise this execution stage.
             */
            componentTransform?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.ComponentTransform>[]>;
            /**
             * Dataflow service generated id for this stage.
             */
            id?: pulumi.Input<string>;
            /**
             * Input sources for this stage.
             */
            inputSource?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.StageSource>[]>;
            /**
             * Type of transform this stage is executing.
             */
            kind?: pulumi.Input<string>;
            /**
             * Dataflow service generated name for this stage.
             */
            name?: pulumi.Input<string>;
            /**
             * Output sources for this stage.
             */
            outputSource?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.StageSource>[]>;
            /**
             * Other stages that must complete before this stage can run.
             */
            prerequisiteStage?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Metadata for a File connector used by the job.
         */
        interface FileIODetails {
            /**
             * File Pattern used to access files by the connector.
             */
            filePattern?: pulumi.Input<string>;
        }
        /**
         * Metadata available primarily for filtering jobs. Will be included in the ListJob response and Job SUMMARY view.
         */
        interface JobMetadata {
            /**
             * Identification of a Cloud BigTable source used in the Dataflow job.
             */
            bigTableDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.BigTableIODetails>[]>;
            /**
             * Identification of a BigQuery source used in the Dataflow job.
             */
            bigqueryDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.BigQueryIODetails>[]>;
            /**
             * Identification of a Datastore source used in the Dataflow job.
             */
            datastoreDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.DatastoreIODetails>[]>;
            /**
             * Identification of a File source used in the Dataflow job.
             */
            fileDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.FileIODetails>[]>;
            /**
             * Identification of a PubSub source used in the Dataflow job.
             */
            pubsubDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.PubSubIODetails>[]>;
            /**
             * The SDK version used to run the job.
             */
            sdkVersion?: pulumi.Input<inputs.dataflow.v1b3.SdkVersion>;
            /**
             * Identification of a Spanner source used in the Dataflow job.
             */
            spannerDetails?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.SpannerIODetails>[]>;
        }
        /**
         * The packages that must be installed in order for a worker to run the steps of the Cloud Dataflow job that will be assigned to its worker pool. This is the mechanism by which the Cloud Dataflow SDK causes code to be loaded onto the workers. For example, the Cloud Dataflow Java SDK might use this to install jars containing the user's code and all of the various dependencies (libraries, data files, etc.) required in order for that code to run.
         */
        interface Package {
            /**
             * The resource to read the package from. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket} bucket.storage.googleapis.com/
             */
            location?: pulumi.Input<string>;
            /**
             * The name of the package.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * A descriptive representation of submitted pipeline as well as the executed form. This data is provided by the Dataflow service for ease of visualizing the pipeline and interpreting Dataflow provided metrics.
         */
        interface PipelineDescription {
            /**
             * Pipeline level display data.
             */
            displayData?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.DisplayData>[]>;
            /**
             * Description of each stage of execution of the pipeline.
             */
            executionPipelineStage?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.ExecutionStageSummary>[]>;
            /**
             * Description of each transform in the pipeline and collections between them.
             */
            originalPipelineTransform?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.TransformSummary>[]>;
        }
        /**
         * Metadata for a Pub/Sub connector used by the job.
         */
        interface PubSubIODetails {
            /**
             * Subscription used in the connection.
             */
            subscription?: pulumi.Input<string>;
            /**
             * Topic accessed in the connection.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * The environment values to set at runtime.
         */
        interface RuntimeEnvironment {
            /**
             * Additional experiment flags for the job.
             */
            additionalExperiments?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Additional user labels to be specified for the job. Keys and values should follow the restrictions specified in the [labeling restrictions](https://cloud.google.com/compute/docs/labeling-resources#restrictions) page. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1kg", "count": "3" }.
             */
            additionalUserLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Whether to bypass the safety checks for the job's temporary directory. Use with caution.
             */
            bypassTempDirValidation?: pulumi.Input<boolean>;
            /**
             * Whether to enable Streaming Engine for the job.
             */
            enableStreamingEngine?: pulumi.Input<boolean>;
            /**
             * Configuration for VM IPs.
             */
            ipConfiguration?: pulumi.Input<string>;
            /**
             * Name for the Cloud KMS key for the job. Key format is: projects//locations//keyRings//cryptoKeys/
             */
            kmsKeyName?: pulumi.Input<string>;
            /**
             * The machine type to use for the job. Defaults to the value from the template if not specified.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The maximum number of Google Compute Engine instances to be made available to your pipeline during execution, from 1 to 1000.
             */
            maxWorkers?: pulumi.Input<number>;
            /**
             * Network to which VMs will be assigned. If empty or unspecified, the service will use the network "default".
             */
            network?: pulumi.Input<string>;
            /**
             * The initial number of Google Compute Engine instnaces for the job.
             */
            numWorkers?: pulumi.Input<number>;
            /**
             * The email address of the service account to run the job as.
             */
            serviceAccountEmail?: pulumi.Input<string>;
            /**
             * Subnetwork to which VMs will be assigned, if desired. You can specify a subnetwork using either a complete URL or an abbreviated path. Expected to be of the form "https://www.googleapis.com/compute/v1/projects/HOST_PROJECT_ID/regions/REGION/subnetworks/SUBNETWORK" or "regions/REGION/subnetworks/SUBNETWORK". If the subnetwork is located in a Shared VPC network, you must use the complete URL.
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * The Cloud Storage path to use for temporary files. Must be a valid Cloud Storage URL, beginning with `gs://`.
             */
            tempLocation?: pulumi.Input<string>;
            /**
             * The Compute Engine region (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1". Mutually exclusive with worker_zone. If neither worker_region nor worker_zone is specified, default to the control plane's region.
             */
            workerRegion?: pulumi.Input<string>;
            /**
             * The Compute Engine zone (https://cloud.google.com/compute/docs/regions-zones/regions-zones) in which worker processing should occur, e.g. "us-west1-a". Mutually exclusive with worker_region. If neither worker_region nor worker_zone is specified, a zone in the control plane's region is chosen based on available capacity. If both `worker_zone` and `zone` are set, `worker_zone` takes precedence.
             */
            workerZone?: pulumi.Input<string>;
            /**
             * The Compute Engine [availability zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones) for launching worker instances to run your pipeline. In the future, worker_zone will take precedence.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Defines a SDK harness container for executing Dataflow pipelines.
         */
        interface SdkHarnessContainerImage {
            /**
             * A docker container image that resides in Google Container Registry.
             */
            containerImage?: pulumi.Input<string>;
            /**
             * Environment ID for the Beam runner API proto Environment that corresponds to the current SDK Harness.
             */
            environmentId?: pulumi.Input<string>;
            /**
             * If true, recommends the Dataflow service to use only one core per SDK container instance with this image. If false (or unset) recommends using more than one core per SDK container instance with this image for efficiency. Note that Dataflow service may choose to override this property if needed.
             */
            useSingleCorePerContainer?: pulumi.Input<boolean>;
        }
        /**
         * The version of the SDK used to run the job.
         */
        interface SdkVersion {
            /**
             * The support status for this SDK version.
             */
            sdkSupportStatus?: pulumi.Input<string>;
            /**
             * The version of the SDK used to run the job.
             */
            version?: pulumi.Input<string>;
            /**
             * A readable string describing the version of the SDK.
             */
            versionDisplayName?: pulumi.Input<string>;
        }
        /**
         * Metadata for a Spanner connector used by the job.
         */
        interface SpannerIODetails {
            /**
             * DatabaseId accessed in the connection.
             */
            databaseId?: pulumi.Input<string>;
            /**
             * InstanceId accessed in the connection.
             */
            instanceId?: pulumi.Input<string>;
            /**
             * ProjectId accessed in the connection.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Description of an input or output of an execution stage.
         */
        interface StageSource {
            /**
             * Dataflow service generated name for this source.
             */
            name?: pulumi.Input<string>;
            /**
             * User name for the original user transform or collection with which this source is most closely associated.
             */
            originalTransformOrCollection?: pulumi.Input<string>;
            /**
             * Size of the source, if measurable.
             */
            sizeBytes?: pulumi.Input<string>;
            /**
             * Human-readable name for this source; may be user or system generated.
             */
            userName?: pulumi.Input<string>;
        }
        /**
         * Defines a particular step within a Cloud Dataflow job. A job consists of multiple steps, each of which performs some specific operation as part of the overall job. Data is typically passed from one step to another as part of the job. Here's an example of a sequence of steps which together implement a Map-Reduce job: * Read a collection of data from some source, parsing the collection's elements. * Validate the elements. * Apply a user-defined function to map each element to some value and extract an element-specific key value. * Group elements with the same key into a single element with that key, transforming a multiply-keyed collection into a uniquely-keyed collection. * Write the elements out to some data sink. Note that the Cloud Dataflow service may be used to run many different types of jobs, not just Map-Reduce.
         */
        interface Step {
            /**
             * The kind of step in the Cloud Dataflow job.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name that identifies the step. This must be unique for each step with respect to all other steps in the Cloud Dataflow job.
             */
            name?: pulumi.Input<string>;
            /**
             * Named properties associated with the step. Each kind of predefined step has its own required set of properties. Must be provided on Create. Only retrieved with JOB_VIEW_ALL.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Taskrunner configuration settings.
         */
        interface TaskRunnerSettings {
            /**
             * Whether to also send taskrunner log info to stderr.
             */
            alsologtostderr?: pulumi.Input<boolean>;
            /**
             * The location on the worker for task-specific subdirectories.
             */
            baseTaskDir?: pulumi.Input<string>;
            /**
             * The base URL for the taskrunner to use when accessing Google Cloud APIs. When workers access Google Cloud APIs, they logically do so via relative URLs. If this field is specified, it supplies the base URL to use for resolving these relative URLs. The normative algorithm used is defined by RFC 1808, "Relative Uniform Resource Locators". If not specified, the default value is "http://www.googleapis.com/"
             */
            baseUrl?: pulumi.Input<string>;
            /**
             * The file to store preprocessing commands in.
             */
            commandlinesFileName?: pulumi.Input<string>;
            /**
             * Whether to continue taskrunner if an exception is hit.
             */
            continueOnException?: pulumi.Input<boolean>;
            /**
             * The API version of endpoint, e.g. "v1b3"
             */
            dataflowApiVersion?: pulumi.Input<string>;
            /**
             * The command to launch the worker harness.
             */
            harnessCommand?: pulumi.Input<string>;
            /**
             * The suggested backend language.
             */
            languageHint?: pulumi.Input<string>;
            /**
             * The directory on the VM to store logs.
             */
            logDir?: pulumi.Input<string>;
            /**
             * Whether to send taskrunner log info to Google Compute Engine VM serial console.
             */
            logToSerialconsole?: pulumi.Input<boolean>;
            /**
             * Indicates where to put logs. If this is not specified, the logs will not be uploaded. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}
             */
            logUploadLocation?: pulumi.Input<string>;
            /**
             * The OAuth2 scopes to be requested by the taskrunner in order to access the Cloud Dataflow API.
             */
            oauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The settings to pass to the parallel worker harness.
             */
            parallelWorkerSettings?: pulumi.Input<inputs.dataflow.v1b3.WorkerSettings>;
            /**
             * The streaming worker main class name.
             */
            streamingWorkerMainClass?: pulumi.Input<string>;
            /**
             * The UNIX group ID on the worker VM to use for tasks launched by taskrunner; e.g. "wheel".
             */
            taskGroup?: pulumi.Input<string>;
            /**
             * The UNIX user ID on the worker VM to use for tasks launched by taskrunner; e.g. "root".
             */
            taskUser?: pulumi.Input<string>;
            /**
             * The prefix of the resources the taskrunner should use for temporary storage. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}
             */
            tempStoragePrefix?: pulumi.Input<string>;
            /**
             * The ID string of the VM.
             */
            vmId?: pulumi.Input<string>;
            /**
             * The file to store the workflow in.
             */
            workflowFileName?: pulumi.Input<string>;
        }
        /**
         * Description of the type, names/ids, and input/outputs for a transform.
         */
        interface TransformSummary {
            /**
             * Transform-specific display data.
             */
            displayData?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.DisplayData>[]>;
            /**
             * SDK generated id of this transform instance.
             */
            id?: pulumi.Input<string>;
            /**
             * User names for all collection inputs to this transform.
             */
            inputCollectionName?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Type of transform.
             */
            kind?: pulumi.Input<string>;
            /**
             * User provided name for this transform instance.
             */
            name?: pulumi.Input<string>;
            /**
             * User names for all collection outputs to this transform.
             */
            outputCollectionName?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Describes one particular pool of Cloud Dataflow workers to be instantiated by the Cloud Dataflow service in order to perform the computations required by a job. Note that a workflow job may use multiple pools, in order to match the various computational requirements of the various stages of the job.
         */
        interface WorkerPool {
            /**
             * Settings for autoscaling of this WorkerPool.
             */
            autoscalingSettings?: pulumi.Input<inputs.dataflow.v1b3.AutoscalingSettings>;
            /**
             * Data disks that are used by a VM in this workflow.
             */
            dataDisks?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.Disk>[]>;
            /**
             * The default package set to install. This allows the service to select a default set of packages which are useful to worker harnesses written in a particular language.
             */
            defaultPackageSet?: pulumi.Input<string>;
            /**
             * Size of root disk for VMs, in GB. If zero or unspecified, the service will attempt to choose a reasonable default.
             */
            diskSizeGb?: pulumi.Input<number>;
            /**
             * Fully qualified source image for disks.
             */
            diskSourceImage?: pulumi.Input<string>;
            /**
             * Type of root disk for VMs. If empty or unspecified, the service will attempt to choose a reasonable default.
             */
            diskType?: pulumi.Input<string>;
            /**
             * Configuration for VM IPs.
             */
            ipConfiguration?: pulumi.Input<string>;
            /**
             * The kind of the worker pool; currently only `harness` and `shuffle` are supported.
             */
            kind?: pulumi.Input<string>;
            /**
             * Machine type (e.g. "n1-standard-1"). If empty or unspecified, the service will attempt to choose a reasonable default.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Metadata to set on the Google Compute Engine VMs.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Network to which VMs will be assigned. If empty or unspecified, the service will use the network "default".
             */
            network?: pulumi.Input<string>;
            /**
             * The number of threads per worker harness. If empty or unspecified, the service will choose a number of threads (according to the number of cores on the selected machine type for batch, or 1 by convention for streaming).
             */
            numThreadsPerWorker?: pulumi.Input<number>;
            /**
             * Number of Google Compute Engine workers in this pool needed to execute the job. If zero or unspecified, the service will attempt to choose a reasonable default.
             */
            numWorkers?: pulumi.Input<number>;
            /**
             * The action to take on host maintenance, as defined by the Google Compute Engine API.
             */
            onHostMaintenance?: pulumi.Input<string>;
            /**
             * Packages to be installed on workers.
             */
            packages?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.Package>[]>;
            /**
             * Extra arguments for this worker pool.
             */
            poolArgs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Set of SDK harness containers needed to execute this pipeline. This will only be set in the Fn API path. For non-cross-language pipelines this should have only one entry. Cross-language pipelines will have two or more entries.
             */
            sdkHarnessContainerImages?: pulumi.Input<pulumi.Input<inputs.dataflow.v1b3.SdkHarnessContainerImage>[]>;
            /**
             * Subnetwork to which VMs will be assigned, if desired. Expected to be of the form "regions/REGION/subnetworks/SUBNETWORK".
             */
            subnetwork?: pulumi.Input<string>;
            /**
             * Settings passed through to Google Compute Engine workers when using the standard Dataflow task runner. Users should ignore this field.
             */
            taskrunnerSettings?: pulumi.Input<inputs.dataflow.v1b3.TaskRunnerSettings>;
            /**
             * Sets the policy for determining when to turndown worker pool. Allowed values are: `TEARDOWN_ALWAYS`, `TEARDOWN_ON_SUCCESS`, and `TEARDOWN_NEVER`. `TEARDOWN_ALWAYS` means workers are always torn down regardless of whether the job succeeds. `TEARDOWN_ON_SUCCESS` means workers are torn down if the job succeeds. `TEARDOWN_NEVER` means the workers are never torn down. If the workers are not torn down by the service, they will continue to run and use Google Compute Engine VM resources in the user's project until they are explicitly terminated by the user. Because of this, Google recommends using the `TEARDOWN_ALWAYS` policy except for small, manually supervised test jobs. If unknown or unspecified, the service will attempt to choose a reasonable default.
             */
            teardownPolicy?: pulumi.Input<string>;
            /**
             * Required. Docker container image that executes the Cloud Dataflow worker harness, residing in Google Container Registry. Deprecated for the Fn API path. Use sdk_harness_container_images instead.
             */
            workerHarnessContainerImage?: pulumi.Input<string>;
            /**
             * Zone to run the worker pools in. If empty or unspecified, the service will attempt to choose a reasonable default.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Provides data to pass through to the worker harness.
         */
        interface WorkerSettings {
            /**
             * The base URL for accessing Google Cloud APIs. When workers access Google Cloud APIs, they logically do so via relative URLs. If this field is specified, it supplies the base URL to use for resolving these relative URLs. The normative algorithm used is defined by RFC 1808, "Relative Uniform Resource Locators". If not specified, the default value is "http://www.googleapis.com/"
             */
            baseUrl?: pulumi.Input<string>;
            /**
             * Whether to send work progress updates to the service.
             */
            reportingEnabled?: pulumi.Input<boolean>;
            /**
             * The Cloud Dataflow service path relative to the root URL, for example, "dataflow/v1b3/projects".
             */
            servicePath?: pulumi.Input<string>;
            /**
             * The Shuffle service path relative to the root URL, for example, "shuffle/v1beta1".
             */
            shuffleServicePath?: pulumi.Input<string>;
            /**
             * The prefix of the resources the system should use for temporary storage. The supported resource type is: Google Cloud Storage: storage.googleapis.com/{bucket}/{object} bucket.storage.googleapis.com/{object}
             */
            tempStoragePrefix?: pulumi.Input<string>;
            /**
             * The ID of the worker running this pipeline.
             */
            workerId?: pulumi.Input<string>;
        }
    }
}
export declare namespace datafusion {
    namespace v1 {
        /**
         * Identifies Data Fusion accelerators for an instance.
         */
        interface Accelerator {
            /**
             * The type of an accelator for a CDF instance.
             */
            acceleratorType?: pulumi.Input<string>;
            /**
             * The state of the accelerator
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.datafusion.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.datafusion.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Network configuration for a Data Fusion instance. These configurations are used for peering with the customer network. Configurations are optional when a public Data Fusion instance is to be created. However, providing these configurations allows several benefits, such as reduced network latency while accessing the customer resources from managed Data Fusion instance nodes, as well as access to the customer on-prem resources.
         */
        interface NetworkConfig {
            /**
             * The IP range in CIDR notation to use for the managed Data Fusion instance nodes. This range must not overlap with any other ranges used in the customer network.
             */
            ipAllocation?: pulumi.Input<string>;
            /**
             * Name of the network in the customer project with which the Tenant Project will be peered for executing pipelines. In case of shared VPC where the network resides in another host project the network should specified in the form of projects/{host-project-id}/global/networks/{network}
             */
            network?: pulumi.Input<string>;
        }
        /**
         * The Data Fusion version. This proto message stores information about certain Data Fusion version, which is used for Data Fusion version upgrade.
         */
        interface Version {
            /**
             * Represents a list of available feature names for a given version.
             */
            availableFeatures?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether this is currently the default version for Cloud Data Fusion
             */
            defaultVersion?: pulumi.Input<boolean>;
            /**
             * The version number of the Data Fusion instance, such as '6.0.1.0'.
             */
            versionNumber?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Identifies Data Fusion accelerators for an instance.
         */
        interface Accelerator {
            /**
             * The type of an accelator for a CDF instance.
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.datafusion.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.datafusion.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Network configuration for a Data Fusion instance. These configurations are used for peering with the customer network. Configurations are optional when a public Data Fusion instance is to be created. However, providing these configurations allows several benefits, such as reduced network latency while accessing the customer resources from managed Data Fusion instance nodes, as well as access to the customer on-prem resources.
         */
        interface NetworkConfig {
            /**
             * The IP range in CIDR notation to use for the managed Data Fusion instance nodes. This range must not overlap with any other ranges used in the Data Fusion instance network.
             */
            ipAllocation?: pulumi.Input<string>;
            /**
             * Name of the network in the customer project with which the Tenant Project will be peered for executing pipelines. In case of shared VPC where the network resides in another host project the network should specified in the form of projects/{host-project-id}/global/networks/{network}
             */
            network?: pulumi.Input<string>;
        }
        /**
         * The Data Fusion version.
         */
        interface Version {
            /**
             * Represents a list of available feature names for a given version.
             */
            availableFeatures?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether this is currently the default version for Cloud Data Fusion
             */
            defaultVersion?: pulumi.Input<boolean>;
            /**
             * The version number of the Data Fusion instance, such as '6.0.1.0'.
             */
            versionNumber?: pulumi.Input<string>;
        }
    }
}
export declare namespace datalabeling {
    namespace v1beta1 {
        /**
         * Container of information related to one possible annotation that can be used in a labeling task. For example, an image classification task where images are labeled as `dog` or `cat` must reference an AnnotationSpec for `dog` and an AnnotationSpec for `cat`.
         */
        interface GoogleCloudDatalabelingV1beta1AnnotationSpec {
            /**
             * Optional. User-provided description of the annotation specification. The description can be up to 10,000 characters long.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. The display name of the AnnotationSpec. Maximum of 64 characters.
             */
            displayName?: pulumi.Input<string>;
            /**
             * This is the integer index of the AnnotationSpec. The index for the whole AnnotationSpecSet is sequential starting from 0. For example, an AnnotationSpecSet with classes `dog` and `cat`, might contain one AnnotationSpec with `{ display_name: "dog", index: 0 }` and one AnnotationSpec with `{ display_name: "cat", index: 1 }`. This is especially useful for model training as it encodes the string labels into numeric values.
             */
            index?: pulumi.Input<number>;
        }
        /**
         * Records a failed evaluation job run.
         */
        interface GoogleCloudDatalabelingV1beta1Attempt {
            attemptTime?: pulumi.Input<string>;
            /**
             * Details of errors that occurred.
             */
            partialFailures?: pulumi.Input<pulumi.Input<inputs.datalabeling.v1beta1.GoogleRpcStatus>[]>;
        }
        /**
         * The BigQuery location for input data. If used in an EvaluationJob, this is where the service saves the prediction input and output sampled from the model version.
         */
        interface GoogleCloudDatalabelingV1beta1BigQuerySource {
            /**
             * Required. BigQuery URI to a table, up to 2,000 characters long. If you specify the URI of a table that does not exist, Data Labeling Service creates a table at the URI with the correct schema when you create your EvaluationJob. If you specify the URI of a table that already exists, it must have the [correct schema](/ml-engine/docs/continuous-evaluation/create-job#table-schema). Provide the table URI in the following format: "bq://{your_project_id}/ {your_dataset_name}/{your_table_name}" [Learn more](/ml-engine/docs/continuous-evaluation/create-job#table-schema).
             */
            inputUri?: pulumi.Input<string>;
        }
        /**
         * Options regarding evaluation between bounding boxes.
         */
        interface GoogleCloudDatalabelingV1beta1BoundingBoxEvaluationOptions {
            /**
             * Minimum [intersection-over-union (IOU)](/vision/automl/object-detection/docs/evaluate#intersection-over-union) required for 2 bounding boxes to be considered a match. This must be a number between 0 and 1.
             */
            iouThreshold?: pulumi.Input<number>;
        }
        /**
         * Config for image bounding poly (and bounding box) human labeling task.
         */
        interface GoogleCloudDatalabelingV1beta1BoundingPolyConfig {
            /**
             * Required. Annotation spec set resource name.
             */
            annotationSpecSet?: pulumi.Input<string>;
            /**
             * Optional. Instruction message showed on contributors UI.
             */
            instructionMessage?: pulumi.Input<string>;
        }
        /**
         * Metadata for classification annotations.
         */
        interface GoogleCloudDatalabelingV1beta1ClassificationMetadata {
            /**
             * Whether the classification task is multi-label or not.
             */
            isMultiLabel?: pulumi.Input<boolean>;
        }
        /**
         * Deprecated: this instruction format is not supported any more. Instruction from a CSV file.
         */
        interface GoogleCloudDatalabelingV1beta1CsvInstruction {
            /**
             * CSV file for the instruction. Only gcs path is allowed.
             */
            gcsFileUri?: pulumi.Input<string>;
        }
        /**
         * Configuration details used for calculating evaluation metrics and creating an Evaluation.
         */
        interface GoogleCloudDatalabelingV1beta1EvaluationConfig {
            /**
             * Only specify this field if the related model performs image object detection (`IMAGE_BOUNDING_BOX_ANNOTATION`). Describes how to evaluate bounding boxes.
             */
            boundingBoxEvaluationOptions?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1BoundingBoxEvaluationOptions>;
        }
        /**
         * Provides details for how an evaluation job sends email alerts based on the results of a run.
         */
        interface GoogleCloudDatalabelingV1beta1EvaluationJobAlertConfig {
            /**
             * Required. An email address to send alerts to.
             */
            email?: pulumi.Input<string>;
            /**
             * Required. A number between 0 and 1 that describes a minimum mean average precision threshold. When the evaluation job runs, if it calculates that your model version's predictions from the recent interval have meanAveragePrecision below this threshold, then it sends an alert to your specified email.
             */
            minAcceptableMeanAveragePrecision?: pulumi.Input<number>;
        }
        /**
         * Configures specific details of how a continuous evaluation job works. Provide this configuration when you create an EvaluationJob.
         */
        interface GoogleCloudDatalabelingV1beta1EvaluationJobConfig {
            /**
             * Required. Prediction keys that tell Data Labeling Service where to find the data for evaluation in your BigQuery table. When the service samples prediction input and output from your model version and saves it to BigQuery, the data gets stored as JSON strings in the BigQuery table. These keys tell Data Labeling Service how to parse the JSON. You can provide the following entries in this field: * `data_json_key`: the data key for prediction input. You must provide either this key or `reference_json_key`. * `reference_json_key`: the data reference key for prediction input. You must provide either this key or `data_json_key`. * `label_json_key`: the label key for prediction output. Required. * `label_score_json_key`: the score key for prediction output. Required. * `bounding_box_json_key`: the bounding box key for prediction output. Required if your model version perform image object detection. Learn [how to configure prediction keys](/ml-engine/docs/continuous-evaluation/create-job#prediction-keys).
             */
            bigqueryImportKeys?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Specify this field if your model version performs image object detection (bounding box detection). `annotationSpecSet` in this configuration must match EvaluationJob.annotationSpecSet.
             */
            boundingPolyConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1BoundingPolyConfig>;
            /**
             * Required. Details for calculating evaluation metrics and creating Evaulations. If your model version performs image object detection, you must specify the `boundingBoxEvaluationOptions` field within this configuration. Otherwise, provide an empty object for this configuration.
             */
            evaluationConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1EvaluationConfig>;
            /**
             * Optional. Configuration details for evaluation job alerts. Specify this field if you want to receive email alerts if the evaluation job finds that your predictions have low mean average precision during a run.
             */
            evaluationJobAlertConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1EvaluationJobAlertConfig>;
            /**
             * Required. The maximum number of predictions to sample and save to BigQuery during each evaluation interval. This limit overrides `example_sample_percentage`: even if the service has not sampled enough predictions to fulfill `example_sample_perecentage` during an interval, it stops sampling predictions when it meets this limit.
             */
            exampleCount?: pulumi.Input<number>;
            /**
             * Required. Fraction of predictions to sample and save to BigQuery during each evaluation interval. For example, 0.1 means 10% of predictions served by your model version get saved to BigQuery.
             */
            exampleSamplePercentage?: pulumi.Input<number>;
            /**
             * Optional. Details for human annotation of your data. If you set labelMissingGroundTruth to `true` for this evaluation job, then you must specify this field. If you plan to provide your own ground truth labels, then omit this field. Note that you must create an Instruction resource before you can specify this field. Provide the name of the instruction resource in the `instruction` field within this configuration.
             */
            humanAnnotationConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1HumanAnnotationConfig>;
            /**
             * Specify this field if your model version performs image classification or general classification. `annotationSpecSet` in this configuration must match EvaluationJob.annotationSpecSet. `allowMultiLabel` in this configuration must match `classificationMetadata.isMultiLabel` in input_config.
             */
            imageClassificationConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1ImageClassificationConfig>;
            /**
             * Rquired. Details for the sampled prediction input. Within this configuration, there are requirements for several fields: * `dataType` must be one of `IMAGE`, `TEXT`, or `GENERAL_DATA`. * `annotationType` must be one of `IMAGE_CLASSIFICATION_ANNOTATION`, `TEXT_CLASSIFICATION_ANNOTATION`, `GENERAL_CLASSIFICATION_ANNOTATION`, or `IMAGE_BOUNDING_BOX_ANNOTATION` (image object detection). * If your machine learning model performs classification, you must specify `classificationMetadata.isMultiLabel`. * You must specify `bigquerySource` (not `gcsSource`).
             */
            inputConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1InputConfig>;
            /**
             * Specify this field if your model version performs text classification. `annotationSpecSet` in this configuration must match EvaluationJob.annotationSpecSet. `allowMultiLabel` in this configuration must match `classificationMetadata.isMultiLabel` in input_config.
             */
            textClassificationConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1TextClassificationConfig>;
        }
        /**
         * Source of the Cloud Storage file to be imported.
         */
        interface GoogleCloudDatalabelingV1beta1GcsSource {
            /**
             * Required. The input URI of source file. This must be a Cloud Storage path (`gs://...`).
             */
            inputUri?: pulumi.Input<string>;
            /**
             * Required. The format of the source file. Only "text/csv" is supported.
             */
            mimeType?: pulumi.Input<string>;
        }
        /**
         * Configuration for how human labeling task should be done.
         */
        interface GoogleCloudDatalabelingV1beta1HumanAnnotationConfig {
            /**
             * Optional. A human-readable description for AnnotatedDataset. The description can be up to 10000 characters long.
             */
            annotatedDatasetDescription?: pulumi.Input<string>;
            /**
             * Required. A human-readable name for AnnotatedDataset defined by users. Maximum of 64 characters .
             */
            annotatedDatasetDisplayName?: pulumi.Input<string>;
            /**
             * Optional. If you want your own labeling contributors to manage and work on this labeling request, you can set these contributors here. We will give them access to the question types in crowdcompute. Note that these emails must be registered in crowdcompute worker UI: https://crowd-compute.appspot.com/
             */
            contributorEmails?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. Instruction resource name.
             */
            instruction?: pulumi.Input<string>;
            /**
             * Optional. A human-readable label used to logically group labeling tasks. This string must match the regular expression `[a-zA-Z\\d_-]{0,128}`.
             */
            labelGroup?: pulumi.Input<string>;
            /**
             * Optional. The Language of this question, as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt). Default value is en-US. Only need to set this when task is language related. For example, French text classification.
             */
            languageCode?: pulumi.Input<string>;
            /**
             * Optional. Maximum duration for contributors to answer a question. Maximum is 3600 seconds. Default is 3600 seconds.
             */
            questionDuration?: pulumi.Input<string>;
            /**
             * Optional. Replication of questions. Each question will be sent to up to this number of contributors to label. Aggregated answers will be returned. Default is set to 1. For image related labeling, valid values are 1, 3, 5.
             */
            replicaCount?: pulumi.Input<number>;
            /**
             * Email of the user who started the labeling task and should be notified by email. If empty no notification will be sent.
             */
            userEmailAddress?: pulumi.Input<string>;
        }
        /**
         * Config for image classification human labeling task.
         */
        interface GoogleCloudDatalabelingV1beta1ImageClassificationConfig {
            /**
             * Optional. If allow_multi_label is true, contributors are able to choose multiple labels for one image.
             */
            allowMultiLabel?: pulumi.Input<boolean>;
            /**
             * Required. Annotation spec set resource name.
             */
            annotationSpecSet?: pulumi.Input<string>;
            /**
             * Optional. The type of how to aggregate answers.
             */
            answerAggregationType?: pulumi.Input<string>;
        }
        /**
         * The configuration of input data, including data type, location, etc.
         */
        interface GoogleCloudDatalabelingV1beta1InputConfig {
            /**
             * Optional. The type of annotation to be performed on this data. You must specify this field if you are using this InputConfig in an EvaluationJob.
             */
            annotationType?: pulumi.Input<string>;
            /**
             * Source located in BigQuery. You must specify this field if you are using this InputConfig in an EvaluationJob.
             */
            bigquerySource?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1BigQuerySource>;
            /**
             * Optional. Metadata about annotations for the input. You must specify this field if you are using this InputConfig in an EvaluationJob for a model version that performs classification.
             */
            classificationMetadata?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1ClassificationMetadata>;
            /**
             * Required. Data type must be specifed when user tries to import data.
             */
            dataType?: pulumi.Input<string>;
            /**
             * Source located in Cloud Storage.
             */
            gcsSource?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1GcsSource>;
            /**
             * Required for text import, as language code must be specified.
             */
            textMetadata?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1TextMetadata>;
        }
        /**
         * Metadata describing the feedback from the operator.
         */
        interface GoogleCloudDatalabelingV1beta1OperatorFeedbackMetadata {
        }
        /**
         * Instruction from a PDF file.
         */
        interface GoogleCloudDatalabelingV1beta1PdfInstruction {
            /**
             * PDF file for the instruction. Only gcs path is allowed.
             */
            gcsFileUri?: pulumi.Input<string>;
        }
        /**
         * Metadata describing the feedback from the labeling task requester.
         */
        interface GoogleCloudDatalabelingV1beta1RequesterFeedbackMetadata {
        }
        /**
         * Config for setting up sentiments.
         */
        interface GoogleCloudDatalabelingV1beta1SentimentConfig {
            /**
             * If set to true, contributors will have the option to select sentiment of the label they selected, to mark it as negative or positive label. Default is false.
             */
            enableLabelSentimentSelection?: pulumi.Input<boolean>;
        }
        /**
         * Config for text classification human labeling task.
         */
        interface GoogleCloudDatalabelingV1beta1TextClassificationConfig {
            /**
             * Optional. If allow_multi_label is true, contributors are able to choose multiple labels for one text segment.
             */
            allowMultiLabel?: pulumi.Input<boolean>;
            /**
             * Required. Annotation spec set resource name.
             */
            annotationSpecSet?: pulumi.Input<string>;
            /**
             * Optional. Configs for sentiment selection. We deprecate sentiment analysis in data labeling side as it is incompatible with uCAIP.
             */
            sentimentConfig?: pulumi.Input<inputs.datalabeling.v1beta1.GoogleCloudDatalabelingV1beta1SentimentConfig>;
        }
        /**
         * Metadata for the text.
         */
        interface GoogleCloudDatalabelingV1beta1TextMetadata {
            /**
             * The language of this text, as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt). Default value is en-US.
             */
            languageCode?: pulumi.Input<string>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface GoogleRpcStatus {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
}
export declare namespace datamigration {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.datamigration.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.datamigration.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance.
         */
        interface CloudSqlConnectionProfile {
            /**
             * Immutable. Metadata used to create the destination Cloud SQL database.
             */
            settings?: pulumi.Input<inputs.datamigration.v1.CloudSqlSettings>;
        }
        /**
         * Settings for creating a Cloud SQL database instance.
         */
        interface CloudSqlSettings {
            /**
             * The activation policy specifies when the instance is activated; it is applicable only when the instance state is 'RUNNABLE'. Valid values: 'ALWAYS': The instance is on, and remains so even in the absence of connection requests. `NEVER`: The instance is off; it is not activated, even if a connection request arrives.
             */
            activationPolicy?: pulumi.Input<string>;
            /**
             * [default: ON] If you enable this setting, Cloud SQL checks your available storage every 30 seconds. If the available storage falls below a threshold size, Cloud SQL automatically adds additional storage capacity. If the available storage repeatedly falls below the threshold size, Cloud SQL continues to add storage until it reaches the maximum of 30 TB.
             */
            autoStorageIncrease?: pulumi.Input<boolean>;
            /**
             * The Cloud SQL default instance level collation.
             */
            collation?: pulumi.Input<string>;
            /**
             * The storage capacity available to the database, in GB. The minimum (and default) size is 10GB.
             */
            dataDiskSizeGb?: pulumi.Input<string>;
            /**
             * The type of storage: `PD_SSD` (default) or `PD_HDD`.
             */
            dataDiskType?: pulumi.Input<string>;
            /**
             * The database flags passed to the Cloud SQL instance at startup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
             */
            databaseFlags?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The database engine type and version.
             */
            databaseVersion?: pulumi.Input<string>;
            /**
             * The settings for IP Management. This allows to enable or disable the instance IP and manage which external networks can connect to the instance. The IPv4 address cannot be disabled.
             */
            ipConfig?: pulumi.Input<inputs.datamigration.v1.SqlIpConfig>;
            /**
             * Input only. Initial root password.
             */
            rootPassword?: pulumi.Input<string>;
            /**
             * The Database Migration Service source connection profile ID, in the format: `projects/my_project_name/locations/us-central1/connectionProfiles/connection_profile_ID`
             */
            sourceId?: pulumi.Input<string>;
            /**
             * The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit.
             */
            storageAutoResizeLimit?: pulumi.Input<string>;
            /**
             * The tier (or machine type) for this instance, for example: `db-n1-standard-1` (MySQL instances) or `db-custom-1-3840` (PostgreSQL instances). For more information, see [Cloud SQL Instance Settings](https://cloud.google.com/sql/docs/mysql/instance-settings).
             */
            tier?: pulumi.Input<string>;
            /**
             * The resource labels for a Cloud SQL instance to use to annotate any related underlying resources such as Compute Engine VMs. An object containing a list of "key": "value" pairs. Example: `{ "name": "wrench", "mass": "18kg", "count": "3" }`.
             */
            userLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The Google Cloud Platform zone where your Cloud SQL datdabse instance is located.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A message defining the database engine and provider.
         */
        interface DatabaseType {
            /**
             * The database engine.
             */
            engine?: pulumi.Input<string>;
            /**
             * The database provider.
             */
            provider?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Specifies connection parameters required specifically for MySQL databases.
         */
        interface MySqlConnectionProfile {
            /**
             * If the source is a Cloud SQL database, use this field to provide the Cloud SQL instance ID of the source.
             */
            cloudSqlId?: pulumi.Input<string>;
            /**
             * Required. The IP or hostname of the source MySQL database.
             */
            host?: pulumi.Input<string>;
            /**
             * Required. Input only. The password for the user that Database Migration Service will be using to connect to the database. This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The network port of the source MySQL database.
             */
            port?: pulumi.Input<number>;
            /**
             * SSL configuration for the destination to connect to the source database.
             */
            ssl?: pulumi.Input<inputs.datamigration.v1.SslConfig>;
            /**
             * Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Specifies connection parameters required specifically for PostgreSQL databases.
         */
        interface PostgreSqlConnectionProfile {
            /**
             * If the source is a Cloud SQL database, use this field to provide the Cloud SQL instance ID of the source.
             */
            cloudSqlId?: pulumi.Input<string>;
            /**
             * Required. The IP or hostname of the source PostgreSQL database.
             */
            host?: pulumi.Input<string>;
            /**
             * Required. Input only. The password for the user that Database Migration Service will be using to connect to the database. This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The network port of the source PostgreSQL database.
             */
            port?: pulumi.Input<number>;
            /**
             * SSL configuration for the destination to connect to the source database.
             */
            ssl?: pulumi.Input<inputs.datamigration.v1.SslConfig>;
            /**
             * Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * The details needed to configure a reverse SSH tunnel between the source and destination databases. These details will be used when calling the generateSshScript method (see https://cloud.google.com/database-migration/docs/reference/rest/v1/projects.locations.migrationJobs/generateSshScript) to produce the script that will help set up the reverse SSH tunnel, and to set up the VPC peering between the Cloud SQL private network and the VPC.
         */
        interface ReverseSshConnectivity {
            /**
             * The name of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vm?: pulumi.Input<string>;
            /**
             * Required. The IP of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vmIp?: pulumi.Input<string>;
            /**
             * Required. The forwarding port of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vmPort?: pulumi.Input<number>;
            /**
             * The name of the VPC to peer with the Cloud SQL private network.
             */
            vpc?: pulumi.Input<string>;
        }
        /**
         * An entry for an Access Control list.
         */
        interface SqlAclEntry {
            /**
             * The time when this access control entry expires in [RFC 3339](https://tools.ietf.org/html/rfc3339) format, for example: `2012-11-15T16:19:00.094Z`.
             */
            expireTime?: pulumi.Input<string>;
            /**
             * A label to identify this entry.
             */
            label?: pulumi.Input<string>;
            /**
             * Input only. The time-to-leave of this access control entry.
             */
            ttl?: pulumi.Input<string>;
            /**
             * The allowlisted value for the access control list.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * IP Management configuration.
         */
        interface SqlIpConfig {
            /**
             * The list of external networks that are allowed to connect to the instance using the IP. See https://en.wikipedia.org/wiki/CIDR_notation#CIDR_notation, also known as 'slash' notation (e.g. `192.168.100.0/24`).
             */
            authorizedNetworks?: pulumi.Input<pulumi.Input<inputs.datamigration.v1.SqlAclEntry>[]>;
            /**
             * Whether the instance should be assigned an IPv4 address or not.
             */
            enableIpv4?: pulumi.Input<boolean>;
            /**
             * The resource link for the VPC network from which the Cloud SQL instance is accessible for private IP. For example, `/projects/myProject/global/networks/default`. This setting can be updated, but it cannot be removed after it is set.
             */
            privateNetwork?: pulumi.Input<string>;
            /**
             * Whether SSL connections over IP should be enforced or not.
             */
            requireSsl?: pulumi.Input<boolean>;
        }
        /**
         * SSL configuration information.
         */
        interface SslConfig {
            /**
             * Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate. The replica will use this certificate to verify it's connecting to the right host.
             */
            caCertificate?: pulumi.Input<string>;
            /**
             * Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.If this field is used then the 'client_key' field is mandatory.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate. If this field is used then the 'client_certificate' field is mandatory.
             */
            clientKey?: pulumi.Input<string>;
        }
        /**
         * The source database will allow incoming connections from the destination database's public IP. You can retrieve the Cloud SQL instance's public IP from the Cloud SQL console or using Cloud SQL APIs. No additional configuration is required.
         */
        interface StaticIpConnectivity {
        }
        /**
         * The details of the VPC where the source database is located in Google Cloud. We will use this information to set up the VPC peering connection between Cloud SQL and this VPC.
         */
        interface VpcPeeringConnectivity {
            /**
             * The name of the VPC network to peer with the Cloud SQL private network.
             */
            vpc?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.datamigration.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.datamigration.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance.
         */
        interface CloudSqlConnectionProfile {
            /**
             * Immutable. Metadata used to create the destination Cloud SQL database.
             */
            settings?: pulumi.Input<inputs.datamigration.v1beta1.CloudSqlSettings>;
        }
        /**
         * Settings for creating a Cloud SQL database instance.
         */
        interface CloudSqlSettings {
            /**
             * The activation policy specifies when the instance is activated; it is applicable only when the instance state is 'RUNNABLE'. Valid values: 'ALWAYS': The instance is on, and remains so even in the absence of connection requests. `NEVER`: The instance is off; it is not activated, even if a connection request arrives.
             */
            activationPolicy?: pulumi.Input<string>;
            /**
             * [default: ON] If you enable this setting, Cloud SQL checks your available storage every 30 seconds. If the available storage falls below a threshold size, Cloud SQL automatically adds additional storage capacity. If the available storage repeatedly falls below the threshold size, Cloud SQL continues to add storage until it reaches the maximum of 30 TB.
             */
            autoStorageIncrease?: pulumi.Input<boolean>;
            /**
             * The storage capacity available to the database, in GB. The minimum (and default) size is 10GB.
             */
            dataDiskSizeGb?: pulumi.Input<string>;
            /**
             * The type of storage: `PD_SSD` (default) or `PD_HDD`.
             */
            dataDiskType?: pulumi.Input<string>;
            /**
             * The database flags passed to the Cloud SQL instance at startup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
             */
            databaseFlags?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The database engine type and version.
             */
            databaseVersion?: pulumi.Input<string>;
            /**
             * The settings for IP Management. This allows to enable or disable the instance IP and manage which external networks can connect to the instance. The IPv4 address cannot be disabled.
             */
            ipConfig?: pulumi.Input<inputs.datamigration.v1beta1.SqlIpConfig>;
            /**
             * Input only. Initial root password.
             */
            rootPassword?: pulumi.Input<string>;
            /**
             * The Database Migration Service source connection profile ID, in the format: `projects/my_project_name/locations/us-central1/connectionProfiles/connection_profile_ID`
             */
            sourceId?: pulumi.Input<string>;
            /**
             * The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit.
             */
            storageAutoResizeLimit?: pulumi.Input<string>;
            /**
             * The tier (or machine type) for this instance, for example: `db-n1-standard-1` (MySQL instances). For more information, see [Cloud SQL Instance Settings](https://cloud.google.com/sql/docs/mysql/instance-settings).
             */
            tier?: pulumi.Input<string>;
            /**
             * The resource labels for a Cloud SQL instance to use to annotate any related underlying resources such as Compute Engine VMs. An object containing a list of "key": "value" pairs. Example: `{ "name": "wrench", "mass": "18kg", "count": "3" }`.
             */
            userLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The Google Cloud Platform zone where your Cloud SQL datdabse instance is located.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * A message defining the database engine and provider.
         */
        interface DatabaseType {
            /**
             * The database engine.
             */
            engine?: pulumi.Input<string>;
            /**
             * The database provider.
             */
            provider?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Specifies connection parameters required specifically for MySQL databases.
         */
        interface MySqlConnectionProfile {
            /**
             * If the source is a Cloud SQL database, use this field to provide the Cloud SQL instance ID of the source.
             */
            cloudSqlId?: pulumi.Input<string>;
            /**
             * Required. The IP or hostname of the source MySQL database.
             */
            host?: pulumi.Input<string>;
            /**
             * Required. Input only. The password for the user that Database Migration Service will be using to connect to the database. This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The network port of the source MySQL database.
             */
            port?: pulumi.Input<number>;
            /**
             * SSL configuration for the destination to connect to the source database.
             */
            ssl?: pulumi.Input<inputs.datamigration.v1beta1.SslConfig>;
            /**
             * Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * The details needed to configure a reverse SSH tunnel between the source and destination databases. These details will be used when calling the generateSshScript method (see https://cloud.google.com/database-migration/docs/reference/rest/v1beta1/projects.locations.migrationJobs/generateSshScript) to produce the script that will help set up the reverse SSH tunnel, and to set up the VPC peering between the Cloud SQL private network and the VPC.
         */
        interface ReverseSshConnectivity {
            /**
             * The name of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vm?: pulumi.Input<string>;
            /**
             * Required. The IP of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vmIp?: pulumi.Input<string>;
            /**
             * Required. The forwarding port of the virtual machine (Compute Engine) used as the bastion server for the SSH tunnel.
             */
            vmPort?: pulumi.Input<number>;
            /**
             * The name of the VPC to peer with the Cloud SQL private network.
             */
            vpc?: pulumi.Input<string>;
        }
        /**
         * An entry for an Access Control list.
         */
        interface SqlAclEntry {
            /**
             * The time when this access control entry expires in [RFC 3339](https://tools.ietf.org/html/rfc3339) format, for example: `2012-11-15T16:19:00.094Z`.
             */
            expireTime?: pulumi.Input<string>;
            /**
             * A label to identify this entry.
             */
            label?: pulumi.Input<string>;
            /**
             * Input only. The time-to-leave of this access control entry.
             */
            ttl?: pulumi.Input<string>;
            /**
             * The allowlisted value for the access control list.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * IP Management configuration.
         */
        interface SqlIpConfig {
            /**
             * The list of external networks that are allowed to connect to the instance using the IP. See https://en.wikipedia.org/wiki/CIDR_notation#CIDR_notation, also known as 'slash' notation (e.g. `192.168.100.0/24`).
             */
            authorizedNetworks?: pulumi.Input<pulumi.Input<inputs.datamigration.v1beta1.SqlAclEntry>[]>;
            /**
             * Whether the instance should be assigned an IPv4 address or not.
             */
            enableIpv4?: pulumi.Input<boolean>;
            /**
             * The resource link for the VPC network from which the Cloud SQL instance is accessible for private IP. For example, `/projects/myProject/global/networks/default`. This setting can be updated, but it cannot be removed after it is set.
             */
            privateNetwork?: pulumi.Input<string>;
            /**
             * Whether SSL connections over IP should be enforced or not.
             */
            requireSsl?: pulumi.Input<boolean>;
        }
        /**
         * SSL configuration information.
         */
        interface SslConfig {
            /**
             * Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate. The replica will use this certificate to verify it's connecting to the right host.
             */
            caCertificate?: pulumi.Input<string>;
            /**
             * Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.If this field is used then the 'client_key' field is mandatory.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate. If this field is used then the 'client_certificate' field is mandatory.
             */
            clientKey?: pulumi.Input<string>;
        }
        /**
         * The source database will allow incoming connections from the destination database's public IP. You can retrieve the Cloud SQL instance's public IP from the Cloud SQL console or using Cloud SQL APIs. No additional configuration is required.
         */
        interface StaticIpConnectivity {
        }
        /**
         * The details of the VPC where the source database is located in Google Cloud. We will use this information to set up the VPC peering connection between Cloud SQL and this VPC.
         */
        interface VpcPeeringConnectivity {
            /**
             * The name of the VPC network to peer with the Cloud SQL private network.
             */
            vpc?: pulumi.Input<string>;
        }
    }
}
export declare namespace dataproc {
    namespace v1 {
        /**
         * Specifies the type and number of accelerator cards attached to the instances of an instance. See GPUs on Compute Engine (https://cloud.google.com/compute/docs/gpus/).
         */
        interface AcceleratorConfig {
            /**
             * The number of the accelerator cards of this type exposed to this instance.
             */
            acceleratorCount?: pulumi.Input<number>;
            /**
             * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See Compute Engine AcceleratorTypes (https://cloud.google.com/compute/docs/reference/beta/acceleratorTypes).Examples: https://www.googleapis.com/compute/beta/projects/[project_id]/zones/us-east1-a/acceleratorTypes/nvidia-tesla-k80 projects/[project_id]/zones/us-east1-a/acceleratorTypes/nvidia-tesla-k80 nvidia-tesla-k80Auto Zone Exception: If you are using the Dataproc Auto Zone Placement (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, nvidia-tesla-k80.
             */
            acceleratorTypeUri?: pulumi.Input<string>;
        }
        /**
         * Autoscaling Policy config associated with the cluster.
         */
        interface AutoscalingConfig {
            /**
             * Optional. The autoscaling policy used by the cluster.Only resource names including projectid and location (region) are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/locations/[dataproc_region]/autoscalingPolicies/[policy_id] projects/[project_id]/locations/[dataproc_region]/autoscalingPolicies/[policy_id]Note that the policy must be in the same project and Dataproc region.
             */
            policyUri?: pulumi.Input<string>;
        }
        /**
         * Basic algorithm for autoscaling.
         */
        interface BasicAutoscalingAlgorithm {
            /**
             * Optional. Duration between scaling events. A scaling period starts after the update operation from the previous event has completed.Bounds: 2m, 1d. Default: 2m.
             */
            cooldownPeriod?: pulumi.Input<string>;
            /**
             * Required. YARN autoscaling configuration.
             */
            yarnConfig?: pulumi.Input<inputs.dataproc.v1.BasicYarnAutoscalingConfig>;
        }
        /**
         * Basic autoscaling configurations for YARN.
         */
        interface BasicYarnAutoscalingConfig {
            /**
             * Required. Timeout for YARN graceful decommissioning of Node Managers. Specifies the duration to wait for jobs to complete before forcefully removing workers (and potentially interrupting jobs). Only applicable to downscaling operations.Bounds: 0s, 1d.
             */
            gracefulDecommissionTimeout?: pulumi.Input<string>;
            /**
             * Required. Fraction of average YARN pending memory in the last cooldown period for which to remove workers. A scale-down factor of 1 will result in scaling down so that there is no available memory remaining after the update (more aggressive scaling). A scale-down factor of 0 disables removing workers, which can be beneficial for autoscaling a single job. See How autoscaling works (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/autoscaling#how_autoscaling_works) for more information.Bounds: 0.0, 1.0.
             */
            scaleDownFactor?: pulumi.Input<number>;
            /**
             * Optional. Minimum scale-down threshold as a fraction of total cluster size before scaling occurs. For example, in a 20-worker cluster, a threshold of 0.1 means the autoscaler must recommend at least a 2 worker scale-down for the cluster to scale. A threshold of 0 means the autoscaler will scale down on any recommended change.Bounds: 0.0, 1.0. Default: 0.0.
             */
            scaleDownMinWorkerFraction?: pulumi.Input<number>;
            /**
             * Required. Fraction of average YARN pending memory in the last cooldown period for which to add workers. A scale-up factor of 1.0 will result in scaling up so that there is no pending memory remaining after the update (more aggressive scaling). A scale-up factor closer to 0 will result in a smaller magnitude of scaling up (less aggressive scaling). See How autoscaling works (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/autoscaling#how_autoscaling_works) for more information.Bounds: 0.0, 1.0.
             */
            scaleUpFactor?: pulumi.Input<number>;
            /**
             * Optional. Minimum scale-up threshold as a fraction of total cluster size before scaling occurs. For example, in a 20-worker cluster, a threshold of 0.1 means the autoscaler must recommend at least a 2-worker scale-up for the cluster to scale. A threshold of 0 means the autoscaler will scale up on any recommended change.Bounds: 0.0, 1.0. Default: 0.0.
             */
            scaleUpMinWorkerFraction?: pulumi.Input<number>;
        }
        /**
         * Associates members with a role.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding.If the condition evaluates to true, then this binding applies to the current request.If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.dataproc.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. group:{emailid}: An email address that represents a Google group. For example, admins@example.com. deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * The cluster config.
         */
        interface ClusterConfig {
            /**
             * Optional. Autoscaling config for the policy associated with the cluster. Cluster does not autoscale if this field is unset.
             */
            autoscalingConfig?: pulumi.Input<inputs.dataproc.v1.AutoscalingConfig>;
            /**
             * Optional. A Cloud Storage bucket used to stage job dependencies, config files, and job driver console output. If you do not specify a staging bucket, Cloud Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's staging bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket (see Dataproc staging bucket (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/staging-bucket)). This field requires a Cloud Storage bucket name, not a URI to a Cloud Storage bucket.
             */
            configBucket?: pulumi.Input<string>;
            /**
             * Optional. Encryption settings for the cluster.
             */
            encryptionConfig?: pulumi.Input<inputs.dataproc.v1.EncryptionConfig>;
            /**
             * Optional. Port/endpoint configuration for this cluster
             */
            endpointConfig?: pulumi.Input<inputs.dataproc.v1.EndpointConfig>;
            /**
             * Optional. The shared Compute Engine config settings for all instances in a cluster.
             */
            gceClusterConfig?: pulumi.Input<inputs.dataproc.v1.GceClusterConfig>;
            /**
             * Optional. BETA. The Kubernetes Engine config for Dataproc clusters deployed to Kubernetes. Setting this is considered mutually exclusive with Compute Engine-based options such as gce_cluster_config, master_config, worker_config, secondary_worker_config, and autoscaling_config.
             */
            gkeClusterConfig?: pulumi.Input<inputs.dataproc.v1.GkeClusterConfig>;
            /**
             * Optional. Commands to execute on each node after config is completed. By default, executables are run on master and all worker nodes. You can test a node's role metadata to run an executable on a master or worker node, as shown below using curl (you can also use wget): ROLE=$(curl -H Metadata-Flavor:Google http://metadata/computeMetadata/v1/instance/attributes/dataproc-role) if [[ "${ROLE}" == 'Master' ]]; then ... master specific actions ... else ... worker specific actions ... fi
             */
            initializationActions?: pulumi.Input<pulumi.Input<inputs.dataproc.v1.NodeInitializationAction>[]>;
            /**
             * Optional. Lifecycle setting for the cluster.
             */
            lifecycleConfig?: pulumi.Input<inputs.dataproc.v1.LifecycleConfig>;
            /**
             * Optional. The Compute Engine config settings for the master instance in a cluster.
             */
            masterConfig?: pulumi.Input<inputs.dataproc.v1.InstanceGroupConfig>;
            /**
             * Optional. Metastore configuration.
             */
            metastoreConfig?: pulumi.Input<inputs.dataproc.v1.MetastoreConfig>;
            /**
             * Optional. The Compute Engine config settings for additional worker instances in a cluster.
             */
            secondaryWorkerConfig?: pulumi.Input<inputs.dataproc.v1.InstanceGroupConfig>;
            /**
             * Optional. Security settings for the cluster.
             */
            securityConfig?: pulumi.Input<inputs.dataproc.v1.SecurityConfig>;
            /**
             * Optional. The config settings for software inside the cluster.
             */
            softwareConfig?: pulumi.Input<inputs.dataproc.v1.SoftwareConfig>;
            /**
             * Optional. A Cloud Storage bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. If you do not specify a temp bucket, Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's temp bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket. The default bucket has a TTL of 90 days, but you can use any TTL (or none) if you specify a bucket. This field requires a Cloud Storage bucket name, not a URI to a Cloud Storage bucket.
             */
            tempBucket?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine config settings for worker instances in a cluster.
             */
            workerConfig?: pulumi.Input<inputs.dataproc.v1.InstanceGroupConfig>;
        }
        /**
         * A selector that chooses target cluster for jobs based on metadata.
         */
        interface ClusterSelector {
            /**
             * Required. The cluster labels. Cluster must have all labels to match.
             */
            clusterLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The zone where workflow process executes. This parameter does not affect the selection of the cluster.If unspecified, the zone of the first cluster matching the selector is used.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Specifies the config of disk options for a group of VM instances.
         */
        interface DiskConfig {
            /**
             * Optional. Size in GB of the boot disk (default is 500GB).
             */
            bootDiskSizeGb?: pulumi.Input<number>;
            /**
             * Optional. Type of the boot disk (default is "pd-standard"). Valid values: "pd-balanced" (Persistent Disk Balanced Solid State Drive), "pd-ssd" (Persistent Disk Solid State Drive), or "pd-standard" (Persistent Disk Hard Disk Drive). See Disk types (https://cloud.google.com/compute/docs/disks#disk-types).
             */
            bootDiskType?: pulumi.Input<string>;
            /**
             * Optional. Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and HDFS (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
             */
            numLocalSsds?: pulumi.Input<number>;
        }
        /**
         * Encryption settings for the cluster.
         */
        interface EncryptionConfig {
            /**
             * Optional. The Cloud KMS key name to use for PD disk encryption for all instances in the cluster.
             */
            gcePdKmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Endpoint config for this cluster
         */
        interface EndpointConfig {
            /**
             * Optional. If true, enable http access to specific ports on the cluster from external sources. Defaults to false.
             */
            enableHttpPortAccess?: pulumi.Input<boolean>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Common config settings for resources of Compute Engine cluster instances, applicable to all instances in the cluster.
         */
        interface GceClusterConfig {
            /**
             * Optional. If true, all instances in the cluster will only have internal IP addresses. By default, clusters are not restricted to internal IP addresses, and will have ephemeral external IP addresses assigned to each instance. This internal_ip_only restriction can only be enabled for subnetwork enabled networks, and all off-cluster dependencies must be configured to be accessible without external IP addresses.
             */
            internalIpOnly?: pulumi.Input<boolean>;
            /**
             * The Compute Engine metadata entries to add to all instances (see Project and instance metadata (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork_uri. If neither network_uri nor subnetwork_uri is specified, the "default" network of the project is used, if it exists. Cannot be a "Custom Subnet Network" (see Using Subnetworks (https://cloud.google.com/compute/docs/subnetworks) for more information).A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/regions/global/default projects/[project_id]/regions/global/default default
             */
            networkUri?: pulumi.Input<string>;
            /**
             * Optional. Node Group Affinity for sole-tenant clusters.
             */
            nodeGroupAffinity?: pulumi.Input<inputs.dataproc.v1.NodeGroupAffinity>;
            /**
             * Optional. The type of IPv6 access for a cluster.
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * Optional. Reservation Affinity for consuming Zonal reservation.
             */
            reservationAffinity?: pulumi.Input<inputs.dataproc.v1.ReservationAffinity>;
            /**
             * Optional. The Dataproc service account (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/service-accounts#service_accounts_in_dataproc) (also see VM Data Plane identity (https://cloud.google.com/dataproc/docs/concepts/iam/dataproc-principals#vm_service_account_data_plane_identity)) used by Dataproc cluster VM instances to access Google Cloud Platform services.If not specified, the Compute Engine default service account (https://cloud.google.com/compute/docs/access/service-accounts#default_service_account) is used.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Optional. The URIs of service account scopes to be included in Compute Engine instances. The following base set of scopes is always included: https://www.googleapis.com/auth/cloud.useraccounts.readonly https://www.googleapis.com/auth/devstorage.read_write https://www.googleapis.com/auth/logging.writeIf no scopes are specified, the following defaults are also provided: https://www.googleapis.com/auth/bigquery https://www.googleapis.com/auth/bigtable.admin.table https://www.googleapis.com/auth/bigtable.data https://www.googleapis.com/auth/devstorage.full_control
             */
            serviceAccountScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Shielded Instance Config for clusters using Compute Engine Shielded VMs (https://cloud.google.com/security/shielded-cloud/shielded-vm).
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.dataproc.v1.ShieldedInstanceConfig>;
            /**
             * Optional. The Compute Engine subnetwork to be used for machine communications. Cannot be specified with network_uri.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/regions/us-east1/subnetworks/sub0 projects/[project_id]/regions/us-east1/subnetworks/sub0 sub0
             */
            subnetworkUri?: pulumi.Input<string>;
            /**
             * The Compute Engine tags to add to all instances (see Tagging instances (https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/[zone] projects/[project_id]/zones/[zone] us-central1-f
             */
            zoneUri?: pulumi.Input<string>;
        }
        /**
         * The GKE config for this cluster.
         */
        interface GkeClusterConfig {
            /**
             * Optional. A target for the deployment.
             */
            namespacedGkeDeploymentTarget?: pulumi.Input<inputs.dataproc.v1.NamespacedGkeDeploymentTarget>;
        }
        /**
         * A Dataproc job for running Apache Hadoop MapReduce (https://hadoop.apache.org/docs/current/hadoop-mapreduce-client/hadoop-mapreduce-client-core/MapReduceTutorial.html) jobs on Apache Hadoop YARN (https://hadoop.apache.org/docs/r2.7.1/hadoop-yarn/hadoop-yarn-site/YARN.html).
         */
        interface HadoopJob {
            /**
             * Optional. HCFS URIs of archives to be extracted in the working directory of Hadoop drivers and tasks. Supported file types: .jar, .tar, .tar.gz, .tgz, or .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as -libjars or -Dfoo=bar, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS (Hadoop Compatible Filesystem) URIs of files to be copied to the working directory of Hadoop drivers and distributed tasks. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Jar file URIs to add to the CLASSPATHs of the Hadoop driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * The name of the driver's main class. The jar file containing the class must be in the default CLASSPATH or specified in jar_file_uris.
             */
            mainClass?: pulumi.Input<string>;
            /**
             * The HCFS URI of the jar file containing the main class. Examples: 'gs://foo-bucket/analytics-binaries/extract-useful-metrics-mr.jar' 'hdfs:/tmp/test-samples/custom-wordcount.jar' 'file:///home/usr/lib/hadoop-mapreduce/hadoop-mapreduce-examples.jar'
             */
            mainJarFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure Hadoop. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Hive (https://hive.apache.org/) queries on YARN.
         */
        interface HiveJob {
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATH of the Hive server and Hadoop MapReduce (MR) tasks. Can contain Hive SerDes and UDFs.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A mapping of property names and values, used to configure Hive. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/hive/conf/hive-site.xml, and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains Hive queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Hive command: SET name="value";).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Identity related configuration, including service account based secure multi-tenancy user mappings.
         */
        interface IdentityConfig {
            /**
             * Required. Map of user to service account.
             */
            userServiceAccountMapping?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Configuration for the size bounds of an instance group, including its proportional size to other groups.
         */
        interface InstanceGroupAutoscalingPolicyConfig {
            /**
             * Required. Maximum number of instances for this group. Required for primary workers. Note that by default, clusters will not use secondary workers. Required for secondary workers if the minimum secondary instances is set.Primary workers - Bounds: [min_instances, ). Secondary workers - Bounds: [min_instances, ). Default: 0.
             */
            maxInstances?: pulumi.Input<number>;
            /**
             * Optional. Minimum number of instances for this group.Primary workers - Bounds: 2, max_instances. Default: 2. Secondary workers - Bounds: 0, max_instances. Default: 0.
             */
            minInstances?: pulumi.Input<number>;
            /**
             * Optional. Weight for the instance group, which is used to determine the fraction of total workers in the cluster from this instance group. For example, if primary workers have weight 2, and secondary workers have weight 1, the cluster will have approximately 2 primary workers for each secondary worker.The cluster may not reach the specified balance if constrained by min/max bounds or other autoscaling settings. For example, if max_instances for secondary workers is 0, then only primary workers will be added. The cluster can also be out of balance when created.If weight is not set on any instance group, the cluster will default to equal weight for all groups: the cluster will attempt to maintain an equal number of workers in each group within the configured size bounds for each group. If weight is set for one group only, the cluster will default to zero weight on the unset group. For example if weight is set only on primary workers, the cluster will use primary workers only and no secondary workers.
             */
            weight?: pulumi.Input<number>;
        }
        /**
         * The config settings for Compute Engine resources in an instance group, such as a master or worker group.
         */
        interface InstanceGroupConfig {
            /**
             * Optional. The Compute Engine accelerator configuration for these instances.
             */
            accelerators?: pulumi.Input<pulumi.Input<inputs.dataproc.v1.AcceleratorConfig>[]>;
            /**
             * Optional. Disk option config settings.
             */
            diskConfig?: pulumi.Input<inputs.dataproc.v1.DiskConfig>;
            /**
             * Optional. The Compute Engine image resource used for cluster instances.The URI can represent an image or image family.Image examples: https://www.googleapis.com/compute/beta/projects/[project_id]/global/images/[image-id] projects/[project_id]/global/images/[image-id] image-idImage family examples. Dataproc will use the most recent image from the family: https://www.googleapis.com/compute/beta/projects/[project_id]/global/images/family/[custom-image-family-name] projects/[project_id]/global/images/family/[custom-image-family-name]If the URI is unspecified, it will be inferred from SoftwareConfig.image_version or the system default.
             */
            imageUri?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine machine type used for cluster instances.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/us-east1-a/machineTypes/n1-standard-2 projects/[project_id]/zones/us-east1-a/machineTypes/n1-standard-2 n1-standard-2Auto Zone Exception: If you are using the Dataproc Auto Zone Placement (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the machine type resource, for example, n1-standard-2.
             */
            machineTypeUri?: pulumi.Input<string>;
            /**
             * Optional. Specifies the minimum cpu platform for the Instance Group. See Dataproc -> Minimum CPU Platform (https://cloud.google.com/dataproc/docs/concepts/compute/dataproc-min-cpu).
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Optional. The number of VM instances in the instance group. For HA cluster master_config groups, must be set to 3. For standard cluster master_config groups, must be set to 1.
             */
            numInstances?: pulumi.Input<number>;
            /**
             * Optional. Specifies the preemptibility of the instance group.The default value for master and worker groups is NON_PREEMPTIBLE. This default cannot be changed.The default value for secondary instances is PREEMPTIBLE.
             */
            preemptibility?: pulumi.Input<string>;
        }
        /**
         * Job scheduling options.
         */
        interface JobScheduling {
            /**
             * Optional. Maximum number of times per hour a driver may be restarted as a result of driver exiting with non-zero code before job is reported failed.A job may be reported as thrashing if driver exits with non-zero code 4 times within 10 minute window.Maximum value is 10.
             */
            maxFailuresPerHour?: pulumi.Input<number>;
            /**
             * Optional. Maximum number of times in total a driver may be restarted as a result of driver exiting with non-zero code before job is reported failed. Maximum value is 240.
             */
            maxFailuresTotal?: pulumi.Input<number>;
        }
        /**
         * Specifies Kerberos related configuration.
         */
        interface KerberosConfig {
            /**
             * Optional. The admin server (IP or hostname) for the remote trusted realm in a cross realm trust relationship.
             */
            crossRealmTrustAdminServer?: pulumi.Input<string>;
            /**
             * Optional. The KDC (IP or hostname) for the remote trusted realm in a cross realm trust relationship.
             */
            crossRealmTrustKdc?: pulumi.Input<string>;
            /**
             * Optional. The remote realm the Dataproc on-cluster KDC will trust, should the user enable cross realm trust.
             */
            crossRealmTrustRealm?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the shared password between the on-cluster Kerberos realm and the remote trusted realm, in a cross realm trust relationship.
             */
            crossRealmTrustSharedPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. Flag to indicate whether to Kerberize the cluster (default: false). Set this field to true to enable Kerberos on a cluster.
             */
            enableKerberos?: pulumi.Input<boolean>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the master key of the KDC database.
             */
            kdcDbKeyUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided key. For the self-signed certificate, this password is generated by Dataproc.
             */
            keyPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided keystore. For the self-signed certificate, this password is generated by Dataproc.
             */
            keystorePasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of the keystore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.
             */
            keystoreUri?: pulumi.Input<string>;
            /**
             * Optional. The uri of the KMS key used to encrypt various sensitive files.
             */
            kmsKeyUri?: pulumi.Input<string>;
            /**
             * Optional. The name of the on-cluster Kerberos realm. If not specified, the uppercased domain of hostnames will be the realm.
             */
            realm?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the root principal password.
             */
            rootPrincipalPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The lifetime of the ticket granting ticket, in hours. If not specified, or user specifies 0, then default value 10 will be used.
             */
            tgtLifetimeHours?: pulumi.Input<number>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided truststore. For the self-signed certificate, this password is generated by Dataproc.
             */
            truststorePasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of the truststore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.
             */
            truststoreUri?: pulumi.Input<string>;
        }
        /**
         * Specifies the cluster auto-delete schedule configuration.
         */
        interface LifecycleConfig {
            /**
             * Optional. The time when cluster will be auto-deleted (see JSON representation of Timestamp (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            autoDeleteTime?: pulumi.Input<string>;
            /**
             * Optional. The lifetime duration of cluster. The cluster will be auto-deleted at the end of this period. Minimum value is 10 minutes; maximum value is 14 days (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            autoDeleteTtl?: pulumi.Input<string>;
            /**
             * Optional. The duration to keep the cluster alive while idling (when no jobs are running). Passing this threshold will cause the cluster to be deleted. Minimum value is 5 minutes; maximum value is 14 days (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            idleDeleteTtl?: pulumi.Input<string>;
        }
        /**
         * The runtime logging config of the job.
         */
        interface LoggingConfig {
            /**
             * The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
             */
            driverLogLevels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Cluster that is managed by the workflow.
         */
        interface ManagedCluster {
            /**
             * Required. The cluster name prefix. A unique cluster name will be formed by appending a random suffix.The name must contain only lower-case letters (a-z), numbers (0-9), and hyphens (-). Must begin with a letter. Cannot begin or end with hyphen. Must consist of between 2 and 35 characters.
             */
            clusterName?: pulumi.Input<string>;
            /**
             * Required. The cluster configuration.
             */
            config?: pulumi.Input<inputs.dataproc.v1.ClusterConfig>;
            /**
             * Optional. The labels to associate with this cluster.Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}{0,62}Label values must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}\p{N}_-{0,63}No more than 32 labels can be associated with a given cluster.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Specifies a Metastore configuration.
         */
        interface MetastoreConfig {
            /**
             * Required. Resource name of an existing Dataproc Metastore service.Example: projects/[project_id]/locations/[dataproc_region]/services/[service-name]
             */
            dataprocMetastoreService?: pulumi.Input<string>;
        }
        /**
         * A full, namespace-isolated deployment target for an existing GKE cluster.
         */
        interface NamespacedGkeDeploymentTarget {
            /**
             * Optional. A namespace within the GKE cluster to deploy into.
             */
            clusterNamespace?: pulumi.Input<string>;
            /**
             * Optional. The target GKE cluster to deploy to. Format: 'projects/{project}/locations/{location}/clusters/{cluster_id}'
             */
            targetGkeCluster?: pulumi.Input<string>;
        }
        /**
         * Node Group Affinity for clusters using sole-tenant node groups.
         */
        interface NodeGroupAffinity {
            /**
             * Required. The URI of a sole-tenant node group resource (https://cloud.google.com/compute/docs/reference/rest/v1/nodeGroups) that the cluster will be created on.A full URL, partial URI, or node group name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/us-central1-a/nodeGroups/node-group-1 projects/[project_id]/zones/us-central1-a/nodeGroups/node-group-1 node-group-1
             */
            nodeGroupUri?: pulumi.Input<string>;
        }
        /**
         * Specifies an executable to run on a fully configured node and a timeout period for executable completion.
         */
        interface NodeInitializationAction {
            /**
             * Required. Cloud Storage URI of executable file.
             */
            executableFile?: pulumi.Input<string>;
            /**
             * Optional. Amount of time executable has to complete. Default is 10 minutes (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).Cluster creation fails with an explanatory error message (the name of the executable that caused the error and the exceeded timeout period) if the executable is not completed at end of the timeout period.
             */
            executionTimeout?: pulumi.Input<string>;
        }
        /**
         * A job executed by the workflow.
         */
        interface OrderedJob {
            /**
             * Optional. Job is a Hadoop job.
             */
            hadoopJob?: pulumi.Input<inputs.dataproc.v1.HadoopJob>;
            /**
             * Optional. Job is a Hive job.
             */
            hiveJob?: pulumi.Input<inputs.dataproc.v1.HiveJob>;
            /**
             * Optional. The labels to associate with this job.Label keys must be between 1 and 63 characters long, and must conform to the following regular expression: \p{Ll}\p{Lo}{0,62}Label values must be between 1 and 63 characters long, and must conform to the following regular expression: \p{Ll}\p{Lo}\p{N}_-{0,63}No more than 32 labels can be associated with a given job.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Job is a Pig job.
             */
            pigJob?: pulumi.Input<inputs.dataproc.v1.PigJob>;
            /**
             * Optional. The optional list of prerequisite job step_ids. If not specified, the job will start at the beginning of workflow.
             */
            prerequisiteStepIds?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Job is a Presto job.
             */
            prestoJob?: pulumi.Input<inputs.dataproc.v1.PrestoJob>;
            /**
             * Optional. Job is a PySpark job.
             */
            pysparkJob?: pulumi.Input<inputs.dataproc.v1.PySparkJob>;
            /**
             * Optional. Job scheduling configuration.
             */
            scheduling?: pulumi.Input<inputs.dataproc.v1.JobScheduling>;
            /**
             * Optional. Job is a Spark job.
             */
            sparkJob?: pulumi.Input<inputs.dataproc.v1.SparkJob>;
            /**
             * Optional. Job is a SparkR job.
             */
            sparkRJob?: pulumi.Input<inputs.dataproc.v1.SparkRJob>;
            /**
             * Optional. Job is a SparkSql job.
             */
            sparkSqlJob?: pulumi.Input<inputs.dataproc.v1.SparkSqlJob>;
            /**
             * Required. The step id. The id must be unique among all jobs within the template.The step id is used as prefix for job id, as job goog-dataproc-workflow-step-id label, and in prerequisiteStepIds field from other steps.The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), and hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between 3 and 50 characters.
             */
            stepId?: pulumi.Input<string>;
        }
        /**
         * Configuration for parameter validation.
         */
        interface ParameterValidation {
            /**
             * Validation based on regular expressions.
             */
            regex?: pulumi.Input<inputs.dataproc.v1.RegexValidation>;
            /**
             * Validation based on a list of allowed values.
             */
            values?: pulumi.Input<inputs.dataproc.v1.ValueValidation>;
        }
        /**
         * A Dataproc job for running Apache Pig (https://pig.apache.org/) queries on YARN.
         */
        interface PigJob {
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATH of the Pig Client and Hadoop MapReduce (MR) tasks. Can contain Pig UDFs.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * Optional. A mapping of property names to values, used to configure Pig. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/pig/conf/pig.properties, and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains the Pig queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Pig command: name=[value]).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Presto (https://prestosql.io/) queries. IMPORTANT: The Dataproc Presto Optional Component (https://cloud.google.com/dataproc/docs/concepts/components/presto) must be enabled when the cluster is created to submit a Presto job to the cluster.
         */
        interface PrestoJob {
            /**
             * Optional. Presto client tags to attach to this query
             */
            clientTags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * Optional. The format in which query output will be displayed. See the Presto documentation for supported output formats
             */
            outputFormat?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values. Used to set Presto session properties (https://prestodb.io/docs/current/sql/set-session.html) Equivalent to using the --session flag in the Presto CLI
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains SQL queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1.QueryList>;
        }
        /**
         * A Dataproc job for running Apache PySpark (https://spark.apache.org/docs/0.9.0/python-programming-guide.html) applications on YARN.
         */
        interface PySparkJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATHs of the Python driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * Required. The HCFS URI of the main Python file to use as the driver. Must be a .py file.
             */
            mainPythonFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure PySpark. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
             */
            pythonFileUris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A list of queries to run on a cluster.
         */
        interface QueryList {
            /**
             * Required. The queries to execute. You do not need to end a query expression with a semicolon. Multiple queries can be specified in one string by separating each with a semicolon. Here is an example of a Dataproc API snippet that uses a QueryList to specify a HiveJob: "hiveJob": { "queryList": { "queries": [ "query1", "query2", "query3;query4", ] } }
             */
            queries?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Validation based on regular expressions.
         */
        interface RegexValidation {
            /**
             * Required. RE2 regular expressions used to validate the parameter's value. The value must match the regex in its entirety (substring matches are not sufficient).
             */
            regexes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Reservation Affinity for consuming Zonal reservation.
         */
        interface ReservationAffinity {
            /**
             * Optional. Type of reservation to consume
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Optional. Corresponds to the label key of reservation resource.
             */
            key?: pulumi.Input<string>;
            /**
             * Optional. Corresponds to the label values of reservation resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Security related configuration, including encryption, Kerberos, etc.
         */
        interface SecurityConfig {
            /**
             * Optional. Identity related configuration, including service account based secure multi-tenancy user mappings.
             */
            identityConfig?: pulumi.Input<inputs.dataproc.v1.IdentityConfig>;
            /**
             * Optional. Kerberos related configuration.
             */
            kerberosConfig?: pulumi.Input<inputs.dataproc.v1.KerberosConfig>;
        }
        /**
         * Shielded Instance Config for clusters using Compute Engine Shielded VMs (https://cloud.google.com/security/shielded-cloud/shielded-vm).
         */
        interface ShieldedInstanceConfig {
            /**
             * Optional. Defines whether instances have integrity monitoring enabled.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Optional. Defines whether instances have Secure Boot enabled.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Optional. Defines whether instances have the vTPM enabled.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * Specifies the selection and config of software inside the cluster.
         */
        interface SoftwareConfig {
            /**
             * Optional. The version of software inside the cluster. It must be one of the supported Dataproc Versions (https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#supported_dataproc_versions), such as "1.2" (including a subminor version, such as "1.2.29"), or the "preview" version (https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#other_versions). If unspecified, it defaults to the latest Debian version.
             */
            imageVersion?: pulumi.Input<string>;
            /**
             * Optional. The set of components to activate on the cluster.
             */
            optionalComponents?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The properties to set on daemon config files.Property keys are specified in prefix:property format, for example core:hadoop.tmp.dir. The following are supported prefixes and their mappings: capacity-scheduler: capacity-scheduler.xml core: core-site.xml distcp: distcp-default.xml hdfs: hdfs-site.xml hive: hive-site.xml mapred: mapred-site.xml pig: pig.properties spark: spark-defaults.conf yarn: yarn-site.xmlFor more information, see Cluster properties (https://cloud.google.com/dataproc/docs/concepts/cluster-properties).
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Spark (http://spark.apache.org/) applications on YARN.
         */
        interface SparkJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATHs of the Spark driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * The name of the driver's main class. The jar file that contains the class must be in the default CLASSPATH or specified in jar_file_uris.
             */
            mainClass?: pulumi.Input<string>;
            /**
             * The HCFS URI of the jar file that contains the main class.
             */
            mainJarFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure Spark. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache SparkR (https://spark.apache.org/docs/latest/sparkr.html) applications on YARN.
         */
        interface SparkRJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * Required. The HCFS URI of the main R file to use as the driver. Must be a .R file.
             */
            mainRFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure SparkR. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Spark SQL (http://spark.apache.org/sql/) queries.
         */
        interface SparkSqlJob {
            /**
             * Optional. HCFS URIs of jar files to be added to the Spark CLASSPATH.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1.LoggingConfig>;
            /**
             * Optional. A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains SQL queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A configurable parameter that replaces one or more fields in the template. Parameterizable fields: - Labels - File uris - Job properties - Job arguments - Script variables - Main class (in HadoopJob and SparkJob) - Zone (in ClusterSelector)
         */
        interface TemplateParameter {
            /**
             * Optional. Brief description of the parameter. Must not exceed 1024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. Paths to all fields that the parameter replaces. A field is allowed to appear in at most one parameter's list of field paths.A field path is similar in syntax to a google.protobuf.FieldMask. For example, a field path that references the zone field of a workflow template's cluster selector would be specified as placement.clusterSelector.zone.Also, field paths can reference fields using the following syntax: Values in maps can be referenced by key: labels'key' placement.clusterSelector.clusterLabels'key' placement.managedCluster.labels'key' placement.clusterSelector.clusterLabels'key' jobs'step-id'.labels'key' Jobs in the jobs list can be referenced by step-id: jobs'step-id'.hadoopJob.mainJarFileUri jobs'step-id'.hiveJob.queryFileUri jobs'step-id'.pySparkJob.mainPythonFileUri jobs'step-id'.hadoopJob.jarFileUris0 jobs'step-id'.hadoopJob.archiveUris0 jobs'step-id'.hadoopJob.fileUris0 jobs'step-id'.pySparkJob.pythonFileUris0 Items in repeated fields can be referenced by a zero-based index: jobs'step-id'.sparkJob.args0 Other examples: jobs'step-id'.hadoopJob.properties'key' jobs'step-id'.hadoopJob.args0 jobs'step-id'.hiveJob.scriptVariables'key' jobs'step-id'.hadoopJob.mainJarFileUri placement.clusterSelector.zoneIt may not be possible to parameterize maps and repeated fields in their entirety since only individual map values and individual items in repeated fields can be referenced. For example, the following field paths are invalid: placement.clusterSelector.clusterLabels jobs'step-id'.sparkJob.args
             */
            fields?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. Parameter name. The parameter name is used as the key, and paired with the parameter value, which are passed to the template when the template is instantiated. The name must contain only capital letters (A-Z), numbers (0-9), and underscores (_), and must not start with a number. The maximum length is 40 characters.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. Validation rules to be applied to this parameter's value.
             */
            validation?: pulumi.Input<inputs.dataproc.v1.ParameterValidation>;
        }
        /**
         * Validation based on a list of allowed values.
         */
        interface ValueValidation {
            /**
             * Required. List of allowed values for the parameter.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Specifies workflow execution target.Either managed_cluster or cluster_selector is required.
         */
        interface WorkflowTemplatePlacement {
            /**
             * Optional. A selector that chooses target cluster for jobs based on metadata.The selector is evaluated at the time each job is submitted.
             */
            clusterSelector?: pulumi.Input<inputs.dataproc.v1.ClusterSelector>;
            /**
             * A cluster that is managed by the workflow.
             */
            managedCluster?: pulumi.Input<inputs.dataproc.v1.ManagedCluster>;
        }
    }
    namespace v1beta2 {
        /**
         * Specifies the type and number of accelerator cards attached to the instances of an instance group (see GPUs on Compute Engine (https://cloud.google.com/compute/docs/gpus/)).
         */
        interface AcceleratorConfig {
            /**
             * The number of the accelerator cards of this type exposed to this instance.
             */
            acceleratorCount?: pulumi.Input<number>;
            /**
             * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See Compute Engine AcceleratorTypes (https://cloud.google.com/compute/docs/reference/beta/acceleratorTypes)Examples * https://www.googleapis.com/compute/beta/projects/[project_id]/zones/us-east1-a/acceleratorTypes/nvidia-tesla-k80 * projects/[project_id]/zones/us-east1-a/acceleratorTypes/nvidia-tesla-k80 * nvidia-tesla-k80Auto Zone Exception: If you are using the Dataproc Auto Zone Placement (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, nvidia-tesla-k80.
             */
            acceleratorTypeUri?: pulumi.Input<string>;
        }
        /**
         * Autoscaling Policy config associated with the cluster.
         */
        interface AutoscalingConfig {
            /**
             * Optional. The autoscaling policy used by the cluster.Only resource names including projectid and location (region) are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/locations/[dataproc_region]/autoscalingPolicies/[policy_id] projects/[project_id]/locations/[dataproc_region]/autoscalingPolicies/[policy_id]Note that the policy must be in the same project and Dataproc region.
             */
            policyUri?: pulumi.Input<string>;
        }
        /**
         * Basic algorithm for autoscaling.
         */
        interface BasicAutoscalingAlgorithm {
            /**
             * Optional. Duration between scaling events. A scaling period starts after the update operation from the previous event has completed.Bounds: 2m, 1d. Default: 2m.
             */
            cooldownPeriod?: pulumi.Input<string>;
            /**
             * Required. YARN autoscaling configuration.
             */
            yarnConfig?: pulumi.Input<inputs.dataproc.v1beta2.BasicYarnAutoscalingConfig>;
        }
        /**
         * Basic autoscaling configurations for YARN.
         */
        interface BasicYarnAutoscalingConfig {
            /**
             * Required. Timeout for YARN graceful decommissioning of Node Managers. Specifies the duration to wait for jobs to complete before forcefully removing workers (and potentially interrupting jobs). Only applicable to downscaling operations.Bounds: 0s, 1d.
             */
            gracefulDecommissionTimeout?: pulumi.Input<string>;
            /**
             * Required. Fraction of average YARN pending memory in the last cooldown period for which to remove workers. A scale-down factor of 1 will result in scaling down so that there is no available memory remaining after the update (more aggressive scaling). A scale-down factor of 0 disables removing workers, which can be beneficial for autoscaling a single job. See How autoscaling works for more information.Bounds: 0.0, 1.0.
             */
            scaleDownFactor?: pulumi.Input<number>;
            /**
             * Optional. Minimum scale-down threshold as a fraction of total cluster size before scaling occurs. For example, in a 20-worker cluster, a threshold of 0.1 means the autoscaler must recommend at least a 2 worker scale-down for the cluster to scale. A threshold of 0 means the autoscaler will scale down on any recommended change.Bounds: 0.0, 1.0. Default: 0.0.
             */
            scaleDownMinWorkerFraction?: pulumi.Input<number>;
            /**
             * Required. Fraction of average YARN pending memory in the last cooldown period for which to add workers. A scale-up factor of 1.0 will result in scaling up so that there is no pending memory remaining after the update (more aggressive scaling). A scale-up factor closer to 0 will result in a smaller magnitude of scaling up (less aggressive scaling). See How autoscaling works for more information.Bounds: 0.0, 1.0.
             */
            scaleUpFactor?: pulumi.Input<number>;
            /**
             * Optional. Minimum scale-up threshold as a fraction of total cluster size before scaling occurs. For example, in a 20-worker cluster, a threshold of 0.1 means the autoscaler must recommend at least a 2-worker scale-up for the cluster to scale. A threshold of 0 means the autoscaler will scale up on any recommended change.Bounds: 0.0, 1.0. Default: 0.0.
             */
            scaleUpMinWorkerFraction?: pulumi.Input<number>;
        }
        /**
         * Associates members with a role.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding.If the condition evaluates to true, then this binding applies to the current request.If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.dataproc.v1beta2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. group:{emailid}: An email address that represents a Google group. For example, admins@example.com. deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * The cluster config.
         */
        interface ClusterConfig {
            /**
             * Optional. Autoscaling config for the policy associated with the cluster. Cluster does not autoscale if this field is unset.
             */
            autoscalingConfig?: pulumi.Input<inputs.dataproc.v1beta2.AutoscalingConfig>;
            /**
             * Optional. A Cloud Storage bucket used to stage job dependencies, config files, and job driver console output. If you do not specify a staging bucket, Cloud Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's staging bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket (see Dataproc staging bucket (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/staging-bucket)). This field requires a Cloud Storage bucket name, not a URI to a Cloud Storage bucket.
             */
            configBucket?: pulumi.Input<string>;
            /**
             * Optional. Encryption settings for the cluster.
             */
            encryptionConfig?: pulumi.Input<inputs.dataproc.v1beta2.EncryptionConfig>;
            /**
             * Optional. Port/endpoint configuration for this cluster
             */
            endpointConfig?: pulumi.Input<inputs.dataproc.v1beta2.EndpointConfig>;
            /**
             * Optional. The shared Compute Engine config settings for all instances in a cluster.
             */
            gceClusterConfig?: pulumi.Input<inputs.dataproc.v1beta2.GceClusterConfig>;
            /**
             * Optional. The Kubernetes Engine config for Dataproc clusters deployed to Kubernetes. Setting this is considered mutually exclusive with Compute Engine-based options such as gce_cluster_config, master_config, worker_config, secondary_worker_config, and autoscaling_config.
             */
            gkeClusterConfig?: pulumi.Input<inputs.dataproc.v1beta2.GkeClusterConfig>;
            /**
             * Optional. Commands to execute on each node after config is completed. By default, executables are run on master and all worker nodes. You can test a node's role metadata to run an executable on a master or worker node, as shown below using curl (you can also use wget): ROLE=$(curl -H Metadata-Flavor:Google http://metadata/computeMetadata/v1beta2/instance/attributes/dataproc-role) if [[ "${ROLE}" == 'Master' ]]; then ... master specific actions ... else ... worker specific actions ... fi
             */
            initializationActions?: pulumi.Input<pulumi.Input<inputs.dataproc.v1beta2.NodeInitializationAction>[]>;
            /**
             * Optional. The config setting for auto delete cluster schedule.
             */
            lifecycleConfig?: pulumi.Input<inputs.dataproc.v1beta2.LifecycleConfig>;
            /**
             * Optional. The Compute Engine config settings for the master instance in a cluster.
             */
            masterConfig?: pulumi.Input<inputs.dataproc.v1beta2.InstanceGroupConfig>;
            /**
             * Optional. Metastore configuration.
             */
            metastoreConfig?: pulumi.Input<inputs.dataproc.v1beta2.MetastoreConfig>;
            /**
             * Optional. The Compute Engine config settings for additional worker instances in a cluster.
             */
            secondaryWorkerConfig?: pulumi.Input<inputs.dataproc.v1beta2.InstanceGroupConfig>;
            /**
             * Optional. Security related configuration.
             */
            securityConfig?: pulumi.Input<inputs.dataproc.v1beta2.SecurityConfig>;
            /**
             * Optional. The config settings for software inside the cluster.
             */
            softwareConfig?: pulumi.Input<inputs.dataproc.v1beta2.SoftwareConfig>;
            /**
             * Optional. A Cloud Storage bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. If you do not specify a temp bucket, Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's temp bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket. The default bucket has a TTL of 90 days, but you can use any TTL (or none) if you specify a bucket. This field requires a Cloud Storage bucket name, not a URI to a Cloud Storage bucket.
             */
            tempBucket?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine config settings for worker instances in a cluster.
             */
            workerConfig?: pulumi.Input<inputs.dataproc.v1beta2.InstanceGroupConfig>;
        }
        /**
         * A selector that chooses target cluster for jobs based on metadata.
         */
        interface ClusterSelector {
            /**
             * Required. The cluster labels. Cluster must have all labels to match.
             */
            clusterLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The zone where workflow process executes. This parameter does not affect the selection of the cluster.If unspecified, the zone of the first cluster matching the selector is used.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Specifies the config of disk options for a group of VM instances.
         */
        interface DiskConfig {
            /**
             * Optional. Size in GB of the boot disk (default is 500GB).
             */
            bootDiskSizeGb?: pulumi.Input<number>;
            /**
             * Optional. Type of the boot disk (default is "pd-standard"). Valid values: "pd-balanced" (Persistent Disk Balanced Solid State Drive), "pd-ssd" (Persistent Disk Solid State Drive), or "pd-standard" (Persistent Disk Hard Disk Drive). See Disk types (https://cloud.google.com/compute/docs/disks#disk-types).
             */
            bootDiskType?: pulumi.Input<string>;
            /**
             * Number of attached SSDs, from 0 to 4 (default is 0). If SSDs are not attached, the boot disk is used to store runtime logs and HDFS (https://hadoop.apache.org/docs/r1.2.1/hdfs_user_guide.html) data. If one or more SSDs are attached, this runtime bulk data is spread across them, and the boot disk contains only basic config and installed binaries.
             */
            numLocalSsds?: pulumi.Input<number>;
        }
        /**
         * Encryption settings for the cluster.
         */
        interface EncryptionConfig {
            /**
             * Optional. The Cloud KMS key name to use for PD disk encryption for all instances in the cluster.
             */
            gcePdKmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Endpoint config for this cluster
         */
        interface EndpointConfig {
            /**
             * Optional. If true, enable http access to specific ports on the cluster from external sources. Defaults to false.
             */
            enableHttpPortAccess?: pulumi.Input<boolean>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Common config settings for resources of Compute Engine cluster instances, applicable to all instances in the cluster.
         */
        interface GceClusterConfig {
            /**
             * Optional. If true, all instances in the cluster will only have internal IP addresses. By default, clusters are not restricted to internal IP addresses, and will have ephemeral external IP addresses assigned to each instance. This internal_ip_only restriction can only be enabled for subnetwork enabled networks, and all off-cluster dependencies must be configured to be accessible without external IP addresses.
             */
            internalIpOnly?: pulumi.Input<boolean>;
            /**
             * The Compute Engine metadata entries to add to all instances (see Project and instance metadata (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork_uri. If neither network_uri nor subnetwork_uri is specified, the "default" network of the project is used, if it exists. Cannot be a "Custom Subnet Network" (see Using Subnetworks (https://cloud.google.com/compute/docs/subnetworks) for more information).A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/regions/global/default projects/[project_id]/regions/global/default default
             */
            networkUri?: pulumi.Input<string>;
            /**
             * Optional. Node Group Affinity for sole-tenant clusters.
             */
            nodeGroupAffinity?: pulumi.Input<inputs.dataproc.v1beta2.NodeGroupAffinity>;
            /**
             * Optional. The type of IPv6 access for a cluster.
             */
            privateIpv6GoogleAccess?: pulumi.Input<string>;
            /**
             * Optional. Reservation Affinity for consuming Zonal reservation.
             */
            reservationAffinity?: pulumi.Input<inputs.dataproc.v1beta2.ReservationAffinity>;
            /**
             * Optional. The Dataproc service account (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/service-accounts#service_accounts_in_dataproc) (also see VM Data Plane identity (https://cloud.google.com/dataproc/docs/concepts/iam/dataproc-principals#vm_service_account_data_plane_identity)) used by Dataproc cluster VM instances to access Google Cloud Platform services.If not specified, the Compute Engine default service account (https://cloud.google.com/compute/docs/access/service-accounts#default_service_account) is used.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Optional. The URIs of service account scopes to be included in Compute Engine instances. The following base set of scopes is always included: https://www.googleapis.com/auth/cloud.useraccounts.readonly https://www.googleapis.com/auth/devstorage.read_write https://www.googleapis.com/auth/logging.writeIf no scopes are specified, the following defaults are also provided: https://www.googleapis.com/auth/bigquery https://www.googleapis.com/auth/bigtable.admin.table https://www.googleapis.com/auth/bigtable.data https://www.googleapis.com/auth/devstorage.full_control
             */
            serviceAccountScopes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Shielded Instance Config for clusters using Compute Engine Shielded VMs (https://cloud.google.com/security/shielded-cloud/shielded-vm).
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.dataproc.v1beta2.ShieldedInstanceConfig>;
            /**
             * Optional. The Compute Engine subnetwork to be used for machine communications. Cannot be specified with network_uri.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/regions/us-east1/subnetworks/sub0 projects/[project_id]/regions/us-east1/subnetworks/sub0 sub0
             */
            subnetworkUri?: pulumi.Input<string>;
            /**
             * The Compute Engine tags to add to all instances (see Tagging instances (https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/[zone] projects/[project_id]/zones/[zone] us-central1-f
             */
            zoneUri?: pulumi.Input<string>;
        }
        /**
         * The GKE config for this cluster.
         */
        interface GkeClusterConfig {
            /**
             * Optional. A target for the deployment.
             */
            namespacedGkeDeploymentTarget?: pulumi.Input<inputs.dataproc.v1beta2.NamespacedGkeDeploymentTarget>;
        }
        /**
         * A Dataproc job for running Apache Hadoop MapReduce (https://hadoop.apache.org/docs/current/hadoop-mapreduce-client/hadoop-mapreduce-client-core/MapReduceTutorial.html) jobs on Apache Hadoop YARN (https://hadoop.apache.org/docs/r2.7.1/hadoop-yarn/hadoop-yarn-site/YARN.html).
         */
        interface HadoopJob {
            /**
             * Optional. HCFS URIs of archives to be extracted in the working directory of Hadoop drivers and tasks. Supported file types: .jar, .tar, .tar.gz, .tgz, or .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as -libjars or -Dfoo=bar, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS (Hadoop Compatible Filesystem) URIs of files to be copied to the working directory of Hadoop drivers and distributed tasks. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Jar file URIs to add to the CLASSPATHs of the Hadoop driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * The name of the driver's main class. The jar file containing the class must be in the default CLASSPATH or specified in jar_file_uris.
             */
            mainClass?: pulumi.Input<string>;
            /**
             * The HCFS URI of the jar file containing the main class. Examples: 'gs://foo-bucket/analytics-binaries/extract-useful-metrics-mr.jar' 'hdfs:/tmp/test-samples/custom-wordcount.jar' 'file:///home/usr/lib/hadoop-mapreduce/hadoop-mapreduce-examples.jar'
             */
            mainJarFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure Hadoop. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Hive (https://hive.apache.org/) queries on YARN.
         */
        interface HiveJob {
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATH of the Hive server and Hadoop MapReduce (MR) tasks. Can contain Hive SerDes and UDFs.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. A mapping of property names and values, used to configure Hive. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/hive/conf/hive-site.xml, and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains Hive queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1beta2.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Hive command: SET name="value";).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Configuration for the size bounds of an instance group, including its proportional size to other groups.
         */
        interface InstanceGroupAutoscalingPolicyConfig {
            /**
             * Optional. Maximum number of instances for this group. Required for primary workers. Note that by default, clusters will not use secondary workers. Required for secondary workers if the minimum secondary instances is set.Primary workers - Bounds: [min_instances, ). Required. Secondary workers - Bounds: [min_instances, ). Default: 0.
             */
            maxInstances?: pulumi.Input<number>;
            /**
             * Optional. Minimum number of instances for this group.Primary workers - Bounds: 2, max_instances. Default: 2. Secondary workers - Bounds: 0, max_instances. Default: 0.
             */
            minInstances?: pulumi.Input<number>;
            /**
             * Optional. Weight for the instance group, which is used to determine the fraction of total workers in the cluster from this instance group. For example, if primary workers have weight 2, and secondary workers have weight 1, the cluster will have approximately 2 primary workers for each secondary worker.The cluster may not reach the specified balance if constrained by min/max bounds or other autoscaling settings. For example, if max_instances for secondary workers is 0, then only primary workers will be added. The cluster can also be out of balance when created.If weight is not set on any instance group, the cluster will default to equal weight for all groups: the cluster will attempt to maintain an equal number of workers in each group within the configured size bounds for each group. If weight is set for one group only, the cluster will default to zero weight on the unset group. For example if weight is set only on primary workers, the cluster will use primary workers only and no secondary workers.
             */
            weight?: pulumi.Input<number>;
        }
        /**
         * The config settings for Compute Engine resources in an instance group, such as a master or worker group.
         */
        interface InstanceGroupConfig {
            /**
             * Optional. The Compute Engine accelerator configuration for these instances.
             */
            accelerators?: pulumi.Input<pulumi.Input<inputs.dataproc.v1beta2.AcceleratorConfig>[]>;
            /**
             * Optional. Disk option config settings.
             */
            diskConfig?: pulumi.Input<inputs.dataproc.v1beta2.DiskConfig>;
            /**
             * Optional. The Compute Engine image resource used for cluster instances.The URI can represent an image or image family.Image examples: https://www.googleapis.com/compute/beta/projects/[project_id]/global/images/[image-id] projects/[project_id]/global/images/[image-id] image-idImage family examples. Dataproc will use the most recent image from the family: https://www.googleapis.com/compute/beta/projects/[project_id]/global/images/family/[custom-image-family-name] projects/[project_id]/global/images/family/[custom-image-family-name]If the URI is unspecified, it will be inferred from SoftwareConfig.image_version or the system default.
             */
            imageUri?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine machine type used for cluster instances.A full URL, partial URI, or short name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/us-east1-a/machineTypes/n1-standard-2 projects/[project_id]/zones/us-east1-a/machineTypes/n1-standard-2 n1-standard-2Auto Zone Exception: If you are using the Dataproc Auto Zone Placement (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the machine type resource, for example, n1-standard-2.
             */
            machineTypeUri?: pulumi.Input<string>;
            /**
             * Specifies the minimum cpu platform for the Instance Group. See Dataproc -> Minimum CPU Platform (https://cloud.google.com/dataproc/docs/concepts/compute/dataproc-min-cpu).
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Optional. The number of VM instances in the instance group. For HA cluster master_config groups, must be set to 3. For standard cluster master_config groups, must be set to 1.
             */
            numInstances?: pulumi.Input<number>;
            /**
             * Optional. Specifies the preemptibility of the instance group.The default value for master and worker groups is NON_PREEMPTIBLE. This default cannot be changed.The default value for secondary instances is PREEMPTIBLE.
             */
            preemptibility?: pulumi.Input<string>;
        }
        /**
         * Job scheduling options.
         */
        interface JobScheduling {
            /**
             * Optional. Maximum number of times per hour a driver may be restarted as a result of driver terminating with non-zero code before job is reported failed.A job may be reported as thrashing if driver exits with non-zero code 4 times within 10 minute window.Maximum value is 10.
             */
            maxFailuresPerHour?: pulumi.Input<number>;
            /**
             * Optional. Maximum number of times in total a driver may be restarted as a result of driver exiting with non-zero code before job is reported failed. Maximum value is 240.
             */
            maxFailuresTotal?: pulumi.Input<number>;
        }
        /**
         * Specifies Kerberos related configuration.
         */
        interface KerberosConfig {
            /**
             * Optional. The admin server (IP or hostname) for the remote trusted realm in a cross realm trust relationship.
             */
            crossRealmTrustAdminServer?: pulumi.Input<string>;
            /**
             * Optional. The KDC (IP or hostname) for the remote trusted realm in a cross realm trust relationship.
             */
            crossRealmTrustKdc?: pulumi.Input<string>;
            /**
             * Optional. The remote realm the Dataproc on-cluster KDC will trust, should the user enable cross realm trust.
             */
            crossRealmTrustRealm?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the shared password between the on-cluster Kerberos realm and the remote trusted realm, in a cross realm trust relationship.
             */
            crossRealmTrustSharedPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. Flag to indicate whether to Kerberize the cluster (default: false). Set this field to true to enable Kerberos on a cluster.
             */
            enableKerberos?: pulumi.Input<boolean>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the master key of the KDC database.
             */
            kdcDbKeyUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided key. For the self-signed certificate, this password is generated by Dataproc.
             */
            keyPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided keystore. For the self-signed certificate, this password is generated by Dataproc.
             */
            keystorePasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of the keystore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.
             */
            keystoreUri?: pulumi.Input<string>;
            /**
             * Optional. The uri of the KMS key used to encrypt various sensitive files.
             */
            kmsKeyUri?: pulumi.Input<string>;
            /**
             * Optional. The name of the on-cluster Kerberos realm. If not specified, the uppercased domain of hostnames will be the realm.
             */
            realm?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the root principal password.
             */
            rootPrincipalPasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The lifetime of the ticket granting ticket, in hours. If not specified, or user specifies 0, then default value 10 will be used.
             */
            tgtLifetimeHours?: pulumi.Input<number>;
            /**
             * Optional. The Cloud Storage URI of a KMS encrypted file containing the password to the user provided truststore. For the self-signed certificate, this password is generated by Dataproc.
             */
            truststorePasswordUri?: pulumi.Input<string>;
            /**
             * Optional. The Cloud Storage URI of the truststore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.
             */
            truststoreUri?: pulumi.Input<string>;
        }
        /**
         * Specifies the cluster auto-delete schedule configuration.
         */
        interface LifecycleConfig {
            /**
             * Optional. The time when cluster will be auto-deleted. (see JSON representation of Timestamp (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            autoDeleteTime?: pulumi.Input<string>;
            /**
             * Optional. The lifetime duration of cluster. The cluster will be auto-deleted at the end of this period. Minimum value is 10 minutes; maximum value is 14 days (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            autoDeleteTtl?: pulumi.Input<string>;
            /**
             * Optional. The duration to keep the cluster alive while idling (when no jobs are running). Passing this threshold will cause the cluster to be deleted. Minimum value is 5 minutes; maximum value is 14 days (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).
             */
            idleDeleteTtl?: pulumi.Input<string>;
        }
        /**
         * The runtime logging config of the job.
         */
        interface LoggingConfig {
            /**
             * The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
             */
            driverLogLevels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Cluster that is managed by the workflow.
         */
        interface ManagedCluster {
            /**
             * Required. The cluster name prefix. A unique cluster name will be formed by appending a random suffix.The name must contain only lower-case letters (a-z), numbers (0-9), and hyphens (-). Must begin with a letter. Cannot begin or end with hyphen. Must consist of between 2 and 35 characters.
             */
            clusterName?: pulumi.Input<string>;
            /**
             * Required. The cluster configuration.
             */
            config?: pulumi.Input<inputs.dataproc.v1beta2.ClusterConfig>;
            /**
             * Optional. The labels to associate with this cluster.Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}{0,62}Label values must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}\p{N}_-{0,63}No more than 32 labels can be associated with a given cluster.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Specifies a Metastore configuration.
         */
        interface MetastoreConfig {
            /**
             * Required. Resource name of an existing Dataproc Metastore service.Example: projects/[project_id]/locations/[dataproc_region]/services/[service-name]
             */
            dataprocMetastoreService?: pulumi.Input<string>;
        }
        /**
         * A full, namespace-isolated deployment target for an existing GKE cluster.
         */
        interface NamespacedGkeDeploymentTarget {
            /**
             * Optional. A namespace within the GKE cluster to deploy into.
             */
            clusterNamespace?: pulumi.Input<string>;
            /**
             * Optional. The target GKE cluster to deploy to. Format: 'projects/{project}/locations/{location}/clusters/{cluster_id}'
             */
            targetGkeCluster?: pulumi.Input<string>;
        }
        /**
         * Node Group Affinity for clusters using sole-tenant node groups.
         */
        interface NodeGroupAffinity {
            /**
             * Required. The URI of a sole-tenant node group resource (https://cloud.google.com/compute/docs/reference/rest/v1/nodeGroups) that the cluster will be created on.A full URL, partial URI, or node group name are valid. Examples: https://www.googleapis.com/compute/v1/projects/[project_id]/zones/us-central1-a/nodeGroups/node-group-1 projects/[project_id]/zones/us-central1-a/nodeGroups/node-group-1 node-group-1
             */
            nodeGroupUri?: pulumi.Input<string>;
        }
        /**
         * Specifies an executable to run on a fully configured node and a timeout period for executable completion.
         */
        interface NodeInitializationAction {
            /**
             * Required. Cloud Storage URI of executable file.
             */
            executableFile?: pulumi.Input<string>;
            /**
             * Optional. Amount of time executable has to complete. Default is 10 minutes (see JSON representation of Duration (https://developers.google.com/protocol-buffers/docs/proto3#json)).Cluster creation fails with an explanatory error message (the name of the executable that caused the error and the exceeded timeout period) if the executable is not completed at end of the timeout period.
             */
            executionTimeout?: pulumi.Input<string>;
        }
        /**
         * A job executed by the workflow.
         */
        interface OrderedJob {
            /**
             * Optional. Job is a Hadoop job.
             */
            hadoopJob?: pulumi.Input<inputs.dataproc.v1beta2.HadoopJob>;
            /**
             * Optional. Job is a Hive job.
             */
            hiveJob?: pulumi.Input<inputs.dataproc.v1beta2.HiveJob>;
            /**
             * Optional. The labels to associate with this job.Label keys must be between 1 and 63 characters long, and must conform to the following regular expression: \p{Ll}\p{Lo}{0,62}Label values must be between 1 and 63 characters long, and must conform to the following regular expression: \p{Ll}\p{Lo}\p{N}_-{0,63}No more than 32 labels can be associated with a given job.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Job is a Pig job.
             */
            pigJob?: pulumi.Input<inputs.dataproc.v1beta2.PigJob>;
            /**
             * Optional. The optional list of prerequisite job step_ids. If not specified, the job will start at the beginning of workflow.
             */
            prerequisiteStepIds?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Job is a Presto job.
             */
            prestoJob?: pulumi.Input<inputs.dataproc.v1beta2.PrestoJob>;
            /**
             * Optional. Job is a PySpark job.
             */
            pysparkJob?: pulumi.Input<inputs.dataproc.v1beta2.PySparkJob>;
            /**
             * Optional. Job scheduling configuration.
             */
            scheduling?: pulumi.Input<inputs.dataproc.v1beta2.JobScheduling>;
            /**
             * Optional. Job is a Spark job.
             */
            sparkJob?: pulumi.Input<inputs.dataproc.v1beta2.SparkJob>;
            /**
             * Optional. Job is a SparkR job.
             */
            sparkRJob?: pulumi.Input<inputs.dataproc.v1beta2.SparkRJob>;
            /**
             * Optional. Job is a SparkSql job.
             */
            sparkSqlJob?: pulumi.Input<inputs.dataproc.v1beta2.SparkSqlJob>;
            /**
             * Required. The step id. The id must be unique among all jobs within the template.The step id is used as prefix for job id, as job goog-dataproc-workflow-step-id label, and in prerequisiteStepIds field from other steps.The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), and hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between 3 and 50 characters.
             */
            stepId?: pulumi.Input<string>;
        }
        /**
         * Configuration for parameter validation.
         */
        interface ParameterValidation {
            /**
             * Validation based on regular expressions.
             */
            regex?: pulumi.Input<inputs.dataproc.v1beta2.RegexValidation>;
            /**
             * Validation based on a list of allowed values.
             */
            values?: pulumi.Input<inputs.dataproc.v1beta2.ValueValidation>;
        }
        /**
         * A Dataproc job for running Apache Pig (https://pig.apache.org/) queries on YARN.
         */
        interface PigJob {
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATH of the Pig Client and Hadoop MapReduce (MR) tasks. Can contain Pig UDFs.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * Optional. A mapping of property names to values, used to configure Pig. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/pig/conf/pig.properties, and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains the Pig queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1beta2.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Pig command: name=[value]).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Presto (https://prestosql.io/) queries. IMPORTANT: The Dataproc Presto Optional Component (https://cloud.google.com/dataproc/docs/concepts/components/presto) must be enabled when the cluster is created to submit a Presto job to the cluster.
         */
        interface PrestoJob {
            /**
             * Optional. Presto client tags to attach to this query
             */
            clientTags?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Whether to continue executing queries if a query fails. The default value is false. Setting to true can be useful when executing independent parallel queries.
             */
            continueOnFailure?: pulumi.Input<boolean>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * Optional. The format in which query output will be displayed. See the Presto documentation for supported output formats
             */
            outputFormat?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values. Used to set Presto session properties (https://prestodb.io/docs/current/sql/set-session.html) Equivalent to using the --session flag in the Presto CLI
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains SQL queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1beta2.QueryList>;
        }
        /**
         * A Dataproc job for running Apache PySpark (https://spark.apache.org/docs/0.9.0/python-programming-guide.html) applications on YARN.
         */
        interface PySparkJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATHs of the Python driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * Required. The HCFS URI of the main Python file to use as the driver. Must be a .py file.
             */
            mainPythonFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure PySpark. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
             */
            pythonFileUris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A list of queries to run on a cluster.
         */
        interface QueryList {
            /**
             * Required. The queries to execute. You do not need to end a query expression with a semicolon. Multiple queries can be specified in one string by separating each with a semicolon. Here is an example of a Dataproc API snippet that uses a QueryList to specify a HiveJob: "hiveJob": { "queryList": { "queries": [ "query1", "query2", "query3;query4", ] } }
             */
            queries?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Validation based on regular expressions.
         */
        interface RegexValidation {
            /**
             * Required. RE2 regular expressions used to validate the parameter's value. The value must match the regex in its entirety (substring matches are not sufficient).
             */
            regexes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Reservation Affinity for consuming Zonal reservation.
         */
        interface ReservationAffinity {
            /**
             * Optional. Type of reservation to consume
             */
            consumeReservationType?: pulumi.Input<string>;
            /**
             * Optional. Corresponds to the label key of reservation resource.
             */
            key?: pulumi.Input<string>;
            /**
             * Optional. Corresponds to the label values of reservation resource.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Security related configuration, including encryption, Kerberos, etc.
         */
        interface SecurityConfig {
            /**
             * Optional. Kerberos related configuration.
             */
            kerberosConfig?: pulumi.Input<inputs.dataproc.v1beta2.KerberosConfig>;
        }
        /**
         * Shielded Instance Config for clusters using Compute Engine Shielded VMs (https://cloud.google.com/security/shielded-cloud/shielded-vm).
         */
        interface ShieldedInstanceConfig {
            /**
             * Optional. Defines whether instances have integrity monitoring enabled.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Optional. Defines whether instances have Secure Boot enabled.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Optional. Defines whether instances have the vTPM enabled.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * Specifies the selection and config of software inside the cluster.
         */
        interface SoftwareConfig {
            /**
             * Optional. The version of software inside the cluster. It must be one of the supported Dataproc Versions (https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#supported_dataproc_versions), such as "1.2" (including a subminor version, such as "1.2.29"), or the "preview" version (https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#other_versions). If unspecified, it defaults to the latest Debian version.
             */
            imageVersion?: pulumi.Input<string>;
            /**
             * The set of optional components to activate on the cluster.
             */
            optionalComponents?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The properties to set on daemon config files.Property keys are specified in prefix:property format, for example core:hadoop.tmp.dir. The following are supported prefixes and their mappings: capacity-scheduler: capacity-scheduler.xml core: core-site.xml distcp: distcp-default.xml hdfs: hdfs-site.xml hive: hive-site.xml mapred: mapred-site.xml pig: pig.properties spark: spark-defaults.conf yarn: yarn-site.xmlFor more information, see Cluster properties (https://cloud.google.com/dataproc/docs/concepts/cluster-properties).
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Spark (http://spark.apache.org/) applications on YARN. The specification of the main method to call to drive the job. Specify either the jar file that contains the main class or the main class name. To pass both a main jar and a main class in that jar, add the jar to CommonJob.jar_file_uris, and then specify the main class name in main_class.
         */
        interface SparkJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of jar files to add to the CLASSPATHs of the Spark driver and tasks.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * The name of the driver's main class. The jar file that contains the class must be in the default CLASSPATH or specified in jar_file_uris.
             */
            mainClass?: pulumi.Input<string>;
            /**
             * The HCFS URI of the jar file that contains the main class.
             */
            mainJarFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure Spark. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache SparkR (https://spark.apache.org/docs/latest/sparkr.html) applications on YARN.
         */
        interface SparkRJob {
            /**
             * Optional. HCFS URIs of archives to be extracted into the working directory of each executor. Supported file types: .jar, .tar, .tar.gz, .tgz, and .zip.
             */
            archiveUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The arguments to pass to the driver. Do not include arguments, such as --conf, that can be set as job properties, since a collision may occur that causes an incorrect job submission.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. HCFS URIs of files to be placed in the working directory of each executor. Useful for naively parallel tasks.
             */
            fileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * Required. The HCFS URI of the main R file to use as the driver. Must be a .R file.
             */
            mainRFileUri?: pulumi.Input<string>;
            /**
             * Optional. A mapping of property names to values, used to configure SparkR. Properties that conflict with values set by the Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A Dataproc job for running Apache Spark SQL (http://spark.apache.org/sql/) queries.
         */
        interface SparkSqlJob {
            /**
             * Optional. HCFS URIs of jar files to be added to the Spark CLASSPATH.
             */
            jarFileUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The runtime log config for job execution.
             */
            loggingConfig?: pulumi.Input<inputs.dataproc.v1beta2.LoggingConfig>;
            /**
             * Optional. A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
             */
            properties?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The HCFS URI of the script that contains SQL queries.
             */
            queryFileUri?: pulumi.Input<string>;
            /**
             * A list of queries.
             */
            queryList?: pulumi.Input<inputs.dataproc.v1beta2.QueryList>;
            /**
             * Optional. Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
             */
            scriptVariables?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A configurable parameter that replaces one or more fields in the template. Parameterizable fields: - Labels - File uris - Job properties - Job arguments - Script variables - Main class (in HadoopJob and SparkJob) - Zone (in ClusterSelector)
         */
        interface TemplateParameter {
            /**
             * Optional. Brief description of the parameter. Must not exceed 1024 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. Paths to all fields that the parameter replaces. A field is allowed to appear in at most one parameter's list of field paths.A field path is similar in syntax to a google.protobuf.FieldMask. For example, a field path that references the zone field of a workflow template's cluster selector would be specified as placement.clusterSelector.zone.Also, field paths can reference fields using the following syntax: Values in maps can be referenced by key: labels'key' placement.clusterSelector.clusterLabels'key' placement.managedCluster.labels'key' placement.clusterSelector.clusterLabels'key' jobs'step-id'.labels'key' Jobs in the jobs list can be referenced by step-id: jobs'step-id'.hadoopJob.mainJarFileUri jobs'step-id'.hiveJob.queryFileUri jobs'step-id'.pySparkJob.mainPythonFileUri jobs'step-id'.hadoopJob.jarFileUris0 jobs'step-id'.hadoopJob.archiveUris0 jobs'step-id'.hadoopJob.fileUris0 jobs'step-id'.pySparkJob.pythonFileUris0 Items in repeated fields can be referenced by a zero-based index: jobs'step-id'.sparkJob.args0 Other examples: jobs'step-id'.hadoopJob.properties'key' jobs'step-id'.hadoopJob.args0 jobs'step-id'.hiveJob.scriptVariables'key' jobs'step-id'.hadoopJob.mainJarFileUri placement.clusterSelector.zoneIt may not be possible to parameterize maps and repeated fields in their entirety since only individual map values and individual items in repeated fields can be referenced. For example, the following field paths are invalid: placement.clusterSelector.clusterLabels jobs'step-id'.sparkJob.args
             */
            fields?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. Parameter name. The parameter name is used as the key, and paired with the parameter value, which are passed to the template when the template is instantiated. The name must contain only capital letters (A-Z), numbers (0-9), and underscores (_), and must not start with a number. The maximum length is 40 characters.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. Validation rules to be applied to this parameter's value.
             */
            validation?: pulumi.Input<inputs.dataproc.v1beta2.ParameterValidation>;
        }
        /**
         * Validation based on a list of allowed values.
         */
        interface ValueValidation {
            /**
             * Required. List of allowed values for the parameter.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Specifies workflow execution target.Either managed_cluster or cluster_selector is required.
         */
        interface WorkflowTemplatePlacement {
            /**
             * Optional. A selector that chooses target cluster for jobs based on metadata.The selector is evaluated at the time each job is submitted.
             */
            clusterSelector?: pulumi.Input<inputs.dataproc.v1beta2.ClusterSelector>;
            /**
             * Optional. A cluster that is managed by the workflow.
             */
            managedCluster?: pulumi.Input<inputs.dataproc.v1beta2.ManagedCluster>;
        }
    }
}
export declare namespace datastore {
    namespace v1 {
        /**
         * A property of an index.
         */
        interface GoogleDatastoreAdminV1IndexedProperty {
            /**
             * Required. The indexed property's direction. Must not be DIRECTION_UNSPECIFIED.
             */
            direction?: pulumi.Input<string>;
            /**
             * Required. The property name to index.
             */
            name?: pulumi.Input<string>;
        }
    }
}
export declare namespace deploymentmanager {
    namespace alpha {
        /**
         * Async options that determine when a resource should finish.
         */
        interface AsyncOptions {
            /**
             * Method regex where this policy will apply.
             */
            methodMatch?: pulumi.Input<string>;
            /**
             * Deployment manager will poll instances for this API resource setting a RUNNING state, and blocking until polling conditions tell whether the resource is completed or failed.
             */
            pollingOptions?: pulumi.Input<inputs.deploymentmanager.alpha.PollingOptions>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Basic Auth used as a credential.
         */
        interface BasicAuth {
            password?: pulumi.Input<string>;
            user?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.deploymentmanager.alpha.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * CollectionOverride allows resource handling overrides for specific resources within a BaseType
         */
        interface CollectionOverride {
            /**
             * The collection that identifies this resource within its service.
             */
            collection?: pulumi.Input<string>;
            /**
             * Custom verb method mappings to support unordered list API mappings.
             */
            methodMap?: pulumi.Input<inputs.deploymentmanager.alpha.MethodMap>;
            /**
             * The options to apply to this resource-level override
             */
            options?: pulumi.Input<inputs.deploymentmanager.alpha.Options>;
        }
        /**
         * Label object for CompositeTypes
         */
        interface CompositeTypeLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface ConfigFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
        }
        /**
         * The credential used by Deployment Manager and TypeProvider. Only one of the options is permitted.
         */
        interface Credential {
            /**
             * Basic Auth Credential, only used by TypeProvider.
             */
            basicAuth?: pulumi.Input<inputs.deploymentmanager.alpha.BasicAuth>;
            /**
             * Service Account Credential, only used by Deployment.
             */
            serviceAccount?: pulumi.Input<inputs.deploymentmanager.alpha.ServiceAccount>;
            /**
             * Specify to use the project default credential, only supported by Deployment.
             */
            useProjectDefault?: pulumi.Input<boolean>;
        }
        /**
         * Label object for Deployments
         */
        interface DeploymentLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Output object for Deployments
         */
        interface DeploymentOutputEntry {
            /**
             * Key of the output
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface DeploymentUpdate {
            /**
             * The user-provided default credential to use when deploying this preview.
             */
            credential?: pulumi.Input<inputs.deploymentmanager.alpha.Credential>;
            /**
             * An optional user-provided description of the deployment after the current update has been applied.
             */
            description?: pulumi.Input<string>;
            /**
             * Map of One Platform labels; provided by the client when the resource is created or updated. Specifically: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?` Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.DeploymentUpdateLabelEntry>[]>;
            /**
             * URL of the manifest representing the update configuration of this deployment.
             */
            manifest?: pulumi.Input<string>;
        }
        /**
         * Label object for DeploymentUpdate
         */
        interface DeploymentUpdateLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface Diagnostic {
            /**
             * JsonPath expression on the resource that if non empty, indicates that this field needs to be extracted as a diagnostic.
             */
            field?: pulumi.Input<string>;
            /**
             * Level to record this diagnostic.
             */
            level?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        interface ImportFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
            /**
             * The name of the file.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * InputMapping creates a 'virtual' property that will be injected into the properties before sending the request to the underlying API.
         */
        interface InputMapping {
            /**
             * The name of the field that is going to be injected.
             */
            fieldName?: pulumi.Input<string>;
            /**
             * The location where this mapping applies.
             */
            location?: pulumi.Input<string>;
            /**
             * Regex to evaluate on method to decide if input applies.
             */
            methodMatch?: pulumi.Input<string>;
            /**
             * A jsonPath expression to select an element.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Deployment Manager will call these methods during the events of creation/deletion/update/get/setIamPolicy
         */
        interface MethodMap {
            /**
             * The action identifier for the create method to be used for this collection
             */
            create?: pulumi.Input<string>;
            /**
             * The action identifier for the delete method to be used for this collection
             */
            delete?: pulumi.Input<string>;
            /**
             * The action identifier for the get method to be used for this collection
             */
            get?: pulumi.Input<string>;
            /**
             * The action identifier for the setIamPolicy method to be used for this collection
             */
            setIamPolicy?: pulumi.Input<string>;
            /**
             * The action identifier for the update method to be used for this collection
             */
            update?: pulumi.Input<string>;
        }
        /**
         * Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/{$api_version}/globalOperations) * [Regional](/compute/docs/reference/rest/{$api_version}/regionOperations) * [Zonal](/compute/docs/reference/rest/{$api_version}/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
         */
        interface Operation {
            /**
             * [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
             */
            clientOperationId?: pulumi.Input<string>;
            /**
             * [Deprecated] This field is deprecated.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * [Output Only] A textual description of the operation, which is set when the operation is created.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
             */
            endTime?: pulumi.Input<string>;
            /**
             * [Output Only] If errors are generated during processing of the operation, this field will be populated.
             */
            error?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
             */
            httpErrorMessage?: pulumi.Input<string>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
             */
            httpErrorStatusCode?: pulumi.Input<number>;
            /**
             * [Output Only] The unique identifier for the operation. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
             */
            insertTime?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Name of the operation.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
             */
            operationGroupId?: pulumi.Input<string>;
            /**
             * [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
             */
            operationType?: pulumi.Input<string>;
            /**
             * [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
             */
            progress?: pulumi.Input<number>;
            /**
             * [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] Server-defined URL for the resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
             */
            startTime?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
             */
            status?: pulumi.Input<string>;
            /**
             * [Output Only] An optional textual description of the current status of the operation.
             */
            statusMessage?: pulumi.Input<string>;
            /**
             * [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
             */
            targetId?: pulumi.Input<string>;
            /**
             * [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
             */
            targetLink?: pulumi.Input<string>;
            /**
             * [Output Only] User who requested the operation, for example: `user@example.com`.
             */
            user?: pulumi.Input<string>;
            /**
             * [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
             */
            warnings?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Options allows customized resource handling by Deployment Manager.
         */
        interface Options {
            /**
             * Options regarding how to thread async requests.
             */
            asyncOptions?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.AsyncOptions>[]>;
            /**
             * The mappings that apply for requests.
             */
            inputMappings?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.InputMapping>[]>;
            /**
             * The json path to the field in the resource JSON body into which the resource name should be mapped. Leaving this empty indicates that there should be no mapping performed.
             */
            nameProperty?: pulumi.Input<string>;
            /**
             * Options for how to validate and process properties on a resource.
             */
            validationOptions?: pulumi.Input<inputs.deploymentmanager.alpha.ValidationOptions>;
        }
        interface PollingOptions {
            /**
             * An array of diagnostics to be collected by Deployment Manager, these diagnostics will be displayed to the user.
             */
            diagnostics?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.Diagnostic>[]>;
            /**
             * JsonPath expression that determines if the request failed.
             */
            failCondition?: pulumi.Input<string>;
            /**
             * JsonPath expression that determines if the request is completed.
             */
            finishCondition?: pulumi.Input<string>;
            /**
             * JsonPath expression that evaluates to string, it indicates where to poll.
             */
            pollingLink?: pulumi.Input<string>;
            /**
             * JsonPath expression, after polling is completed, indicates where to fetch the resource.
             */
            targetLink?: pulumi.Input<string>;
        }
        /**
         * Service Account used as a credential.
         */
        interface ServiceAccount {
            /**
             * The IAM service account email address like test@myproject.iam.gserviceaccount.com
             */
            email?: pulumi.Input<string>;
        }
        interface TargetConfiguration {
            /**
             * The configuration to use for this deployment.
             */
            config?: pulumi.Input<inputs.deploymentmanager.alpha.ConfigFile>;
            /**
             * Specifies any files to import for this configuration. This can be used to import templates or other files. For example, you might import a text file in order to use the file in a template.
             */
            imports?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.ImportFile>[]>;
        }
        /**
         * Files that make up the template contents of a template type.
         */
        interface TemplateContents {
            /**
             * Import files referenced by the main template.
             */
            imports?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.alpha.ImportFile>[]>;
            /**
             * Which interpreter (python or jinja) should be used during expansion.
             */
            interpreter?: pulumi.Input<string>;
            /**
             * The filename of the mainTemplate
             */
            mainTemplate?: pulumi.Input<string>;
            /**
             * The contents of the template schema.
             */
            schema?: pulumi.Input<string>;
            /**
             * The contents of the main template file.
             */
            template?: pulumi.Input<string>;
        }
        /**
         * Label object for TypeProviders
         */
        interface TypeProviderLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Options for how to validate and process properties on a resource.
         */
        interface ValidationOptions {
            /**
             * Customize how deployment manager will validate the resource against schema errors.
             */
            schemaValidation?: pulumi.Input<string>;
            /**
             * Specify what to do with extra properties when executing a request.
             */
            undeclaredProperties?: pulumi.Input<string>;
        }
    }
    namespace v2 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.deploymentmanager.v2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        interface ConfigFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
        }
        /**
         * Label object for Deployments
         */
        interface DeploymentLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface DeploymentUpdate {
            /**
             * An optional user-provided description of the deployment after the current update has been applied.
             */
            description?: pulumi.Input<string>;
            /**
             * Map of One Platform labels; provided by the client when the resource is created or updated. Specifically: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?` Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2.DeploymentUpdateLabelEntry>[]>;
            /**
             * URL of the manifest representing the update configuration of this deployment.
             */
            manifest?: pulumi.Input<string>;
        }
        /**
         * Label object for DeploymentUpdate
         */
        interface DeploymentUpdateLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        interface ImportFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
            /**
             * The name of the file.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/{$api_version}/globalOperations) * [Regional](/compute/docs/reference/rest/{$api_version}/regionOperations) * [Zonal](/compute/docs/reference/rest/{$api_version}/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
         */
        interface Operation {
            /**
             * [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
             */
            clientOperationId?: pulumi.Input<string>;
            /**
             * [Deprecated] This field is deprecated.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * [Output Only] A textual description of the operation, which is set when the operation is created.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
             */
            endTime?: pulumi.Input<string>;
            /**
             * [Output Only] If errors are generated during processing of the operation, this field will be populated.
             */
            error?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
             */
            httpErrorMessage?: pulumi.Input<string>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
             */
            httpErrorStatusCode?: pulumi.Input<number>;
            /**
             * [Output Only] The unique identifier for the operation. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
             */
            insertTime?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Name of the operation.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
             */
            operationGroupId?: pulumi.Input<string>;
            /**
             * [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
             */
            operationType?: pulumi.Input<string>;
            /**
             * [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
             */
            progress?: pulumi.Input<number>;
            /**
             * [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] Server-defined URL for the resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
             */
            startTime?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
             */
            status?: pulumi.Input<string>;
            /**
             * [Output Only] An optional textual description of the current status of the operation.
             */
            statusMessage?: pulumi.Input<string>;
            /**
             * [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
             */
            targetId?: pulumi.Input<string>;
            /**
             * [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
             */
            targetLink?: pulumi.Input<string>;
            /**
             * [Output Only] User who requested the operation, for example: `user@example.com`.
             */
            user?: pulumi.Input<string>;
            /**
             * [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
             */
            warnings?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
             */
            zone?: pulumi.Input<string>;
        }
        interface TargetConfiguration {
            /**
             * The configuration to use for this deployment.
             */
            config?: pulumi.Input<inputs.deploymentmanager.v2.ConfigFile>;
            /**
             * Specifies any files to import for this configuration. This can be used to import templates or other files. For example, you might import a text file in order to use the file in a template.
             */
            imports?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2.ImportFile>[]>;
        }
    }
    namespace v2beta {
        /**
         * Async options that determine when a resource should finish.
         */
        interface AsyncOptions {
            /**
             * Method regex where this policy will apply.
             */
            methodMatch?: pulumi.Input<string>;
            /**
             * Deployment manager will poll instances for this API resource setting a RUNNING state, and blocking until polling conditions tell whether the resource is completed or failed.
             */
            pollingOptions?: pulumi.Input<inputs.deploymentmanager.v2beta.PollingOptions>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Basic Auth used as a credential.
         */
        interface BasicAuth {
            password?: pulumi.Input<string>;
            user?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.deploymentmanager.v2beta.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * CollectionOverride allows resource handling overrides for specific resources within a BaseType
         */
        interface CollectionOverride {
            /**
             * The collection that identifies this resource within its service.
             */
            collection?: pulumi.Input<string>;
            /**
             * The options to apply to this resource-level override
             */
            options?: pulumi.Input<inputs.deploymentmanager.v2beta.Options>;
        }
        /**
         * Label object for CompositeTypes
         */
        interface CompositeTypeLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface ConfigFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
        }
        /**
         * The credential used by Deployment Manager and TypeProvider. Only one of the options is permitted.
         */
        interface Credential {
            /**
             * Basic Auth Credential, only used by TypeProvider.
             */
            basicAuth?: pulumi.Input<inputs.deploymentmanager.v2beta.BasicAuth>;
            /**
             * Service Account Credential, only used by Deployment.
             */
            serviceAccount?: pulumi.Input<inputs.deploymentmanager.v2beta.ServiceAccount>;
            /**
             * Specify to use the project default credential, only supported by Deployment.
             */
            useProjectDefault?: pulumi.Input<boolean>;
        }
        /**
         * Label object for Deployments
         */
        interface DeploymentLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface DeploymentUpdate {
            /**
             * An optional user-provided description of the deployment after the current update has been applied.
             */
            description?: pulumi.Input<string>;
            /**
             * Map of One Platform labels; provided by the client when the resource is created or updated. Specifically: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?` Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.DeploymentUpdateLabelEntry>[]>;
            /**
             * URL of the manifest representing the update configuration of this deployment.
             */
            manifest?: pulumi.Input<string>;
        }
        /**
         * Label object for DeploymentUpdate
         */
        interface DeploymentUpdateLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        interface Diagnostic {
            /**
             * JsonPath expression on the resource that if non empty, indicates that this field needs to be extracted as a diagnostic.
             */
            field?: pulumi.Input<string>;
            /**
             * Level to record this diagnostic.
             */
            level?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        interface ImportFile {
            /**
             * The contents of the file.
             */
            content?: pulumi.Input<string>;
            /**
             * The name of the file.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * InputMapping creates a 'virtual' property that will be injected into the properties before sending the request to the underlying API.
         */
        interface InputMapping {
            /**
             * The name of the field that is going to be injected.
             */
            fieldName?: pulumi.Input<string>;
            /**
             * The location where this mapping applies.
             */
            location?: pulumi.Input<string>;
            /**
             * Regex to evaluate on method to decide if input applies.
             */
            methodMatch?: pulumi.Input<string>;
            /**
             * A jsonPath expression to select an element.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Represents an Operation resource. Google Compute Engine has three Operation resources: * [Global](/compute/docs/reference/rest/{$api_version}/globalOperations) * [Regional](/compute/docs/reference/rest/{$api_version}/regionOperations) * [Zonal](/compute/docs/reference/rest/{$api_version}/zoneOperations) You can use an operation resource to manage asynchronous API requests. For more information, read Handling API responses. Operations can be global, regional or zonal. - For global operations, use the `globalOperations` resource. - For regional operations, use the `regionOperations` resource. - For zonal operations, use the `zonalOperations` resource. For more information, read Global, Regional, and Zonal Resources.
         */
        interface Operation {
            /**
             * [Output Only] The value of `requestId` if you provided it in the request. Not present otherwise.
             */
            clientOperationId?: pulumi.Input<string>;
            /**
             * [Deprecated] This field is deprecated.
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * [Output Only] A textual description of the operation, which is set when the operation is created.
             */
            description?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was completed. This value is in RFC3339 text format.
             */
            endTime?: pulumi.Input<string>;
            /**
             * [Output Only] If errors are generated during processing of the operation, this field will be populated.
             */
            error?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error message that was returned, such as `NOT FOUND`.
             */
            httpErrorMessage?: pulumi.Input<string>;
            /**
             * [Output Only] If the operation fails, this field contains the HTTP error status code that was returned. For example, a `404` means the resource was not found.
             */
            httpErrorStatusCode?: pulumi.Input<number>;
            /**
             * [Output Only] The unique identifier for the operation. This identifier is defined by the server.
             */
            id?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was requested. This value is in RFC3339 text format.
             */
            insertTime?: pulumi.Input<string>;
            /**
             * [Output Only] Type of the resource. Always `compute#operation` for Operation resources.
             */
            kind?: pulumi.Input<string>;
            /**
             * [Output Only] Name of the operation.
             */
            name?: pulumi.Input<string>;
            /**
             * [Output Only] An ID that represents a group of operations, such as when a group of operations results from a `bulkInsert` API request.
             */
            operationGroupId?: pulumi.Input<string>;
            /**
             * [Output Only] The type of operation, such as `insert`, `update`, or `delete`, and so on.
             */
            operationType?: pulumi.Input<string>;
            /**
             * [Output Only] An optional progress indicator that ranges from 0 to 100. There is no requirement that this be linear or support any granularity of operations. This should not be used to guess when the operation will be complete. This number should monotonically increase as the operation progresses.
             */
            progress?: pulumi.Input<number>;
            /**
             * [Output Only] The URL of the region where the operation resides. Only applicable when performing regional operations.
             */
            region?: pulumi.Input<string>;
            /**
             * [Output Only] Server-defined URL for the resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * [Output Only] The time that this operation was started by the server. This value is in RFC3339 text format.
             */
            startTime?: pulumi.Input<string>;
            /**
             * [Output Only] The status of the operation, which can be one of the following: `PENDING`, `RUNNING`, or `DONE`.
             */
            status?: pulumi.Input<string>;
            /**
             * [Output Only] An optional textual description of the current status of the operation.
             */
            statusMessage?: pulumi.Input<string>;
            /**
             * [Output Only] The unique target ID, which identifies a specific incarnation of the target resource.
             */
            targetId?: pulumi.Input<string>;
            /**
             * [Output Only] The URL of the resource that the operation modifies. For operations related to creating a snapshot, this points to the persistent disk that the snapshot was created from.
             */
            targetLink?: pulumi.Input<string>;
            /**
             * [Output Only] User who requested the operation, for example: `user@example.com`.
             */
            user?: pulumi.Input<string>;
            /**
             * [Output Only] If warning messages are generated during processing of the operation, this field will be populated.
             */
            warnings?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * [Output Only] The URL of the zone where the operation resides. Only applicable when performing per-zone operations.
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Options allows customized resource handling by Deployment Manager.
         */
        interface Options {
            /**
             * Options regarding how to thread async requests.
             */
            asyncOptions?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.AsyncOptions>[]>;
            /**
             * The mappings that apply for requests.
             */
            inputMappings?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.InputMapping>[]>;
            /**
             * Options for how to validate and process properties on a resource.
             */
            validationOptions?: pulumi.Input<inputs.deploymentmanager.v2beta.ValidationOptions>;
            /**
             * Additional properties block described as a jsonSchema, these properties will never be part of the json payload, but they can be consumed by InputMappings, this must be a valid json schema draft-04. The properties specified here will be decouple in a different section. This schema will be merged to the schema validation, and properties here will be extracted From the payload and consumed explicitly by InputMappings. ex: field1: type: string field2: type: number
             */
            virtualProperties?: pulumi.Input<string>;
        }
        interface PollingOptions {
            /**
             * An array of diagnostics to be collected by Deployment Manager, these diagnostics will be displayed to the user.
             */
            diagnostics?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.Diagnostic>[]>;
            /**
             * JsonPath expression that determines if the request failed.
             */
            failCondition?: pulumi.Input<string>;
            /**
             * JsonPath expression that determines if the request is completed.
             */
            finishCondition?: pulumi.Input<string>;
            /**
             * JsonPath expression that evaluates to string, it indicates where to poll.
             */
            pollingLink?: pulumi.Input<string>;
            /**
             * JsonPath expression, after polling is completed, indicates where to fetch the resource.
             */
            targetLink?: pulumi.Input<string>;
        }
        /**
         * Service Account used as a credential.
         */
        interface ServiceAccount {
            /**
             * The IAM service account email address like test@myproject.iam.gserviceaccount.com
             */
            email?: pulumi.Input<string>;
        }
        interface TargetConfiguration {
            /**
             * The configuration to use for this deployment.
             */
            config?: pulumi.Input<inputs.deploymentmanager.v2beta.ConfigFile>;
            /**
             * Specifies any files to import for this configuration. This can be used to import templates or other files. For example, you might import a text file in order to use the file in a template.
             */
            imports?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.ImportFile>[]>;
        }
        /**
         * Files that make up the template contents of a template type.
         */
        interface TemplateContents {
            /**
             * Import files referenced by the main template.
             */
            imports?: pulumi.Input<pulumi.Input<inputs.deploymentmanager.v2beta.ImportFile>[]>;
            /**
             * Which interpreter (python or jinja) should be used during expansion.
             */
            interpreter?: pulumi.Input<string>;
            /**
             * The filename of the mainTemplate
             */
            mainTemplate?: pulumi.Input<string>;
            /**
             * The contents of the template schema.
             */
            schema?: pulumi.Input<string>;
            /**
             * The contents of the main template file.
             */
            template?: pulumi.Input<string>;
        }
        /**
         * Label object for TypeProviders
         */
        interface TypeProviderLabelEntry {
            /**
             * Key of the label
             */
            key?: pulumi.Input<string>;
            /**
             * Value of the label
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Options for how to validate and process properties on a resource.
         */
        interface ValidationOptions {
            /**
             * Customize how deployment manager will validate the resource against schema errors.
             */
            schemaValidation?: pulumi.Input<string>;
            /**
             * Specify what to do with extra properties when executing a request.
             */
            undeclaredProperties?: pulumi.Input<string>;
        }
    }
}
export declare namespace dialogflow {
    namespace v2 {
        /**
         * Defines the Automated Agent to connect to a conversation.
         */
        interface GoogleCloudDialogflowV2AutomatedAgentConfig {
            /**
             * Required. ID of the Dialogflow agent environment to use. This project needs to either be the same project as the conversation or you need to grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow API Service Agent` role in this project. Format: `projects//locations//agent/environments/`. If environment is not specified, the default `draft` environment is used. Refer to [DetectIntentRequest](/dialogflow/docs/reference/rpc/google.cloud.dialogflow.v2#google.cloud.dialogflow.v2.DetectIntentRequest) for more details.
             */
            agent?: pulumi.Input<string>;
        }
        /**
         * Dialogflow contexts are similar to natural language context. If a person says to you "they are orange", you need context in order to understand what "they" is referring to. Similarly, for Dialogflow to handle an end-user expression like that, it needs to be provided with context in order to correctly match an intent. Using contexts, you can control the flow of a conversation. You can configure contexts for an intent by setting input and output contexts, which are identified by string names. When an intent is matched, any configured output contexts for that intent become active. While any contexts are active, Dialogflow is more likely to match intents that are configured with input contexts that correspond to the currently active contexts. For more information about context, see the [Contexts guide](https://cloud.google.com/dialogflow/docs/contexts-overview).
         */
        interface GoogleCloudDialogflowV2Context {
            /**
             * Optional. The number of conversational query requests after which the context expires. The default is `0`. If set to `0`, the context expires immediately. Contexts expire automatically after 20 minutes if there are no matching queries.
             */
            lifespanCount?: pulumi.Input<number>;
            /**
             * Required. The unique identifier of the context. Format: `projects//agent/sessions//contexts/`, or `projects//agent/environments//users//sessions//contexts/`. The `Context ID` is always converted to lowercase, may only contain characters in a-zA-Z0-9_-% and may be at most 250 bytes long. If `Environment ID` is not specified, we assume default 'draft' environment. If `User ID` is not specified, we assume default '-' user. The following context names are reserved for internal use by Dialogflow. You should not use these contexts or create contexts with these names: * `__system_counters__` * `*_id_dialog_context` * `*_dialog_params_size`
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. The collection of parameters associated with this context. Depending on your protocol or client library language, this is a map, associative array, symbol table, dictionary, or JSON object composed of a collection of (MapKey, MapValue) pairs: - MapKey type: string - MapKey value: parameter name - MapValue type: - If parameter's entity type is a composite entity: map - Else: depending on parameter value type, could be one of string, number, boolean, null, list or map - MapValue value: - If parameter's entity type is a composite entity: map from composite entity property names to property values - Else: parameter value
             */
            parameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * An **entity entry** for an associated entity type.
         */
        interface GoogleCloudDialogflowV2EntityTypeEntity {
            /**
             * Required. A collection of value synonyms. For example, if the entity type is *vegetable*, and `value` is *scallions*, a synonym could be *green onions*. For `KIND_LIST` entity types: * This collection must contain exactly one synonym equal to `value`.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The primary value associated with this entity entry. For example, if the entity type is *vegetable*, the value could be *scallions*. For `KIND_MAP` entity types: * A reference value to be used in place of synonyms. For `KIND_LIST` entity types: * A string that can contain references to other entity types (with or without aliases).
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Defines the Human Agent Assist to connect to a conversation.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfig {
            /**
             * Configuration for agent assistance of end user participant. Currently, this feature is not general available, please contact Google to get access.
             */
            endUserSuggestionConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionConfig>;
            /**
             * Configuration for agent assistance of human agent participant.
             */
            humanAgentSuggestionConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionConfig>;
            /**
             * Configuration for message analysis.
             */
            messageAnalysisConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigMessageAnalysisConfig>;
            /**
             * Pub/Sub topic on which to publish new agent assistant events.
             */
            notificationConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2NotificationConfig>;
        }
        /**
         * Custom conversation models used in agent assist feature. Supported feature: ARTICLE_SUGGESTION, SMART_COMPOSE, SMART_REPLY.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigConversationModelConfig {
            /**
             * Required. Conversation model resource name. Format: `projects//conversationModels/`.
             */
            model?: pulumi.Input<string>;
        }
        /**
         * Configuration for analyses to run on each conversation message.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigMessageAnalysisConfig {
            /**
             * Enable entity extraction in conversation messages on [agent assist stage](https://cloud.google.com/dialogflow/priv/docs/contact-center/basics#stages). If unspecified, defaults to false. Currently, this feature is not general available, please contact Google to get access.
             */
            enableEntityExtraction?: pulumi.Input<boolean>;
            /**
             * Enable sentiment analysis in conversation messages on [agent assist stage](https://cloud.google.com/dialogflow/priv/docs/contact-center/basics#stages). If unspecified, defaults to false. Sentiment analysis inspects user input and identifies the prevailing subjective opinion, especially to determine a user's attitude as positive, negative, or neutral: https://cloud.google.com/natural-language/docs/basics#sentiment_analysis For Participants.StreamingAnalyzeContent method, result will be in StreamingAnalyzeContentResponse.message.SentimentAnalysisResult. For Participants.AnalyzeContent method, result will be in AnalyzeContentResponse.message.SentimentAnalysisResult For Conversations.ListMessages method, result will be in ListMessagesResponse.messages.SentimentAnalysisResult If Pub/Sub notification is configured, result will be in ConversationEvent.new_message_payload.SentimentAnalysisResult.
             */
            enableSentimentAnalysis?: pulumi.Input<boolean>;
        }
        /**
         * Detail human agent assistant config.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionConfig {
            /**
             * Configuration of different suggestion features. One feature can have only one config.
             */
            featureConfigs?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionFeatureConfig>[]>;
            /**
             * If `group_suggestion_responses` is false, and there are multiple `feature_configs` in `event based suggestion` or StreamingAnalyzeContent, we will try to deliver suggestions to customers as soon as we get new suggestion. Different type of suggestions based on the same context will be in separate Pub/Sub event or `StreamingAnalyzeContentResponse`. If `group_suggestion_responses` set to true. All the suggestions to the same participant based on the same context will be grouped into a single Pub/Sub event or StreamingAnalyzeContentResponse.
             */
            groupSuggestionResponses?: pulumi.Input<boolean>;
        }
        /**
         * Config for suggestion features.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionFeatureConfig {
            /**
             * Configs of custom conversation model.
             */
            conversationModelConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigConversationModelConfig>;
            /**
             * Automatically iterates all participants and tries to compile suggestions. Supported features: ARTICLE_SUGGESTION, FAQ, DIALOGFLOW_ASSIST.
             */
            enableEventBasedSuggestion?: pulumi.Input<boolean>;
            /**
             * Configs of query.
             */
            queryConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfig>;
            /**
             * The suggestion feature.
             */
            suggestionFeature?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2SuggestionFeature>;
            /**
             * Settings of suggestion trigger. Currently, only ARTICLE_SUGGESTION and FAQ will use this field.
             */
            suggestionTriggerSettings?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionTriggerSettings>;
        }
        /**
         * Config for suggestion query.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfig {
            /**
             * Confidence threshold of query result. Agent Assist gives each suggestion a score in the range [0.0, 1.0], based on the relevance between the suggestion and the current conversation context. A score of 0.0 has no relevance, while a score of 1.0 has high relevance. Only suggestions with a score greater than or equal to the value of this field are included in the results. For a baseline model (the default), the recommended value is in the range [0.05, 0.1]. For a custom model, there is no recommended value. Tune this value by starting from a very low value and slowly increasing until you have desired results. If this field is not set, it defaults to 0.0, which means that all suggestions are returned. Supported features: ARTICLE_SUGGESTION.
             */
            confidenceThreshold?: pulumi.Input<number>;
            /**
             * Determines how recent conversation context is filtered when generating suggestions. If unspecified, no messages will be dropped.
             */
            contextFilterSettings?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigContextFilterSettings>;
            /**
             * Query from Dialogflow agent. It is used by DIALOGFLOW_ASSIST.
             */
            dialogflowQuerySource?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigDialogflowQuerySource>;
            /**
             * Query from knowledge base document. It is used by: SMART_REPLY, SMART_COMPOSE.
             */
            documentQuerySource?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigDocumentQuerySource>;
            /**
             * Query from knowledgebase. It is used by: ARTICLE_SUGGESTION, FAQ.
             */
            knowledgeBaseQuerySource?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigKnowledgeBaseQuerySource>;
            /**
             * Maximum number of results to return. Currently, if unset, defaults to 10. And the max number is 20.
             */
            maxResults?: pulumi.Input<number>;
        }
        /**
         * Settings that determine how to filter recent conversation context when generating suggestions.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigContextFilterSettings {
            /**
             * If set to true, the last message from virtual agent (hand off message) and the message before it (trigger message of hand off) are dropped.
             */
            dropHandoffMessages?: pulumi.Input<boolean>;
            /**
             * If set to true, all messages from ivr stage are dropped.
             */
            dropIvrMessages?: pulumi.Input<boolean>;
            /**
             * If set to true, all messages from virtual agent are dropped.
             */
            dropVirtualAgentMessages?: pulumi.Input<boolean>;
        }
        /**
         * Dialogflow source setting. Supported feature: DIALOGFLOW_ASSIST.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigDialogflowQuerySource {
            /**
             * Required. The name of a Dialogflow virtual agent used for end user side intent detection and suggestion. Format: `projects//locations//agent`. When multiple agents are allowed in the same Dialogflow project.
             */
            agent?: pulumi.Input<string>;
        }
        /**
         * Document source settings. Supported features: SMART_REPLY, SMART_COMPOSE.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigDocumentQuerySource {
            /**
             * Required. Knowledge documents to query from. Format: `projects//locations//knowledgeBases//documents/`. Currently, at most 5 documents are supported.
             */
            documents?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Knowledge base source settings. Supported features: ARTICLE_SUGGESTION, FAQ.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionQueryConfigKnowledgeBaseQuerySource {
            /**
             * Required. Knowledge bases to query. Format: `projects//locations//knowledgeBases/`. Currently, at most 5 knowledge bases are supported.
             */
            knowledgeBases?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings of suggestion trigger.
         */
        interface GoogleCloudDialogflowV2HumanAgentAssistantConfigSuggestionTriggerSettings {
            /**
             * Do not trigger if last utterance is small talk.
             */
            noSmalltalk?: pulumi.Input<boolean>;
            /**
             * Only trigger suggestion if participant role of last utterance is END_USER.
             */
            onlyEndUser?: pulumi.Input<boolean>;
        }
        /**
         * Defines the hand off to a live agent, typically on which external agent service provider to connect to a conversation. Currently, this feature is not general available, please contact Google to get access.
         */
        interface GoogleCloudDialogflowV2HumanAgentHandoffConfig {
            /**
             * Uses LivePerson (https://www.liveperson.com).
             */
            livePersonConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentHandoffConfigLivePersonConfig>;
            /**
             * Uses Salesforce Live Agent.
             */
            salesforceLiveAgentConfig?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2HumanAgentHandoffConfigSalesforceLiveAgentConfig>;
        }
        /**
         * Configuration specific to LivePerson (https://www.liveperson.com).
         */
        interface GoogleCloudDialogflowV2HumanAgentHandoffConfigLivePersonConfig {
            /**
             * Required. Account number of the LivePerson account to connect. This is the account number you input at the login page.
             */
            accountNumber?: pulumi.Input<string>;
        }
        /**
         * Configuration specific to Salesforce Live Agent.
         */
        interface GoogleCloudDialogflowV2HumanAgentHandoffConfigSalesforceLiveAgentConfig {
            /**
             * Required. Live Agent chat button ID.
             */
            buttonId?: pulumi.Input<string>;
            /**
             * Required. Live Agent deployment ID.
             */
            deploymentId?: pulumi.Input<string>;
            /**
             * Required. Domain of the Live Agent endpoint for this agent. You can find the endpoint URL in the `Live Agent settings` page. For example if URL has the form https://d.la4-c2-phx.salesforceliveagent.com/..., you should fill in d.la4-c2-phx.salesforceliveagent.com.
             */
            endpointDomain?: pulumi.Input<string>;
            /**
             * Required. The organization ID of the Salesforce account.
             */
            organizationId?: pulumi.Input<string>;
        }
        /**
         * Represents a single followup intent in the chain.
         */
        interface GoogleCloudDialogflowV2IntentFollowupIntentInfo {
            /**
             * The unique identifier of the followup intent. Format: `projects//agent/intents/`.
             */
            followupIntentName?: pulumi.Input<string>;
            /**
             * The unique identifier of the followup intent's parent. Format: `projects//agent/intents/`.
             */
            parentFollowupIntentName?: pulumi.Input<string>;
        }
        /**
         * A rich response message. Corresponds to the intent `Response` field in the Dialogflow console. For more information, see [Rich response messages](https://cloud.google.com/dialogflow/docs/intents-rich-messages).
         */
        interface GoogleCloudDialogflowV2IntentMessage {
            /**
             * The basic card response for Actions on Google.
             */
            basicCard?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBasicCard>;
            /**
             * Browse carousel card for Actions on Google.
             */
            browseCarouselCard?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBrowseCarouselCard>;
            /**
             * The card response.
             */
            card?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageCard>;
            /**
             * The carousel card response for Actions on Google.
             */
            carouselSelect?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageCarouselSelect>;
            /**
             * The image response.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * The link out suggestion chip for Actions on Google.
             */
            linkOutSuggestion?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageLinkOutSuggestion>;
            /**
             * The list card response for Actions on Google.
             */
            listSelect?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageListSelect>;
            /**
             * The media content card for Actions on Google.
             */
            mediaContent?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageMediaContent>;
            /**
             * A custom platform-specific response.
             */
            payload?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The platform that this message is intended for.
             */
            platform?: pulumi.Input<string>;
            /**
             * The quick replies response.
             */
            quickReplies?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageQuickReplies>;
            /**
             * The voice and text-only responses for Actions on Google.
             */
            simpleResponses?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSimpleResponses>;
            /**
             * The suggestion chips for Actions on Google.
             */
            suggestions?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSuggestions>;
            /**
             * Table card for Actions on Google.
             */
            tableCard?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageTableCard>;
            /**
             * The text response.
             */
            text?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageText>;
        }
        /**
         * The basic card message. Useful for displaying information.
         */
        interface GoogleCloudDialogflowV2IntentMessageBasicCard {
            /**
             * Optional. The collection of card buttons.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBasicCardButton>[]>;
            /**
             * Required, unless image is present. The body text of the card.
             */
            formattedText?: pulumi.Input<string>;
            /**
             * Optional. The image for the card.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Optional. The subtitle of the card.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The button object that appears at the bottom of a card.
         */
        interface GoogleCloudDialogflowV2IntentMessageBasicCardButton {
            /**
             * Required. Action to take when a user taps on the button.
             */
            openUriAction?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBasicCardButtonOpenUriAction>;
            /**
             * Required. The title of the button.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Opens the given URI.
         */
        interface GoogleCloudDialogflowV2IntentMessageBasicCardButtonOpenUriAction {
            /**
             * Required. The HTTP or HTTPS scheme URI.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Browse Carousel Card for Actions on Google. https://developers.google.com/actions/assistant/responses#browsing_carousel
         */
        interface GoogleCloudDialogflowV2IntentMessageBrowseCarouselCard {
            /**
             * Optional. Settings for displaying the image. Applies to every image in items.
             */
            imageDisplayOptions?: pulumi.Input<string>;
            /**
             * Required. List of items in the Browse Carousel Card. Minimum of two items, maximum of ten.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBrowseCarouselCardBrowseCarouselCardItem>[]>;
        }
        /**
         * Browsing carousel tile
         */
        interface GoogleCloudDialogflowV2IntentMessageBrowseCarouselCardBrowseCarouselCardItem {
            /**
             * Optional. Description of the carousel item. Maximum of four lines of text.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Text that appears at the bottom of the Browse Carousel Card. Maximum of one line of text.
             */
            footer?: pulumi.Input<string>;
            /**
             * Optional. Hero image for the carousel item.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Required. Action to present to the user.
             */
            openUriAction?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBrowseCarouselCardBrowseCarouselCardItemOpenUrlAction>;
            /**
             * Required. Title of the carousel item. Maximum of two lines of text.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Actions on Google action to open a given url.
         */
        interface GoogleCloudDialogflowV2IntentMessageBrowseCarouselCardBrowseCarouselCardItemOpenUrlAction {
            /**
             * Required. URL
             */
            url?: pulumi.Input<string>;
            /**
             * Optional. Specifies the type of viewer that is used when opening the URL. Defaults to opening via web browser.
             */
            urlTypeHint?: pulumi.Input<string>;
        }
        /**
         * The card response message.
         */
        interface GoogleCloudDialogflowV2IntentMessageCard {
            /**
             * Optional. The collection of card buttons.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageCardButton>[]>;
            /**
             * Optional. The public URI to an image file for the card.
             */
            imageUri?: pulumi.Input<string>;
            /**
             * Optional. The subtitle of the card.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Contains information about a button.
         */
        interface GoogleCloudDialogflowV2IntentMessageCardButton {
            /**
             * Optional. The text to send back to the Dialogflow API or a URI to open.
             */
            postback?: pulumi.Input<string>;
            /**
             * Optional. The text to show on the button.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * The card for presenting a carousel of options to select from.
         */
        interface GoogleCloudDialogflowV2IntentMessageCarouselSelect {
            /**
             * Required. Carousel items.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageCarouselSelectItem>[]>;
        }
        /**
         * An item in the carousel.
         */
        interface GoogleCloudDialogflowV2IntentMessageCarouselSelectItem {
            /**
             * Optional. The body text of the card.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. The image to display.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Required. Additional info about the option item.
             */
            info?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSelectItemInfo>;
            /**
             * Required. Title of the carousel item.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Column properties for TableCard.
         */
        interface GoogleCloudDialogflowV2IntentMessageColumnProperties {
            /**
             * Required. Column heading.
             */
            header?: pulumi.Input<string>;
            /**
             * Optional. Defines text alignment for all cells in this column.
             */
            horizontalAlignment?: pulumi.Input<string>;
        }
        /**
         * The image response message.
         */
        interface GoogleCloudDialogflowV2IntentMessageImage {
            /**
             * Optional. A text description of the image to be used for accessibility, e.g., screen readers.
             */
            accessibilityText?: pulumi.Input<string>;
            /**
             * Optional. The public URI to an image file.
             */
            imageUri?: pulumi.Input<string>;
        }
        /**
         * The suggestion chip message that allows the user to jump out to the app or website associated with this agent.
         */
        interface GoogleCloudDialogflowV2IntentMessageLinkOutSuggestion {
            /**
             * Required. The name of the app or site this chip is linking to.
             */
            destinationName?: pulumi.Input<string>;
            /**
             * Required. The URI of the app or site to open when the user taps the suggestion chip.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * The card for presenting a list of options to select from.
         */
        interface GoogleCloudDialogflowV2IntentMessageListSelect {
            /**
             * Required. List items.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageListSelectItem>[]>;
            /**
             * Optional. Subtitle of the list.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The overall title of the list.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * An item in the list.
         */
        interface GoogleCloudDialogflowV2IntentMessageListSelectItem {
            /**
             * Optional. The main text describing the item.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. The image to display.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Required. Additional information about this option.
             */
            info?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSelectItemInfo>;
            /**
             * Required. The title of the list item.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The media content card for Actions on Google.
         */
        interface GoogleCloudDialogflowV2IntentMessageMediaContent {
            /**
             * Required. List of media objects.
             */
            mediaObjects?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageMediaContentResponseMediaObject>[]>;
            /**
             * Optional. What type of media is the content (ie "audio").
             */
            mediaType?: pulumi.Input<string>;
        }
        /**
         * Response media object for media content card.
         */
        interface GoogleCloudDialogflowV2IntentMessageMediaContentResponseMediaObject {
            /**
             * Required. Url where the media is stored.
             */
            contentUrl?: pulumi.Input<string>;
            /**
             * Optional. Description of media card.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Icon to display above media content.
             */
            icon?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Optional. Image to display above media content.
             */
            largeImage?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Required. Name of media card.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The quick replies response message.
         */
        interface GoogleCloudDialogflowV2IntentMessageQuickReplies {
            /**
             * Optional. The collection of quick replies.
             */
            quickReplies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The title of the collection of quick replies.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Additional info about the select item for when it is triggered in a dialog.
         */
        interface GoogleCloudDialogflowV2IntentMessageSelectItemInfo {
            /**
             * Required. A unique key that will be sent back to the agent if this response is given.
             */
            key?: pulumi.Input<string>;
            /**
             * Optional. A list of synonyms that can also be used to trigger this item in dialog.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The simple response message containing speech or text.
         */
        interface GoogleCloudDialogflowV2IntentMessageSimpleResponse {
            /**
             * Optional. The text to display.
             */
            displayText?: pulumi.Input<string>;
            /**
             * One of text_to_speech or ssml must be provided. Structured spoken response to the user in the SSML format. Mutually exclusive with text_to_speech.
             */
            ssml?: pulumi.Input<string>;
            /**
             * One of text_to_speech or ssml must be provided. The plain text of the speech output. Mutually exclusive with ssml.
             */
            textToSpeech?: pulumi.Input<string>;
        }
        /**
         * The collection of simple response candidates. This message in `QueryResult.fulfillment_messages` and `WebhookResponse.fulfillment_messages` should contain only one `SimpleResponse`.
         */
        interface GoogleCloudDialogflowV2IntentMessageSimpleResponses {
            /**
             * Required. The list of simple responses.
             */
            simpleResponses?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSimpleResponse>[]>;
        }
        /**
         * The suggestion chip message that the user can tap to quickly post a reply to the conversation.
         */
        interface GoogleCloudDialogflowV2IntentMessageSuggestion {
            /**
             * Required. The text shown the in the suggestion chip.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The collection of suggestions.
         */
        interface GoogleCloudDialogflowV2IntentMessageSuggestions {
            /**
             * Required. The list of suggested replies.
             */
            suggestions?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageSuggestion>[]>;
        }
        /**
         * Table card for Actions on Google.
         */
        interface GoogleCloudDialogflowV2IntentMessageTableCard {
            /**
             * Optional. List of buttons for the card.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageBasicCardButton>[]>;
            /**
             * Optional. Display properties for the columns in this table.
             */
            columnProperties?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageColumnProperties>[]>;
            /**
             * Optional. Image which should be displayed on the card.
             */
            image?: pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageImage>;
            /**
             * Optional. Rows in this table of data.
             */
            rows?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageTableCardRow>[]>;
            /**
             * Optional. Subtitle to the title.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Required. Title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Cell of TableCardRow.
         */
        interface GoogleCloudDialogflowV2IntentMessageTableCardCell {
            /**
             * Required. Text in this cell.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Row of TableCard.
         */
        interface GoogleCloudDialogflowV2IntentMessageTableCardRow {
            /**
             * Optional. List of cells that make up this row.
             */
            cells?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentMessageTableCardCell>[]>;
            /**
             * Optional. Whether to add a visual divider after this row.
             */
            dividerAfter?: pulumi.Input<boolean>;
        }
        /**
         * The text response message.
         */
        interface GoogleCloudDialogflowV2IntentMessageText {
            /**
             * Optional. The collection of the agent's responses.
             */
            text?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents intent parameters.
         */
        interface GoogleCloudDialogflowV2IntentParameter {
            /**
             * Optional. The default value to use when the `value` yields an empty result. Default values can be extracted from contexts by using the following syntax: `#context_name.parameter_name`.
             */
            defaultValue?: pulumi.Input<string>;
            /**
             * Required. The name of the parameter.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Optional. The name of the entity type, prefixed with `@`, that describes values of the parameter. If the parameter is required, this must be provided.
             */
            entityTypeDisplayName?: pulumi.Input<string>;
            /**
             * Optional. Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Optional. Indicates whether the parameter is required. That is, whether the intent cannot be completed without collecting the parameter value.
             */
            mandatory?: pulumi.Input<boolean>;
            /**
             * The unique identifier of this parameter.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. The collection of prompts that the agent can present to the user in order to collect a value for the parameter.
             */
            prompts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The definition of the parameter value. It can be: - a constant string, - a parameter value defined as `$parameter_name`, - an original parameter value defined as `$parameter_name.original`, - a parameter value from some context defined as `#context_name.parameter_name`.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Represents an example that the agent is trained on.
         */
        interface GoogleCloudDialogflowV2IntentTrainingPhrase {
            /**
             * The unique identifier of this training phrase.
             */
            name?: pulumi.Input<string>;
            /**
             * Required. The ordered list of training phrase parts. The parts are concatenated in order to form the training phrase. Note: The API does not automatically annotate training phrases like the Dialogflow Console does. Note: Do not forget to include whitespace at part boundaries, so the training phrase is well formatted when the parts are concatenated. If the training phrase does not need to be annotated with parameters, you just need a single part with only the Part.text field set. If you want to annotate the training phrase, you must create multiple parts, where the fields of each part are populated in one of two ways: - `Part.text` is set to a part of the phrase that has no parameters. - `Part.text` is set to a part of the phrase that you want to annotate, and the `entity_type`, `alias`, and `user_defined` fields are all set.
             */
            parts?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2.GoogleCloudDialogflowV2IntentTrainingPhrasePart>[]>;
            /**
             * Optional. Indicates how many times this example was added to the intent. Each time a developer adds an existing sample by editing an intent or training, this counter is increased.
             */
            timesAddedCount?: pulumi.Input<number>;
            /**
             * Required. The type of the training phrase.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a part of a training phrase.
         */
        interface GoogleCloudDialogflowV2IntentTrainingPhrasePart {
            /**
             * Optional. The parameter name for the value extracted from the annotated part of the example. This field is required for annotated parts of the training phrase.
             */
            alias?: pulumi.Input<string>;
            /**
             * Optional. The entity type name prefixed with `@`. This field is required for annotated parts of the training phrase.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. The text for this part.
             */
            text?: pulumi.Input<string>;
            /**
             * Optional. Indicates whether the text was manually annotated. This field is set to true when the Dialogflow Console is used to manually annotate the part. When creating an annotated part with the API, you must set this to true.
             */
            userDefined?: pulumi.Input<boolean>;
        }
        /**
         * Defines logging behavior for conversation lifecycle events.
         */
        interface GoogleCloudDialogflowV2LoggingConfig {
            /**
             * Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
             */
            enableStackdriverLogging?: pulumi.Input<boolean>;
        }
        /**
         * Defines notification behavior.
         */
        interface GoogleCloudDialogflowV2NotificationConfig {
            /**
             * Format of message.
             */
            messageFormat?: pulumi.Input<string>;
            /**
             * Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Configures speech transcription for ConversationProfile.
         */
        interface GoogleCloudDialogflowV2SpeechToTextConfig {
            /**
             * Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
             */
            speechModelVariant?: pulumi.Input<string>;
        }
        /**
         * The type of Human Agent Assistant API suggestion to perform, and the maximum number of results to return for that type. Multiple `Feature` objects can be specified in the `features` list.
         */
        interface GoogleCloudDialogflowV2SuggestionFeature {
            /**
             * Type of Human Agent Assistant API feature to request.
             */
            type?: pulumi.Input<string>;
        }
    }
    namespace v2beta1 {
        /**
         * Defines the Automated Agent to connect to a conversation.
         */
        interface GoogleCloudDialogflowV2beta1AutomatedAgentConfig {
            /**
             * Required. ID of the Dialogflow agent environment to use. This project needs to either be the same project as the conversation or you need to grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow API Service Agent` role in this project. - For ES agents, use format: `projects//locations//agent/environments/`. If environment is not specified, the default `draft` environment is used. Refer to [DetectIntentRequest](/dialogflow/docs/reference/rpc/google.cloud.dialogflow.v2beta1#google.cloud.dialogflow.v2beta1.DetectIntentRequest) for more details. - For CX agents, use format `projects//locations//agents//environments/`. If environment is not specified, the default `draft` environment is used.
             */
            agent?: pulumi.Input<string>;
        }
        /**
         * Dialogflow contexts are similar to natural language context. If a person says to you "they are orange", you need context in order to understand what "they" is referring to. Similarly, for Dialogflow to handle an end-user expression like that, it needs to be provided with context in order to correctly match an intent. Using contexts, you can control the flow of a conversation. You can configure contexts for an intent by setting input and output contexts, which are identified by string names. When an intent is matched, any configured output contexts for that intent become active. While any contexts are active, Dialogflow is more likely to match intents that are configured with input contexts that correspond to the currently active contexts. For more information about context, see the [Contexts guide](https://cloud.google.com/dialogflow/docs/contexts-overview).
         */
        interface GoogleCloudDialogflowV2beta1Context {
            /**
             * Optional. The number of conversational query requests after which the context expires. The default is `0`. If set to `0`, the context expires immediately. Contexts expire automatically after 20 minutes if there are no matching queries.
             */
            lifespanCount?: pulumi.Input<number>;
            /**
             * Required. The unique identifier of the context. Supported formats: - `projects//agent/sessions//contexts/`, - `projects//locations//agent/sessions//contexts/`, - `projects//agent/environments//users//sessions//contexts/`, - `projects//locations//agent/environments//users//sessions//contexts/`, The `Context ID` is always converted to lowercase, may only contain characters in a-zA-Z0-9_-% and may be at most 250 bytes long. If `Environment ID` is not specified, we assume default 'draft' environment. If `User ID` is not specified, we assume default '-' user. The following context names are reserved for internal use by Dialogflow. You should not use these contexts or create contexts with these names: * `__system_counters__` * `*_id_dialog_context` * `*_dialog_params_size`
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. The collection of parameters associated with this context. Depending on your protocol or client library language, this is a map, associative array, symbol table, dictionary, or JSON object composed of a collection of (MapKey, MapValue) pairs: - MapKey type: string - MapKey value: parameter name - MapValue type: - If parameter's entity type is a composite entity: map - Else: depending on parameter value type, could be one of string, number, boolean, null, list or map - MapValue value: - If parameter's entity type is a composite entity: map from composite entity property names to property values - Else: parameter value
             */
            parameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * An **entity entry** for an associated entity type.
         */
        interface GoogleCloudDialogflowV2beta1EntityTypeEntity {
            /**
             * Required. A collection of value synonyms. For example, if the entity type is *vegetable*, and `value` is *scallions*, a synonym could be *green onions*. For `KIND_LIST` entity types: * This collection must contain exactly one synonym equal to `value`.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The primary value associated with this entity entry. For example, if the entity type is *vegetable*, the value could be *scallions*. For `KIND_MAP` entity types: * A reference value to be used in place of synonyms. For `KIND_LIST` entity types: * A string that can contain references to other entity types (with or without aliases).
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Defines the Human Agent Assistant to connect to a conversation.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfig {
            /**
             * Configuration for agent assistance of end user participant. Currently, this feature is not general available, please contact Google to get access.
             */
            endUserSuggestionConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionConfig>;
            /**
             * Configuration for agent assistance of human agent participant.
             */
            humanAgentSuggestionConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionConfig>;
            /**
             * Configuration for message analysis.
             */
            messageAnalysisConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigMessageAnalysisConfig>;
            /**
             * Pub/Sub topic on which to publish new agent assistant events.
             */
            notificationConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1NotificationConfig>;
        }
        /**
         * Custom conversation models used in agent assist feature. Supported feature: ARTICLE_SUGGESTION, SMART_COMPOSE, SMART_REPLY.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigConversationModelConfig {
            /**
             * Required. Conversation model resource name. Format: `projects//conversationModels/`.
             */
            model?: pulumi.Input<string>;
        }
        /**
         * Configuration for analyses to run on each conversation message.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigMessageAnalysisConfig {
            /**
             * Enable entity extraction in conversation messages on [agent assist stage](https://cloud.google.com/dialogflow/priv/docs/contact-center/basics#stages). If unspecified, defaults to false. Currently, this feature is not general available, please contact Google to get access.
             */
            enableEntityExtraction?: pulumi.Input<boolean>;
            /**
             * Enable sentiment analysis in conversation messages on [agent assist stage](https://cloud.google.com/dialogflow/priv/docs/contact-center/basics#stages). If unspecified, defaults to false. Sentiment analysis inspects user input and identifies the prevailing subjective opinion, especially to determine a user's attitude as positive, negative, or neutral: https://cloud.google.com/natural-language/docs/basics#sentiment_analysis For Participants.StreamingAnalyzeContent method, result will be in StreamingAnalyzeContentResponse.message.SentimentAnalysisResult. For Participants.AnalyzeContent method, result will be in AnalyzeContentResponse.message.SentimentAnalysisResult For Conversations.ListMessages method, result will be in ListMessagesResponse.messages.SentimentAnalysisResult If Pub/Sub notification is configured, result will be in ConversationEvent.new_message_payload.SentimentAnalysisResult.
             */
            enableSentimentAnalysis?: pulumi.Input<boolean>;
        }
        /**
         * Detail human agent assistant config.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionConfig {
            /**
             * Configuration of different suggestion features. One feature can have only one config.
             */
            featureConfigs?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionFeatureConfig>[]>;
            /**
             * If `group_suggestion_responses` is false, and there are multiple `feature_configs` in `event based suggestion` or StreamingAnalyzeContent, we will try to deliver suggestions to customers as soon as we get new suggestion. Different type of suggestions based on the same context will be in separate Pub/Sub event or `StreamingAnalyzeContentResponse`. If `group_suggestion_responses` set to true. All the suggestions to the same participant based on the same context will be grouped into a single Pub/Sub event or StreamingAnalyzeContentResponse.
             */
            groupSuggestionResponses?: pulumi.Input<boolean>;
        }
        /**
         * Config for suggestion features.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionFeatureConfig {
            /**
             * Configs of custom conversation model.
             */
            conversationModelConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigConversationModelConfig>;
            /**
             * Automatically iterates all participants and tries to compile suggestions. Supported features: ARTICLE_SUGGESTION, FAQ, DIALOGFLOW_ASSIST.
             */
            enableEventBasedSuggestion?: pulumi.Input<boolean>;
            /**
             * Configs of query.
             */
            queryConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfig>;
            /**
             * The suggestion feature.
             */
            suggestionFeature?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1SuggestionFeature>;
            /**
             * Settings of suggestion trigger. Currently, only ARTICLE_SUGGESTION, FAQ, and DIALOGFLOW_ASSIST will use this field.
             */
            suggestionTriggerSettings?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionTriggerSettings>;
        }
        /**
         * Config for suggestion query.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfig {
            /**
             * Confidence threshold of query result. Agent Assist gives each suggestion a score in the range [0.0, 1.0], based on the relevance between the suggestion and the current conversation context. A score of 0.0 has no relevance, while a score of 1.0 has high relevance. Only suggestions with a score greater than or equal to the value of this field are included in the results. For a baseline model (the default), the recommended value is in the range [0.05, 0.1]. For a custom model, there is no recommended value. Tune this value by starting from a very low value and slowly increasing until you have desired results. If this field is not set, it is default to 0.0, which means that all suggestions are returned. Supported features: ARTICLE_SUGGESTION, FAQ, SMART_REPLY, SMART_COMPOSE.
             */
            confidenceThreshold?: pulumi.Input<number>;
            /**
             * Determines how recent conversation context is filtered when generating suggestions. If unspecified, no messages will be dropped.
             */
            contextFilterSettings?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigContextFilterSettings>;
            /**
             * Query from Dialogflow agent. It is used by DIALOGFLOW_ASSIST.
             */
            dialogflowQuerySource?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigDialogflowQuerySource>;
            /**
             * Query from knowledge base document. It is used by: SMART_REPLY, SMART_COMPOSE.
             */
            documentQuerySource?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigDocumentQuerySource>;
            /**
             * Query from knowledgebase. It is used by: ARTICLE_SUGGESTION, FAQ.
             */
            knowledgeBaseQuerySource?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigKnowledgeBaseQuerySource>;
            /**
             * Maximum number of results to return. Currently, if unset, defaults to 10. And the max number is 20.
             */
            maxResults?: pulumi.Input<number>;
        }
        /**
         * Settings that determine how to filter recent conversation context when generating suggestions.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigContextFilterSettings {
            /**
             * If set to true, the last message from virtual agent (hand off message) and the message before it (trigger message of hand off) are dropped.
             */
            dropHandoffMessages?: pulumi.Input<boolean>;
            /**
             * If set to true, all messages from ivr stage are dropped.
             */
            dropIvrMessages?: pulumi.Input<boolean>;
            /**
             * If set to true, all messages from virtual agent are dropped.
             */
            dropVirtualAgentMessages?: pulumi.Input<boolean>;
        }
        /**
         * Dialogflow source setting. Supported feature: DIALOGFLOW_ASSIST.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigDialogflowQuerySource {
            /**
             * Required. The name of a dialogflow virtual agent used for end user side intent detection and suggestion. Format: `projects//locations//agent`. When multiple agents are allowed in the same Dialogflow project.
             */
            agent?: pulumi.Input<string>;
        }
        /**
         * Document source settings. Supported features: SMART_REPLY, SMART_COMPOSE.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigDocumentQuerySource {
            /**
             * Required. Knowledge documents to query from. Format: `projects//locations//knowledgeBases//documents/`. Currently, only one document is supported.
             */
            documents?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Knowledge base source settings. Supported features: ARTICLE_SUGGESTION, FAQ.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionQueryConfigKnowledgeBaseQuerySource {
            /**
             * Required. Knowledge bases to query. Format: `projects//locations//knowledgeBases/`. Currently, only one knowledge base is supported.
             */
            knowledgeBases?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings of suggestion trigger.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentAssistantConfigSuggestionTriggerSettings {
            /**
             * Do not trigger if last utterance is small talk.
             */
            noSmallTalk?: pulumi.Input<boolean>;
            /**
             * Only trigger suggestion if participant role of last utterance is END_USER.
             */
            onlyEndUser?: pulumi.Input<boolean>;
        }
        /**
         * Defines the hand off to a live agent, typically on which external agent service provider to connect to a conversation. Currently, this feature is not general available, please contact Google to get access.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentHandoffConfig {
            /**
             * Uses LivePerson (https://www.liveperson.com).
             */
            livePersonConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentHandoffConfigLivePersonConfig>;
            /**
             * Uses Salesforce Live Agent.
             */
            salesforceLiveAgentConfig?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1HumanAgentHandoffConfigSalesforceLiveAgentConfig>;
        }
        /**
         * Configuration specific to LivePerson (https://www.liveperson.com).
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentHandoffConfigLivePersonConfig {
            /**
             * Required. Account number of the LivePerson account to connect. This is the account number you input at the login page.
             */
            accountNumber?: pulumi.Input<string>;
        }
        /**
         * Configuration specific to Salesforce Live Agent.
         */
        interface GoogleCloudDialogflowV2beta1HumanAgentHandoffConfigSalesforceLiveAgentConfig {
            /**
             * Required. Live Agent chat button ID.
             */
            buttonId?: pulumi.Input<string>;
            /**
             * Required. Live Agent deployment ID.
             */
            deploymentId?: pulumi.Input<string>;
            /**
             * Required. Domain of the Live Agent endpoint for this agent. You can find the endpoint URL in the `Live Agent settings` page. For example if URL has the form https://d.la4-c2-phx.salesforceliveagent.com/..., you should fill in d.la4-c2-phx.salesforceliveagent.com.
             */
            endpointDomain?: pulumi.Input<string>;
            /**
             * Required. The organization ID of the Salesforce account.
             */
            organizationId?: pulumi.Input<string>;
        }
        /**
         * Corresponds to the `Response` field in the Dialogflow console.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessage {
            /**
             * Displays a basic card for Actions on Google.
             */
            basicCard?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBasicCard>;
            /**
             * Browse carousel card for Actions on Google.
             */
            browseCarouselCard?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCard>;
            /**
             * Displays a card.
             */
            card?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageCard>;
            /**
             * Displays a carousel card for Actions on Google.
             */
            carouselSelect?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageCarouselSelect>;
            /**
             * Displays an image.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Displays a link out suggestion chip for Actions on Google.
             */
            linkOutSuggestion?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageLinkOutSuggestion>;
            /**
             * Displays a list card for Actions on Google.
             */
            listSelect?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageListSelect>;
            /**
             * The media content card for Actions on Google.
             */
            mediaContent?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageMediaContent>;
            /**
             * A custom platform-specific response.
             */
            payload?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The platform that this message is intended for.
             */
            platform?: pulumi.Input<string>;
            /**
             * Displays quick replies.
             */
            quickReplies?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageQuickReplies>;
            /**
             * Rich Business Messaging (RBM) carousel rich card response.
             */
            rbmCarouselRichCard?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmCarouselCard>;
            /**
             * Standalone Rich Business Messaging (RBM) rich card response.
             */
            rbmStandaloneRichCard?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmStandaloneCard>;
            /**
             * Rich Business Messaging (RBM) text response. RBM allows businesses to send enriched and branded versions of SMS. See https://jibe.google.com/business-messaging.
             */
            rbmText?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmText>;
            /**
             * Returns a voice or text-only response for Actions on Google.
             */
            simpleResponses?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSimpleResponses>;
            /**
             * Displays suggestion chips for Actions on Google.
             */
            suggestions?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSuggestions>;
            /**
             * Table card for Actions on Google.
             */
            tableCard?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTableCard>;
            /**
             * Plays audio from a file in Telephony Gateway.
             */
            telephonyPlayAudio?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTelephonyPlayAudio>;
            /**
             * Synthesizes speech in Telephony Gateway.
             */
            telephonySynthesizeSpeech?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTelephonySynthesizeSpeech>;
            /**
             * Transfers the call in Telephony Gateway.
             */
            telephonyTransferCall?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTelephonyTransferCall>;
            /**
             * Returns a text response.
             */
            text?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageText>;
        }
        /**
         * The basic card message. Useful for displaying information.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBasicCard {
            /**
             * Optional. The collection of card buttons.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBasicCardButton>[]>;
            /**
             * Required, unless image is present. The body text of the card.
             */
            formattedText?: pulumi.Input<string>;
            /**
             * Optional. The image for the card.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Optional. The subtitle of the card.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The button object that appears at the bottom of a card.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBasicCardButton {
            /**
             * Required. Action to take when a user taps on the button.
             */
            openUriAction?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBasicCardButtonOpenUriAction>;
            /**
             * Required. The title of the button.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Opens the given URI.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBasicCardButtonOpenUriAction {
            /**
             * Required. The HTTP or HTTPS scheme URI.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Browse Carousel Card for Actions on Google. https://developers.google.com/actions/assistant/responses#browsing_carousel
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCard {
            /**
             * Optional. Settings for displaying the image. Applies to every image in items.
             */
            imageDisplayOptions?: pulumi.Input<string>;
            /**
             * Required. List of items in the Browse Carousel Card. Minimum of two items, maximum of ten.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCardBrowseCarouselCardItem>[]>;
        }
        /**
         * Browsing carousel tile
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCardBrowseCarouselCardItem {
            /**
             * Optional. Description of the carousel item. Maximum of four lines of text.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Text that appears at the bottom of the Browse Carousel Card. Maximum of one line of text.
             */
            footer?: pulumi.Input<string>;
            /**
             * Optional. Hero image for the carousel item.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Required. Action to present to the user.
             */
            openUriAction?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCardBrowseCarouselCardItemOpenUrlAction>;
            /**
             * Required. Title of the carousel item. Maximum of two lines of text.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Actions on Google action to open a given url.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageBrowseCarouselCardBrowseCarouselCardItemOpenUrlAction {
            /**
             * Required. URL
             */
            url?: pulumi.Input<string>;
            /**
             * Optional. Specifies the type of viewer that is used when opening the URL. Defaults to opening via web browser.
             */
            urlTypeHint?: pulumi.Input<string>;
        }
        /**
         * The card response message.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageCard {
            /**
             * Optional. The collection of card buttons.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageCardButton>[]>;
            /**
             * Optional. The public URI to an image file for the card.
             */
            imageUri?: pulumi.Input<string>;
            /**
             * Optional. The subtitle of the card.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Optional. Contains information about a button.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageCardButton {
            /**
             * Optional. The text to send back to the Dialogflow API or a URI to open.
             */
            postback?: pulumi.Input<string>;
            /**
             * Optional. The text to show on the button.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * The card for presenting a carousel of options to select from.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageCarouselSelect {
            /**
             * Required. Carousel items.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageCarouselSelectItem>[]>;
        }
        /**
         * An item in the carousel.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageCarouselSelectItem {
            /**
             * Optional. The body text of the card.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. The image to display.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Required. Additional info about the option item.
             */
            info?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSelectItemInfo>;
            /**
             * Required. Title of the carousel item.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Column properties for TableCard.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageColumnProperties {
            /**
             * Required. Column heading.
             */
            header?: pulumi.Input<string>;
            /**
             * Optional. Defines text alignment for all cells in this column.
             */
            horizontalAlignment?: pulumi.Input<string>;
        }
        /**
         * The image response message.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageImage {
            /**
             * A text description of the image to be used for accessibility, e.g., screen readers. Required if image_uri is set for CarouselSelect.
             */
            accessibilityText?: pulumi.Input<string>;
            /**
             * Optional. The public URI to an image file.
             */
            imageUri?: pulumi.Input<string>;
        }
        /**
         * The suggestion chip message that allows the user to jump out to the app or website associated with this agent.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageLinkOutSuggestion {
            /**
             * Required. The name of the app or site this chip is linking to.
             */
            destinationName?: pulumi.Input<string>;
            /**
             * Required. The URI of the app or site to open when the user taps the suggestion chip.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * The card for presenting a list of options to select from.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageListSelect {
            /**
             * Required. List items.
             */
            items?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageListSelectItem>[]>;
            /**
             * Optional. Subtitle of the list.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Optional. The overall title of the list.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * An item in the list.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageListSelectItem {
            /**
             * Optional. The main text describing the item.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. The image to display.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Required. Additional information about this option.
             */
            info?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSelectItemInfo>;
            /**
             * Required. The title of the list item.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The media content card for Actions on Google.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageMediaContent {
            /**
             * Required. List of media objects.
             */
            mediaObjects?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageMediaContentResponseMediaObject>[]>;
            /**
             * Optional. What type of media is the content (ie "audio").
             */
            mediaType?: pulumi.Input<string>;
        }
        /**
         * Response media object for media content card.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageMediaContentResponseMediaObject {
            /**
             * Required. Url where the media is stored.
             */
            contentUrl?: pulumi.Input<string>;
            /**
             * Optional. Description of media card.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Icon to display above media content.
             */
            icon?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Optional. Image to display above media content.
             */
            largeImage?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Required. Name of media card.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The quick replies response message.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageQuickReplies {
            /**
             * Optional. The collection of quick replies.
             */
            quickReplies?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The title of the collection of quick replies.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Rich Business Messaging (RBM) Card content
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmCardContent {
            /**
             * Optional. Description of the card (at most 2000 bytes). At least one of the title, description or media must be set.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. However at least one of the title, description or media must be set. Media (image, GIF or a video) to include in the card.
             */
            media?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmCardContentRbmMedia>;
            /**
             * Optional. List of suggestions to include in the card.
             */
            suggestions?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestion>[]>;
            /**
             * Optional. Title of the card (at most 200 bytes). At least one of the title, description or media must be set.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Rich Business Messaging (RBM) Media displayed in Cards The following media-types are currently supported: Image Types * image/jpeg * image/jpg' * image/gif * image/png Video Types * video/h263 * video/m4v * video/mp4 * video/mpeg * video/mpeg4 * video/webm
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmCardContentRbmMedia {
            /**
             * Required. Publicly reachable URI of the file. The RBM platform determines the MIME type of the file from the content-type field in the HTTP headers when the platform fetches the file. The content-type field must be present and accurate in the HTTP response from the URL.
             */
            fileUri?: pulumi.Input<string>;
            /**
             * Required for cards with vertical orientation. The height of the media within a rich card with a vertical layout. For a standalone card with horizontal layout, height is not customizable, and this field is ignored.
             */
            height?: pulumi.Input<string>;
            /**
             * Optional. Publicly reachable URI of the thumbnail.If you don't provide a thumbnail URI, the RBM platform displays a blank placeholder thumbnail until the user's device downloads the file. Depending on the user's setting, the file may not download automatically and may require the user to tap a download button.
             */
            thumbnailUri?: pulumi.Input<string>;
        }
        /**
         * Carousel Rich Business Messaging (RBM) rich card. Rich cards allow you to respond to users with more vivid content, e.g. with media and suggestions. If you want to show a single card with more control over the layout, please use RbmStandaloneCard instead.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmCarouselCard {
            /**
             * Required. The cards in the carousel. A carousel must have at least 2 cards and at most 10.
             */
            cardContents?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmCardContent>[]>;
            /**
             * Required. The width of the cards in the carousel.
             */
            cardWidth?: pulumi.Input<string>;
        }
        /**
         * Standalone Rich Business Messaging (RBM) rich card. Rich cards allow you to respond to users with more vivid content, e.g. with media and suggestions. You can group multiple rich cards into one using RbmCarouselCard but carousel cards will give you less control over the card layout.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmStandaloneCard {
            /**
             * Required. Card content.
             */
            cardContent?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmCardContent>;
            /**
             * Required. Orientation of the card.
             */
            cardOrientation?: pulumi.Input<string>;
            /**
             * Required if orientation is horizontal. Image preview alignment for standalone cards with horizontal layout.
             */
            thumbnailImageAlignment?: pulumi.Input<string>;
        }
        /**
         * Rich Business Messaging (RBM) suggested client-side action that the user can choose from the card.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedAction {
            /**
             * Suggested client side action: Dial a phone number
             */
            dial?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionDial>;
            /**
             * Suggested client side action: Open a URI on device
             */
            openUrl?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionOpenUri>;
            /**
             * Opaque payload that the Dialogflow receives in a user event when the user taps the suggested action. This data will be also forwarded to webhook to allow performing custom business logic.
             */
            postbackData?: pulumi.Input<string>;
            /**
             * Suggested client side action: Share user location
             */
            shareLocation?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionShareLocation>;
            /**
             * Text to display alongside the action.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Opens the user's default dialer app with the specified phone number but does not dial automatically.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionDial {
            /**
             * Required. The phone number to fill in the default dialer app. This field should be in [E.164](https://en.wikipedia.org/wiki/E.164) format. An example of a correctly formatted phone number: +15556767888.
             */
            phoneNumber?: pulumi.Input<string>;
        }
        /**
         * Opens the user's default web browser app to the specified uri If the user has an app installed that is registered as the default handler for the URL, then this app will be opened instead, and its icon will be used in the suggested action UI.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionOpenUri {
            /**
             * Required. The uri to open on the user device
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Opens the device's location chooser so the user can pick a location to send back to the agent.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedActionRbmSuggestedActionShareLocation {
        }
        /**
         * Rich Business Messaging (RBM) suggested reply that the user can click instead of typing in their own response.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedReply {
            /**
             * Opaque payload that the Dialogflow receives in a user event when the user taps the suggested reply. This data will be also forwarded to webhook to allow performing custom business logic.
             */
            postbackData?: pulumi.Input<string>;
            /**
             * Suggested reply text.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Rich Business Messaging (RBM) suggestion. Suggestions allow user to easily select/click a predefined response or perform an action (like opening a web uri).
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestion {
            /**
             * Predefined client side actions that user can choose
             */
            action?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedAction>;
            /**
             * Predefined replies for user to select instead of typing
             */
            reply?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestedReply>;
        }
        /**
         * Rich Business Messaging (RBM) text response with suggestions.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageRbmText {
            /**
             * Optional. One or more suggestions to show to the user.
             */
            rbmSuggestion?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageRbmSuggestion>[]>;
            /**
             * Required. Text sent and displayed to the user.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Additional info about the select item for when it is triggered in a dialog.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageSelectItemInfo {
            /**
             * Required. A unique key that will be sent back to the agent if this response is given.
             */
            key?: pulumi.Input<string>;
            /**
             * Optional. A list of synonyms that can also be used to trigger this item in dialog.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The simple response message containing speech or text.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageSimpleResponse {
            /**
             * Optional. The text to display.
             */
            displayText?: pulumi.Input<string>;
            /**
             * One of text_to_speech or ssml must be provided. Structured spoken response to the user in the SSML format. Mutually exclusive with text_to_speech.
             */
            ssml?: pulumi.Input<string>;
            /**
             * One of text_to_speech or ssml must be provided. The plain text of the speech output. Mutually exclusive with ssml.
             */
            textToSpeech?: pulumi.Input<string>;
        }
        /**
         * The collection of simple response candidates. This message in `QueryResult.fulfillment_messages` and `WebhookResponse.fulfillment_messages` should contain only one `SimpleResponse`.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageSimpleResponses {
            /**
             * Required. The list of simple responses.
             */
            simpleResponses?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSimpleResponse>[]>;
        }
        /**
         * The suggestion chip message that the user can tap to quickly post a reply to the conversation.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageSuggestion {
            /**
             * Required. The text shown the in the suggestion chip.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The collection of suggestions.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageSuggestions {
            /**
             * Required. The list of suggested replies.
             */
            suggestions?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageSuggestion>[]>;
        }
        /**
         * Table card for Actions on Google.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTableCard {
            /**
             * Optional. List of buttons for the card.
             */
            buttons?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageBasicCardButton>[]>;
            /**
             * Optional. Display properties for the columns in this table.
             */
            columnProperties?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageColumnProperties>[]>;
            /**
             * Optional. Image which should be displayed on the card.
             */
            image?: pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageImage>;
            /**
             * Optional. Rows in this table of data.
             */
            rows?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTableCardRow>[]>;
            /**
             * Optional. Subtitle to the title.
             */
            subtitle?: pulumi.Input<string>;
            /**
             * Required. Title of the card.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Cell of TableCardRow.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTableCardCell {
            /**
             * Required. Text in this cell.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Row of TableCard.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTableCardRow {
            /**
             * Optional. List of cells that make up this row.
             */
            cells?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentMessageTableCardCell>[]>;
            /**
             * Optional. Whether to add a visual divider after this row.
             */
            dividerAfter?: pulumi.Input<boolean>;
        }
        /**
         * Plays audio from a file in Telephony Gateway.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTelephonyPlayAudio {
            /**
             * Required. URI to a Google Cloud Storage object containing the audio to play, e.g., "gs://bucket/object". The object must contain a single channel (mono) of linear PCM audio (2 bytes / sample) at 8kHz. This object must be readable by the `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` service account where is the number of the Telephony Gateway project (usually the same as the Dialogflow agent project). If the Google Cloud Storage bucket is in the Telephony Gateway project, this permission is added by default when enabling the Dialogflow V2 API. For audio from other sources, consider using the `TelephonySynthesizeSpeech` message with SSML.
             */
            audioUri?: pulumi.Input<string>;
        }
        /**
         * Synthesizes speech and plays back the synthesized audio to the caller in Telephony Gateway. Telephony Gateway takes the synthesizer settings from `DetectIntentResponse.output_audio_config` which can either be set at request-level or can come from the agent-level synthesizer config.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTelephonySynthesizeSpeech {
            /**
             * The SSML to be synthesized. For more information, see [SSML](https://developers.google.com/actions/reference/ssml).
             */
            ssml?: pulumi.Input<string>;
            /**
             * The raw text to be synthesized.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Transfers the call in Telephony Gateway.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageTelephonyTransferCall {
            /**
             * Required. The phone number to transfer the call to in [E.164 format](https://en.wikipedia.org/wiki/E.164). We currently only allow transferring to US numbers (+1xxxyyyzzzz).
             */
            phoneNumber?: pulumi.Input<string>;
        }
        /**
         * The text response message.
         */
        interface GoogleCloudDialogflowV2beta1IntentMessageText {
            /**
             * Optional. The collection of the agent's responses.
             */
            text?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents intent parameters.
         */
        interface GoogleCloudDialogflowV2beta1IntentParameter {
            /**
             * Optional. The default value to use when the `value` yields an empty result. Default values can be extracted from contexts by using the following syntax: `#context_name.parameter_name`.
             */
            defaultValue?: pulumi.Input<string>;
            /**
             * Required. The name of the parameter.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Optional. The name of the entity type, prefixed with `@`, that describes values of the parameter. If the parameter is required, this must be provided.
             */
            entityTypeDisplayName?: pulumi.Input<string>;
            /**
             * Optional. Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Optional. Indicates whether the parameter is required. That is, whether the intent cannot be completed without collecting the parameter value.
             */
            mandatory?: pulumi.Input<boolean>;
            /**
             * The unique identifier of this parameter.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. The collection of prompts that the agent can present to the user in order to collect a value for the parameter.
             */
            prompts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The definition of the parameter value. It can be: - a constant string, - a parameter value defined as `$parameter_name`, - an original parameter value defined as `$parameter_name.original`, - a parameter value from some context defined as `#context_name.parameter_name`.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Represents an example that the agent is trained on.
         */
        interface GoogleCloudDialogflowV2beta1IntentTrainingPhrase {
            /**
             * The unique identifier of this training phrase.
             */
            name?: pulumi.Input<string>;
            /**
             * Required. The ordered list of training phrase parts. The parts are concatenated in order to form the training phrase. Note: The API does not automatically annotate training phrases like the Dialogflow Console does. Note: Do not forget to include whitespace at part boundaries, so the training phrase is well formatted when the parts are concatenated. If the training phrase does not need to be annotated with parameters, you just need a single part with only the Part.text field set. If you want to annotate the training phrase, you must create multiple parts, where the fields of each part are populated in one of two ways: - `Part.text` is set to a part of the phrase that has no parameters. - `Part.text` is set to a part of the phrase that you want to annotate, and the `entity_type`, `alias`, and `user_defined` fields are all set.
             */
            parts?: pulumi.Input<pulumi.Input<inputs.dialogflow.v2beta1.GoogleCloudDialogflowV2beta1IntentTrainingPhrasePart>[]>;
            /**
             * Optional. Indicates how many times this example was added to the intent. Each time a developer adds an existing sample by editing an intent or training, this counter is increased.
             */
            timesAddedCount?: pulumi.Input<number>;
            /**
             * Required. The type of the training phrase.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a part of a training phrase.
         */
        interface GoogleCloudDialogflowV2beta1IntentTrainingPhrasePart {
            /**
             * Optional. The parameter name for the value extracted from the annotated part of the example. This field is required for annotated parts of the training phrase.
             */
            alias?: pulumi.Input<string>;
            /**
             * Optional. The entity type name prefixed with `@`. This field is required for annotated parts of the training phrase.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. The text for this part.
             */
            text?: pulumi.Input<string>;
            /**
             * Optional. Indicates whether the text was manually annotated. This field is set to true when the Dialogflow Console is used to manually annotate the part. When creating an annotated part with the API, you must set this to true.
             */
            userDefined?: pulumi.Input<boolean>;
        }
        /**
         * Defines logging behavior for conversation lifecycle events.
         */
        interface GoogleCloudDialogflowV2beta1LoggingConfig {
            /**
             * Whether to log conversation events like CONVERSATION_STARTED to Stackdriver in the conversation project as JSON format ConversationEvent protos.
             */
            enableStackdriverLogging?: pulumi.Input<boolean>;
        }
        /**
         * Defines notification behavior.
         */
        interface GoogleCloudDialogflowV2beta1NotificationConfig {
            /**
             * Format of message.
             */
            messageFormat?: pulumi.Input<string>;
            /**
             * Name of the Pub/Sub topic to publish conversation events like CONVERSATION_STARTED as serialized ConversationEvent protos. Notification works for phone calls, if this topic either is in the same project as the conversation or you grant `service-@gcp-sa-dialogflow.iam.gserviceaccount.com` the `Dialogflow Service Agent` role in the topic project. Format: `projects//locations//topics/`.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Configures speech transcription for ConversationProfile.
         */
        interface GoogleCloudDialogflowV2beta1SpeechToTextConfig {
            /**
             * Optional. The speech model used in speech to text. `SPEECH_MODEL_VARIANT_UNSPECIFIED`, `USE_BEST_AVAILABLE` will be treated as `USE_ENHANCED`. It can be overridden in AnalyzeContentRequest and StreamingAnalyzeContentRequest request.
             */
            speechModelVariant?: pulumi.Input<string>;
        }
        /**
         * The type of Human Agent Assistant API suggestion to perform, and the maximum number of results to return for that type. Multiple `Feature` objects can be specified in the `features` list.
         */
        interface GoogleCloudDialogflowV2beta1SuggestionFeature {
            /**
             * Type of Human Agent Assistant API feature to request.
             */
            type?: pulumi.Input<string>;
        }
    }
    namespace v3 {
        /**
         * Represents the natural speech audio to be processed.
         */
        interface GoogleCloudDialogflowCxV3AudioInput {
            /**
             * The natural language speech audio to be processed. A single request can contain up to 1 minute of speech audio data. The transcribed text cannot contain more than 256 bytes. For non-streaming audio detect intent, both `config` and `audio` must be provided. For streaming audio detect intent, `config` must be provided in the first request and `audio` must be provided in all following requests.
             */
            audio?: pulumi.Input<string>;
            /**
             * Required. Instructs the speech recognizer how to process the speech audio.
             */
            config?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3InputAudioConfig>;
        }
        /**
         * One interaction between a human and virtual agent. The human provides some input and the virtual agent provides a response.
         */
        interface GoogleCloudDialogflowCxV3ConversationTurn {
            /**
             * The user input.
             */
            userInput?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ConversationTurnUserInput>;
            /**
             * The virtual agent output.
             */
            virtualAgentOutput?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ConversationTurnVirtualAgentOutput>;
        }
        /**
         * The input from the human user.
         */
        interface GoogleCloudDialogflowCxV3ConversationTurnUserInput {
            /**
             * Parameters that need to be injected into the conversation during intent detection.
             */
            injectedParameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Supports text input, event input, dtmf input in the test case.
             */
            input?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3QueryInput>;
            /**
             * If webhooks should be allowed to trigger in response to the user utterance. Often if parameters are injected, webhooks should not be enabled.
             */
            isWebhookEnabled?: pulumi.Input<boolean>;
        }
        /**
         * The output from the virtual agent.
         */
        interface GoogleCloudDialogflowCxV3ConversationTurnVirtualAgentOutput {
            /**
             * The Page on which the utterance was spoken. Only name and displayName will be set.
             */
            currentPage?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Page>;
            /**
             * Required. Input only. The diagnostic info output for the turn.
             */
            diagnosticInfo?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The session parameters available to the bot at this point.
             */
            sessionParameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Response error from the agent in the test result. If set, other output is empty.
             */
            status?: pulumi.Input<inputs.dialogflow.v3.GoogleRpcStatus>;
            /**
             * The text responses from the agent for the turn.
             */
            textResponses?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessageText>[]>;
            /**
             * The Intent that triggered the response. Only name and displayName will be set.
             */
            triggeredIntent?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Intent>;
        }
        /**
         * Represents the input for dtmf event.
         */
        interface GoogleCloudDialogflowCxV3DtmfInput {
            /**
             * The dtmf digits.
             */
            digits?: pulumi.Input<string>;
            /**
             * The finish digit (if any).
             */
            finishDigit?: pulumi.Input<string>;
        }
        /**
         * An **entity entry** for an associated entity type.
         */
        interface GoogleCloudDialogflowCxV3EntityTypeEntity {
            /**
             * Required. A collection of value synonyms. For example, if the entity type is *vegetable*, and `value` is *scallions*, a synonym could be *green onions*. For `KIND_LIST` entity types: * This collection must contain exactly one synonym equal to `value`.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The primary value associated with this entity entry. For example, if the entity type is *vegetable*, the value could be *scallions*. For `KIND_MAP` entity types: * A canonical value to be used in place of synonyms. For `KIND_LIST` entity types: * A string that can contain references to other entity types (with or without aliases).
             */
            value?: pulumi.Input<string>;
        }
        /**
         * An excluded entity phrase that should not be matched.
         */
        interface GoogleCloudDialogflowCxV3EntityTypeExcludedPhrase {
            /**
             * Required. The word or phrase to be excluded.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Configuration for the version.
         */
        interface GoogleCloudDialogflowCxV3EnvironmentVersionConfig {
            /**
             * Required. Format: projects//locations//agents//flows//versions/.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * An event handler specifies an event that can be handled during a session. When the specified event happens, the following actions are taken in order: * If there is a `trigger_fulfillment` associated with the event, it will be called. * If there is a `target_page` associated with the event, the session will transition into the specified page. * If there is a `target_flow` associated with the event, the session will transition into the specified flow.
         */
        interface GoogleCloudDialogflowCxV3EventHandler {
            /**
             * Required. The name of the event to handle.
             */
            event?: pulumi.Input<string>;
            /**
             * The target flow to transition to. Format: `projects//locations//agents//flows/`.
             */
            targetFlow?: pulumi.Input<string>;
            /**
             * The target page to transition to. Format: `projects//locations//agents//flows//pages/`.
             */
            targetPage?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the event occurs. Handling webhook errors with a fulfillment enabled with webhook could cause infinite loop. It is invalid to specify such fulfillment for a handler handling webhooks.
             */
            triggerFulfillment?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Fulfillment>;
        }
        /**
         * Represents the event to trigger.
         */
        interface GoogleCloudDialogflowCxV3EventInput {
            /**
             * Name of the event.
             */
            event?: pulumi.Input<string>;
        }
        /**
         * Definition of the experiment.
         */
        interface GoogleCloudDialogflowCxV3ExperimentDefinition {
            /**
             * The condition defines which subset of sessions are selected for this experiment. If not specified, all sessions are eligible. E.g. "query_input.language_code=en" See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition).
             */
            condition?: pulumi.Input<string>;
            /**
             * The flow versions as the variants of this experiment.
             */
            versionVariants?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3VersionVariants>;
        }
        /**
         * The inference result which includes an objective metric to optimize and the confidence interval.
         */
        interface GoogleCloudDialogflowCxV3ExperimentResult {
            /**
             * The last time the experiment's stats data was updated. Will have default value if stats have never been computed for this experiment.
             */
            lastUpdateTime?: pulumi.Input<string>;
            /**
             * Version variants and metrics.
             */
            versionMetrics?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ExperimentResultVersionMetrics>[]>;
        }
        /**
         * A confidence interval is a range of possible values for the experiment objective you are trying to measure.
         */
        interface GoogleCloudDialogflowCxV3ExperimentResultConfidenceInterval {
            /**
             * The confidence level used to construct the interval, i.e. there is X% chance that the true value is within this interval.
             */
            confidenceLevel?: pulumi.Input<number>;
            /**
             * Lower bound of the interval.
             */
            lowerBound?: pulumi.Input<number>;
            /**
             * The percent change between an experiment metric's value and the value for its control.
             */
            ratio?: pulumi.Input<number>;
            /**
             * Upper bound of the interval.
             */
            upperBound?: pulumi.Input<number>;
        }
        /**
         * Metric and corresponding confidence intervals.
         */
        interface GoogleCloudDialogflowCxV3ExperimentResultMetric {
            /**
             * The probability that the treatment is better than all other treatments in the experiment
             */
            confidenceInterval?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ExperimentResultConfidenceInterval>;
            /**
             * Count value of a metric.
             */
            count?: pulumi.Input<number>;
            /**
             * Count-based metric type. Only one of type or count_type is specified in each Metric.
             */
            countType?: pulumi.Input<string>;
            /**
             * Ratio value of a metric.
             */
            ratio?: pulumi.Input<number>;
            /**
             * Ratio-based metric type. Only one of type or count_type is specified in each Metric.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Version variant and associated metrics.
         */
        interface GoogleCloudDialogflowCxV3ExperimentResultVersionMetrics {
            /**
             * The metrics and corresponding confidence intervals in the inference result.
             */
            metrics?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ExperimentResultMetric>[]>;
            /**
             * Number of sessions that were allocated to this version.
             */
            sessionCount?: pulumi.Input<number>;
            /**
             * The name of the flow Version. Format: `projects//locations//agents//flows//versions/`.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * A form is a data model that groups related parameters that can be collected from the user. The process in which the agent prompts the user and collects parameter values from the user is called form filling. A form can be added to a page. When form filling is done, the filled parameters will be written to the session.
         */
        interface GoogleCloudDialogflowCxV3Form {
            /**
             * Parameters to collect from the user.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FormParameter>[]>;
        }
        /**
         * Represents a form parameter.
         */
        interface GoogleCloudDialogflowCxV3FormParameter {
            /**
             * The default value of an optional parameter. If the parameter is required, the default value will be ignored.
             */
            defaultValue?: any;
            /**
             * Required. The human-readable name of the parameter, unique within the form.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Required. The entity type of the parameter. Format: `projects/-/locations/-/agents/-/entityTypes/` for system entity types (for example, `projects/-/locations/-/agents/-/entityTypes/sys.date`), or `projects//locations//agents//entityTypes/` for developer entity types.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. Defines fill behavior for the parameter.
             */
            fillBehavior?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FormParameterFillBehavior>;
            /**
             * Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter content should be redacted in log. If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled.
             */
            redact?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them. Required parameters must be filled before form filling concludes.
             */
            required?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for how the filling of a parameter should be handled.
         */
        interface GoogleCloudDialogflowCxV3FormParameterFillBehavior {
            /**
             * Required. The fulfillment to provide the initial prompt that the agent can present to the user in order to fill the parameter.
             */
            initialPromptFulfillment?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Fulfillment>;
            /**
             * The handlers for parameter-level events, used to provide reprompt for the parameter or transition to a different page/flow. The supported events are: * `sys.no-match-`, where N can be from 1 to 6 * `sys.no-match-default` * `sys.no-input-`, where N can be from 1 to 6 * `sys.no-input-default` * `sys.invalid-parameter` `initial_prompt_fulfillment` provides the first prompt for the parameter. If the user's response does not fill the parameter, a no-match/no-input event will be triggered, and the fulfillment associated with the `sys.no-match-1`/`sys.no-input-1` handler (if defined) will be called to provide a prompt. The `sys.no-match-2`/`sys.no-input-2` handler (if defined) will respond to the next no-match/no-input event, and so on. A `sys.no-match-default` or `sys.no-input-default` handler will be used to handle all following no-match/no-input events after all numbered no-match/no-input handlers for the parameter are consumed. A `sys.invalid-parameter` handler can be defined to handle the case where the parameter values have been `invalidated` by webhook. For example, if the user's response fill the parameter, however the parameter was invalidated by webhook, the fulfillment associated with the `sys.invalid-parameter` handler (if defined) will be called to provide a prompt. If the event handler for the corresponding event can't be found on the parameter, `initial_prompt_fulfillment` will be re-prompted.
             */
            repromptEventHandlers?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3EventHandler>[]>;
        }
        /**
         * A fulfillment can do one or more of the following actions at the same time: * Generate rich message responses. * Set parameter values. * Call the webhook. Fulfillments can be called at various stages in the Page or Form lifecycle. For example, when a DetectIntentRequest drives a session to enter a new page, the page's entry fulfillment can add a static response to the QueryResult in the returning DetectIntentResponse, call the webhook (for example, to load user data from a database), or both.
         */
        interface GoogleCloudDialogflowCxV3Fulfillment {
            /**
             * Conditional cases for this fulfillment.
             */
            conditionalCases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FulfillmentConditionalCases>[]>;
            /**
             * The list of rich message responses to present to the user.
             */
            messages?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessage>[]>;
            /**
             * Set parameter values before executing the webhook.
             */
            setParameterActions?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FulfillmentSetParameterAction>[]>;
            /**
             * The tag used by the webhook to identify which fulfillment is being called. This field is required if `webhook` is specified.
             */
            tag?: pulumi.Input<string>;
            /**
             * The webhook to call. Format: `projects//locations//agents//webhooks/`.
             */
            webhook?: pulumi.Input<string>;
        }
        /**
         * A list of cascading if-else conditions. Cases are mutually exclusive. The first one with a matching condition is selected, all the rest ignored.
         */
        interface GoogleCloudDialogflowCxV3FulfillmentConditionalCases {
            /**
             * A list of cascading if-else conditions.
             */
            cases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FulfillmentConditionalCasesCase>[]>;
        }
        /**
         * Each case has a Boolean condition. When it is evaluated to be True, the corresponding messages will be selected and evaluated recursively.
         */
        interface GoogleCloudDialogflowCxV3FulfillmentConditionalCasesCase {
            /**
             * A list of case content.
             */
            caseContent?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FulfillmentConditionalCasesCaseCaseContent>[]>;
            /**
             * The condition to activate and select this case. Empty means the condition is always true. The condition is evaluated against form parameters or session parameters. See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition).
             */
            condition?: pulumi.Input<string>;
        }
        /**
         * The list of messages or conditional cases to activate for this case.
         */
        interface GoogleCloudDialogflowCxV3FulfillmentConditionalCasesCaseCaseContent {
            /**
             * Additional cases to be evaluated.
             */
            additionalCases?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3FulfillmentConditionalCases>;
            /**
             * Returned message.
             */
            message?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessage>;
        }
        /**
         * Setting a parameter value.
         */
        interface GoogleCloudDialogflowCxV3FulfillmentSetParameterAction {
            /**
             * Display name of the parameter.
             */
            parameter?: pulumi.Input<string>;
            /**
             * The new value of the parameter. A null value clears the parameter.
             */
            value?: any;
        }
        /**
         * Instructs the speech recognizer on how to process the audio content.
         */
        interface GoogleCloudDialogflowCxV3InputAudioConfig {
            /**
             * Required. Audio encoding of the audio content to process.
             */
            audioEncoding?: pulumi.Input<string>;
            /**
             * Optional. If `true`, Dialogflow returns SpeechWordInfo in StreamingRecognitionResult with information about the recognized speech words, e.g. start and end time offsets. If false or unspecified, Speech doesn't return any word-level information.
             */
            enableWordInfo?: pulumi.Input<boolean>;
            /**
             * Optional. Which Speech model to select for the given request. Select the model best suited to your domain to get best results. If a model is not explicitly specified, then we auto-select a model based on the parameters in the InputAudioConfig. If enhanced speech model is enabled for the agent and an enhanced version of the specified model for the language does not exist, then the speech is recognized using the standard version of the specified model. Refer to [Cloud Speech API documentation](https://cloud.google.com/speech-to-text/docs/basics#select-model) for more details.
             */
            model?: pulumi.Input<string>;
            /**
             * Optional. Which variant of the Speech model to use.
             */
            modelVariant?: pulumi.Input<string>;
            /**
             * Optional. A list of strings containing words and phrases that the speech recognizer should recognize with higher likelihood. See [the Cloud Speech documentation](https://cloud.google.com/speech-to-text/docs/basics#phrase-hints) for more details.
             */
            phraseHints?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Sample rate (in Hertz) of the audio content sent in the query. Refer to [Cloud Speech API documentation](https://cloud.google.com/speech-to-text/docs/basics) for more details.
             */
            sampleRateHertz?: pulumi.Input<number>;
            /**
             * Optional. If `false` (default), recognition does not cease until the client closes the stream. If `true`, the recognizer will detect a single spoken utterance in input audio. Recognition ceases when it detects the audio's voice has stopped or paused. In this case, once a detected intent is received, the client should close the stream and start a new request with a new stream as needed. Note: This setting is relevant only for streaming methods.
             */
            singleUtterance?: pulumi.Input<boolean>;
        }
        /**
         * An intent represents a user's intent to interact with a conversational agent. You can provide information for the Dialogflow API to use to match user input to an intent by adding training phrases (i.e., examples of user input) to your intent.
         */
        interface GoogleCloudDialogflowCxV3Intent {
            /**
             * Optional. Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. The human-readable name of the intent, unique within the agent.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation. Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.
             */
            isFallback?: pulumi.Input<boolean>;
            /**
             * Optional. The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes. Prefix "sys." is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys.head * sys.contextual The above labels do not require value. "sys.head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The unique identifier of the intent. Required for the Intents.UpdateIntent method. Intents.CreateIntent populates the name automatically. Format: `projects//locations//agents//intents/`.
             */
            name?: pulumi.Input<string>;
            /**
             * The collection of parameters associated with the intent.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3IntentParameter>[]>;
            /**
             * The priority of this intent. Higher numbers represent higher priorities. - If the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the `Normal` priority in the console. - If the supplied value is negative, the intent is ignored in runtime detect intent requests.
             */
            priority?: pulumi.Input<number>;
            /**
             * The collection of training phrases the agent is trained on to identify the intent.
             */
            trainingPhrases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3IntentTrainingPhrase>[]>;
        }
        /**
         * Represents the intent to trigger programmatically rather than as a result of natural language processing.
         */
        interface GoogleCloudDialogflowCxV3IntentInput {
            /**
             * Required. The unique identifier of the intent. Format: `projects//locations//agents//intents/`.
             */
            intent?: pulumi.Input<string>;
        }
        /**
         * Represents an intent parameter.
         */
        interface GoogleCloudDialogflowCxV3IntentParameter {
            /**
             * Required. The entity type of the parameter. Format: `projects/-/locations/-/agents/-/entityTypes/` for system entity types (for example, `projects/-/locations/-/agents/-/entityTypes/sys.date`), or `projects//locations//agents//entityTypes/` for developer entity types.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. The unique identifier of the parameter. This field is used by training phrases to annotate their parts.
             */
            id?: pulumi.Input<string>;
            /**
             * Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter content should be redacted in log. If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled.
             */
            redact?: pulumi.Input<boolean>;
        }
        /**
         * Represents an example that the agent is trained on to identify the intent.
         */
        interface GoogleCloudDialogflowCxV3IntentTrainingPhrase {
            /**
             * The unique identifier of the training phrase.
             */
            id?: pulumi.Input<string>;
            /**
             * Required. The ordered list of training phrase parts. The parts are concatenated in order to form the training phrase. Note: The API does not automatically annotate training phrases like the Dialogflow Console does. Note: Do not forget to include whitespace at part boundaries, so the training phrase is well formatted when the parts are concatenated. If the training phrase does not need to be annotated with parameters, you just need a single part with only the Part.text field set. If you want to annotate the training phrase, you must create multiple parts, where the fields of each part are populated in one of two ways: - `Part.text` is set to a part of the phrase that has no parameters. - `Part.text` is set to a part of the phrase that you want to annotate, and the `parameter_id` field is set.
             */
            parts?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3IntentTrainingPhrasePart>[]>;
            /**
             * Indicates how many times this example was added to the intent.
             */
            repeatCount?: pulumi.Input<number>;
        }
        /**
         * Represents a part of a training phrase.
         */
        interface GoogleCloudDialogflowCxV3IntentTrainingPhrasePart {
            /**
             * The parameter used to annotate this part of the training phrase. This field is required for annotated parts of the training phrase.
             */
            parameterId?: pulumi.Input<string>;
            /**
             * Required. The text for this part.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Settings related to NLU.
         */
        interface GoogleCloudDialogflowCxV3NluSettings {
            /**
             * To filter out false positive results and still get variety in matched natural language inputs for your agent, you can tune the machine learning classification threshold. If the returned score value is less than the threshold value, then a no-match event will be triggered. The score values range from 0.0 (completely uncertain) to 1.0 (completely certain). If set to 0.0, the default of 0.3 is used.
             */
            classificationThreshold?: pulumi.Input<number>;
            /**
             * Indicates NLU model training mode.
             */
            modelTrainingMode?: pulumi.Input<string>;
            /**
             * Indicates the type of NLU model.
             */
            modelType?: pulumi.Input<string>;
        }
        /**
         * A Dialogflow CX conversation (session) can be described and visualized as a state machine. The states of a CX session are represented by pages. For each flow, you define many pages, where your combined pages can handle a complete conversation on the topics the flow is designed for. At any given moment, exactly one page is the current page, the current page is considered active, and the flow associated with that page is considered active. Every flow has a special start page. When a flow initially becomes active, the start page page becomes the current page. For each conversational turn, the current page will either stay the same or transition to another page. You configure each page to collect information from the end-user that is relevant for the conversational state represented by the page. For more information, see the [Page guide](https://cloud.google.com/dialogflow/cx/docs/concept/page).
         */
        interface GoogleCloudDialogflowCxV3Page {
            /**
             * Required. The human-readable name of the page, unique within the agent.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the session is entering the page.
             */
            entryFulfillment?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Fulfillment>;
            /**
             * Handlers associated with the page to handle events such as webhook errors, no match or no input.
             */
            eventHandlers?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3EventHandler>[]>;
            /**
             * The form associated with the page, used for collecting parameters relevant to the page.
             */
            form?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Form>;
            /**
             * The unique identifier of the page. Required for the Pages.UpdatePage method. Pages.CreatePage populates the name automatically. Format: `projects//locations//agents//flows//pages/`.
             */
            name?: pulumi.Input<string>;
            /**
             * Ordered list of `TransitionRouteGroups` associated with the page. Transition route groups must be unique within a page. * If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes. * If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence. Format:`projects//locations//agents//flows//transitionRouteGroups/`.
             */
            transitionRouteGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow. When we are in a certain page, the TransitionRoutes are evalauted in the following order: * TransitionRoutes defined in the page with intent specified. * TransitionRoutes defined in the transition route groups with intent specified. * TransitionRoutes defined in flow with intent specified. * TransitionRoutes defined in the transition route groups with intent specified. * TransitionRoutes defined in the page with only condition specified. * TransitionRoutes defined in the transition route groups with only condition specified.
             */
            transitionRoutes?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3TransitionRoute>[]>;
        }
        /**
         * Represents the query input. It can contain one of: 1. A conversational query in the form of text. 2. An intent query that specifies which intent to trigger. 3. Natural language speech audio to be processed. 4. An event to be triggered.
         */
        interface GoogleCloudDialogflowCxV3QueryInput {
            /**
             * The natural language speech audio to be processed.
             */
            audio?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3AudioInput>;
            /**
             * The DTMF event to be handled.
             */
            dtmf?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3DtmfInput>;
            /**
             * The event to be triggered.
             */
            event?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3EventInput>;
            /**
             * The intent to be triggered.
             */
            intent?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3IntentInput>;
            /**
             * Required. The language of the input. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. Note that queries in the same session do not necessarily need to specify the same language.
             */
            languageCode?: pulumi.Input<string>;
            /**
             * The natural language text to be processed.
             */
            text?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3TextInput>;
        }
        /**
         * Represents a response message that can be returned by a conversational agent. Response messages are also used for output audio synthesis. The approach is as follows: * If at least one OutputAudioText response is present, then all OutputAudioText responses are linearly concatenated, and the result is used for output audio synthesis. * If the OutputAudioText responses are a mixture of text and SSML, then the concatenated result is treated as SSML; otherwise, the result is treated as either text or SSML as appropriate. The agent designer should ideally use either text or SSML consistently throughout the bot design. * Otherwise, all Text responses are linearly concatenated, and the result is used for output audio synthesis. This approach allows for more sophisticated user experience scenarios, where the text displayed to the user may differ from what is heard.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessage {
            /**
             * Indicates that the conversation succeeded.
             */
            conversationSuccess?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessageConversationSuccess>;
            /**
             * Hands off conversation to a human agent.
             */
            liveAgentHandoff?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessageLiveAgentHandoff>;
            /**
             * A text or ssml response that is preferentially used for TTS output audio synthesis, as described in the comment on the ResponseMessage message.
             */
            outputAudioText?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessageOutputAudioText>;
            /**
             * Returns a response containing a custom, platform-specific payload.
             */
            payload?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Signal that the client should play an audio clip hosted at a client-specific URI. Dialogflow uses this to construct mixed_audio. However, Dialogflow itself does not try to read or process the URI in any way.
             */
            playAudio?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessagePlayAudio>;
            /**
             * Returns a text response.
             */
            text?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ResponseMessageText>;
        }
        /**
         * Indicates that the conversation succeeded, i.e., the bot handled the issue that the customer talked to it about. Dialogflow only uses this to determine which conversations should be counted as successful and doesn't process the metadata in this message in any way. Note that Dialogflow also considers conversations that get to the conversation end page as successful even if they don't return ConversationSuccess. You may set this, for example: * In the entry_fulfillment of a Page if entering the page indicates that the conversation succeeded. * In a webhook response when you determine that you handled the customer issue.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessageConversationSuccess {
            /**
             * Custom metadata. Dialogflow doesn't impose any structure on this.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Indicates that the conversation should be handed off to a live agent. Dialogflow only uses this to determine which conversations were handed off to a human agent for measurement purposes. What else to do with this signal is up to you and your handoff procedures. You may set this, for example: * In the entry_fulfillment of a Page if entering the page indicates something went extremely wrong in the conversation. * In a webhook response when you determine that the customer issue can only be handled by a human.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessageLiveAgentHandoff {
            /**
             * Custom metadata for your handoff procedure. Dialogflow doesn't impose any structure on this.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A text or ssml response that is preferentially used for TTS output audio synthesis, as described in the comment on the ResponseMessage message.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessageOutputAudioText {
            /**
             * The SSML text to be synthesized. For more information, see [SSML](/speech/text-to-speech/docs/ssml).
             */
            ssml?: pulumi.Input<string>;
            /**
             * The raw text to be synthesized.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Specifies an audio clip to be played by the client as part of the response.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessagePlayAudio {
            /**
             * Required. URI of the audio clip. Dialogflow does not impose any validation on this value. It is specific to the client that reads it.
             */
            audioUri?: pulumi.Input<string>;
        }
        /**
         * The text response message.
         */
        interface GoogleCloudDialogflowCxV3ResponseMessageText {
            /**
             * Required. A collection of text responses.
             */
            text?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings related to speech recognition.
         */
        interface GoogleCloudDialogflowCxV3SpeechToTextSettings {
            /**
             * Whether to use speech adaptation for speech recognition.
             */
            enableSpeechAdaptation?: pulumi.Input<boolean>;
        }
        /**
         * Represents a result from running a test case in an agent environment.
         */
        interface GoogleCloudDialogflowCxV3TestCaseResult {
            /**
             * The conversation turns uttered during the test case replay in chronological order.
             */
            conversationTurns?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3ConversationTurn>[]>;
            /**
             * Environment where the test was run. If not set, it indicates the draft environment.
             */
            environment?: pulumi.Input<string>;
            /**
             * The resource name for the test case result. Format: `projects//locations//agents//testCases/ /results/`.
             */
            name?: pulumi.Input<string>;
            /**
             * Whether the test case passed in the agent environment.
             */
            testResult?: pulumi.Input<string>;
            /**
             * The time that the test was run.
             */
            testTime?: pulumi.Input<string>;
        }
        /**
         * Represents configurations for a test case.
         */
        interface GoogleCloudDialogflowCxV3TestConfig {
            /**
             * Flow name. If not set, default start flow is assumed. Format: `projects//locations//agents//flows/`.
             */
            flow?: pulumi.Input<string>;
            /**
             * Session parameters to be compared when calculating differences.
             */
            trackingParameters?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents the natural language text to be processed.
         */
        interface GoogleCloudDialogflowCxV3TextInput {
            /**
             * Required. The UTF-8 encoded natural language text to be processed. Text length must not exceed 256 characters.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * A transition route specifies a intent that can be matched and/or a data condition that can be evaluated during a session. When a specified transition is matched, the following actions are taken in order: * If there is a `trigger_fulfillment` associated with the transition, it will be called. * If there is a `target_page` associated with the transition, the session will transition into the specified page. * If there is a `target_flow` associated with the transition, the session will transition into the specified flow.
         */
        interface GoogleCloudDialogflowCxV3TransitionRoute {
            /**
             * The condition to evaluate against form parameters or session parameters. See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition). At least one of `intent` or `condition` must be specified. When both `intent` and `condition` are specified, the transition can only happen when both are fulfilled.
             */
            condition?: pulumi.Input<string>;
            /**
             * The unique identifier of an Intent. Format: `projects//locations//agents//intents/`. Indicates that the transition can only happen when the given intent is matched. At least one of `intent` or `condition` must be specified. When both `intent` and `condition` are specified, the transition can only happen when both are fulfilled.
             */
            intent?: pulumi.Input<string>;
            /**
             * The target flow to transition to. Format: `projects//locations//agents//flows/`.
             */
            targetFlow?: pulumi.Input<string>;
            /**
             * The target page to transition to. Format: `projects//locations//agents//flows//pages/`.
             */
            targetPage?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the condition is satisfied. At least one of `trigger_fulfillment` and `target` must be specified. When both are defined, `trigger_fulfillment` is executed first.
             */
            triggerFulfillment?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3Fulfillment>;
        }
        /**
         * The history of variants update.
         */
        interface GoogleCloudDialogflowCxV3VariantsHistory {
            /**
             * Update time of the variants.
             */
            updateTime?: pulumi.Input<string>;
            /**
             * The flow versions as the variants.
             */
            versionVariants?: pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3VersionVariants>;
        }
        /**
         * A list of flow version variants.
         */
        interface GoogleCloudDialogflowCxV3VersionVariants {
            /**
             * A list of flow version variants.
             */
            variants?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3.GoogleCloudDialogflowCxV3VersionVariantsVariant>[]>;
        }
        /**
         * A single flow version with specified traffic allocation.
         */
        interface GoogleCloudDialogflowCxV3VersionVariantsVariant {
            /**
             * Whether the variant is for the control group.
             */
            isControlGroup?: pulumi.Input<boolean>;
            /**
             * Percentage of the traffic which should be routed to this version of flow. Traffic allocation for a single flow must sum up to 1.0.
             */
            trafficAllocation?: pulumi.Input<number>;
            /**
             * The name of the flow version. Format: `projects//locations//agents//flows//versions/`.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Represents configuration for a generic web service.
         */
        interface GoogleCloudDialogflowCxV3WebhookGenericWebService {
            /**
             * The password for HTTP Basic authentication.
             */
            password?: pulumi.Input<string>;
            /**
             * The HTTP request headers to send together with webhook requests.
             */
            requestHeaders?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Required. The webhook URI for receiving POST requests. It must use https protocol.
             */
            uri?: pulumi.Input<string>;
            /**
             * The user name for HTTP Basic authentication.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface GoogleRpcStatus {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
    namespace v3beta1 {
        /**
         * Represents the natural speech audio to be processed.
         */
        interface GoogleCloudDialogflowCxV3beta1AudioInput {
            /**
             * The natural language speech audio to be processed. A single request can contain up to 1 minute of speech audio data. The transcribed text cannot contain more than 256 bytes. For non-streaming audio detect intent, both `config` and `audio` must be provided. For streaming audio detect intent, `config` must be provided in the first request and `audio` must be provided in all following requests.
             */
            audio?: pulumi.Input<string>;
            /**
             * Required. Instructs the speech recognizer how to process the speech audio.
             */
            config?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1InputAudioConfig>;
        }
        /**
         * One interaction between a human and virtual agent. The human provides some input and the virtual agent provides a response.
         */
        interface GoogleCloudDialogflowCxV3beta1ConversationTurn {
            /**
             * The user input.
             */
            userInput?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ConversationTurnUserInput>;
            /**
             * The virtual agent output.
             */
            virtualAgentOutput?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ConversationTurnVirtualAgentOutput>;
        }
        /**
         * The input from the human user.
         */
        interface GoogleCloudDialogflowCxV3beta1ConversationTurnUserInput {
            /**
             * Parameters that need to be injected into the conversation during intent detection.
             */
            injectedParameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Supports text input, event input, dtmf input in the test case.
             */
            input?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1QueryInput>;
            /**
             * If webhooks should be allowed to trigger in response to the user utterance. Often if parameters are injected, webhooks should not be enabled.
             */
            isWebhookEnabled?: pulumi.Input<boolean>;
        }
        /**
         * The output from the virtual agent.
         */
        interface GoogleCloudDialogflowCxV3beta1ConversationTurnVirtualAgentOutput {
            /**
             * The Page on which the utterance was spoken. Only name and displayName will be set.
             */
            currentPage?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Page>;
            /**
             * Required. Input only. The diagnostic info output for the turn.
             */
            diagnosticInfo?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The session parameters available to the bot at this point.
             */
            sessionParameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Response error from the agent in the test result. If set, other output is empty.
             */
            status?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleRpcStatus>;
            /**
             * The text responses from the agent for the turn.
             */
            textResponses?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessageText>[]>;
            /**
             * The Intent that triggered the response. Only name and displayName will be set.
             */
            triggeredIntent?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Intent>;
        }
        /**
         * Represents the input for dtmf event.
         */
        interface GoogleCloudDialogflowCxV3beta1DtmfInput {
            /**
             * The dtmf digits.
             */
            digits?: pulumi.Input<string>;
            /**
             * The finish digit (if any).
             */
            finishDigit?: pulumi.Input<string>;
        }
        /**
         * An **entity entry** for an associated entity type.
         */
        interface GoogleCloudDialogflowCxV3beta1EntityTypeEntity {
            /**
             * Required. A collection of value synonyms. For example, if the entity type is *vegetable*, and `value` is *scallions*, a synonym could be *green onions*. For `KIND_LIST` entity types: * This collection must contain exactly one synonym equal to `value`.
             */
            synonyms?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The primary value associated with this entity entry. For example, if the entity type is *vegetable*, the value could be *scallions*. For `KIND_MAP` entity types: * A canonical value to be used in place of synonyms. For `KIND_LIST` entity types: * A string that can contain references to other entity types (with or without aliases).
             */
            value?: pulumi.Input<string>;
        }
        /**
         * An excluded entity phrase that should not be matched.
         */
        interface GoogleCloudDialogflowCxV3beta1EntityTypeExcludedPhrase {
            /**
             * Required. The word or phrase to be excluded.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Configuration for the version.
         */
        interface GoogleCloudDialogflowCxV3beta1EnvironmentVersionConfig {
            /**
             * Required. Format: projects//locations//agents//flows//versions/.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * An event handler specifies an event that can be handled during a session. When the specified event happens, the following actions are taken in order: * If there is a `trigger_fulfillment` associated with the event, it will be called. * If there is a `target_page` associated with the event, the session will transition into the specified page. * If there is a `target_flow` associated with the event, the session will transition into the specified flow.
         */
        interface GoogleCloudDialogflowCxV3beta1EventHandler {
            /**
             * Required. The name of the event to handle.
             */
            event?: pulumi.Input<string>;
            /**
             * The target flow to transition to. Format: `projects//locations//agents//flows/`.
             */
            targetFlow?: pulumi.Input<string>;
            /**
             * The target page to transition to. Format: `projects//locations//agents//flows//pages/`.
             */
            targetPage?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the event occurs. Handling webhook errors with a fulfillment enabled with webhook could cause infinite loop. It is invalid to specify such fulfillment for a handler handling webhooks.
             */
            triggerFulfillment?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Fulfillment>;
        }
        /**
         * Represents the event to trigger.
         */
        interface GoogleCloudDialogflowCxV3beta1EventInput {
            /**
             * Name of the event.
             */
            event?: pulumi.Input<string>;
        }
        /**
         * Definition of the experiment.
         */
        interface GoogleCloudDialogflowCxV3beta1ExperimentDefinition {
            /**
             * The condition defines which subset of sessions are selected for this experiment. If not specified, all sessions are eligible. E.g. "query_input.language_code=en" See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition).
             */
            condition?: pulumi.Input<string>;
            /**
             * The flow versions as the variants of this experiment.
             */
            versionVariants?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1VersionVariants>;
        }
        /**
         * The inference result which includes an objective metric to optimize and the confidence interval.
         */
        interface GoogleCloudDialogflowCxV3beta1ExperimentResult {
            /**
             * The last time the experiment's stats data was updated. Will have default value if stats have never been computed for this experiment.
             */
            lastUpdateTime?: pulumi.Input<string>;
            /**
             * Version variants and metrics.
             */
            versionMetrics?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ExperimentResultVersionMetrics>[]>;
        }
        /**
         * A confidence interval is a range of possible values for the experiment objective you are trying to measure.
         */
        interface GoogleCloudDialogflowCxV3beta1ExperimentResultConfidenceInterval {
            /**
             * The confidence level used to construct the interval, i.e. there is X% chance that the true value is within this interval.
             */
            confidenceLevel?: pulumi.Input<number>;
            /**
             * Lower bound of the interval.
             */
            lowerBound?: pulumi.Input<number>;
            /**
             * The percent change between an experiment metric's value and the value for its control.
             */
            ratio?: pulumi.Input<number>;
            /**
             * Upper bound of the interval.
             */
            upperBound?: pulumi.Input<number>;
        }
        /**
         * Metric and corresponding confidence intervals.
         */
        interface GoogleCloudDialogflowCxV3beta1ExperimentResultMetric {
            /**
             * The probability that the treatment is better than all other treatments in the experiment
             */
            confidenceInterval?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ExperimentResultConfidenceInterval>;
            /**
             * Count value of a metric.
             */
            count?: pulumi.Input<number>;
            /**
             * Count-based metric type. Only one of type or count_type is specified in each Metric.
             */
            countType?: pulumi.Input<string>;
            /**
             * Ratio value of a metric.
             */
            ratio?: pulumi.Input<number>;
            /**
             * Ratio-based metric type. Only one of type or count_type is specified in each Metric.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Version variant and associated metrics.
         */
        interface GoogleCloudDialogflowCxV3beta1ExperimentResultVersionMetrics {
            /**
             * The metrics and corresponding confidence intervals in the inference result.
             */
            metrics?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ExperimentResultMetric>[]>;
            /**
             * Number of sessions that were allocated to this version.
             */
            sessionCount?: pulumi.Input<number>;
            /**
             * The name of the flow Version. Format: `projects//locations//agents//flows//versions/`.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * A form is a data model that groups related parameters that can be collected from the user. The process in which the agent prompts the user and collects parameter values from the user is called form filling. A form can be added to a page. When form filling is done, the filled parameters will be written to the session.
         */
        interface GoogleCloudDialogflowCxV3beta1Form {
            /**
             * Parameters to collect from the user.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FormParameter>[]>;
        }
        /**
         * Represents a form parameter.
         */
        interface GoogleCloudDialogflowCxV3beta1FormParameter {
            /**
             * The default value of an optional parameter. If the parameter is required, the default value will be ignored.
             */
            defaultValue?: any;
            /**
             * Required. The human-readable name of the parameter, unique within the form.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Required. The entity type of the parameter. Format: `projects/-/locations/-/agents/-/entityTypes/` for system entity types (for example, `projects/-/locations/-/agents/-/entityTypes/sys.date`), or `projects//locations//agents//entityTypes/` for developer entity types.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. Defines fill behavior for the parameter.
             */
            fillBehavior?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FormParameterFillBehavior>;
            /**
             * Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter content should be redacted in log. If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled.
             */
            redact?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them. Required parameters must be filled before form filling concludes.
             */
            required?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for how the filling of a parameter should be handled.
         */
        interface GoogleCloudDialogflowCxV3beta1FormParameterFillBehavior {
            /**
             * Required. The fulfillment to provide the initial prompt that the agent can present to the user in order to fill the parameter.
             */
            initialPromptFulfillment?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Fulfillment>;
            /**
             * The handlers for parameter-level events, used to provide reprompt for the parameter or transition to a different page/flow. The supported events are: * `sys.no-match-`, where N can be from 1 to 6 * `sys.no-match-default` * `sys.no-input-`, where N can be from 1 to 6 * `sys.no-input-default` * `sys.invalid-parameter` `initial_prompt_fulfillment` provides the first prompt for the parameter. If the user's response does not fill the parameter, a no-match/no-input event will be triggered, and the fulfillment associated with the `sys.no-match-1`/`sys.no-input-1` handler (if defined) will be called to provide a prompt. The `sys.no-match-2`/`sys.no-input-2` handler (if defined) will respond to the next no-match/no-input event, and so on. A `sys.no-match-default` or `sys.no-input-default` handler will be used to handle all following no-match/no-input events after all numbered no-match/no-input handlers for the parameter are consumed. A `sys.invalid-parameter` handler can be defined to handle the case where the parameter values have been `invalidated` by webhook. For example, if the user's response fill the parameter, however the parameter was invalidated by webhook, the fulfillment associated with the `sys.invalid-parameter` handler (if defined) will be called to provide a prompt. If the event handler for the corresponding event can't be found on the parameter, `initial_prompt_fulfillment` will be re-prompted.
             */
            repromptEventHandlers?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1EventHandler>[]>;
        }
        /**
         * A fulfillment can do one or more of the following actions at the same time: * Generate rich message responses. * Set parameter values. * Call the webhook. Fulfillments can be called at various stages in the Page or Form lifecycle. For example, when a DetectIntentRequest drives a session to enter a new page, the page's entry fulfillment can add a static response to the QueryResult in the returning DetectIntentResponse, call the webhook (for example, to load user data from a database), or both.
         */
        interface GoogleCloudDialogflowCxV3beta1Fulfillment {
            /**
             * Conditional cases for this fulfillment.
             */
            conditionalCases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCases>[]>;
            /**
             * The list of rich message responses to present to the user.
             */
            messages?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessage>[]>;
            /**
             * Set parameter values before executing the webhook.
             */
            setParameterActions?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FulfillmentSetParameterAction>[]>;
            /**
             * The tag used by the webhook to identify which fulfillment is being called. This field is required if `webhook` is specified.
             */
            tag?: pulumi.Input<string>;
            /**
             * The webhook to call. Format: `projects//locations//agents//webhooks/`.
             */
            webhook?: pulumi.Input<string>;
        }
        /**
         * A list of cascading if-else conditions. Cases are mutually exclusive. The first one with a matching condition is selected, all the rest ignored.
         */
        interface GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCases {
            /**
             * A list of cascading if-else conditions.
             */
            cases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCasesCase>[]>;
        }
        /**
         * Each case has a Boolean condition. When it is evaluated to be True, the corresponding messages will be selected and evaluated recursively.
         */
        interface GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCasesCase {
            /**
             * A list of case content.
             */
            caseContent?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCasesCaseCaseContent>[]>;
            /**
             * The condition to activate and select this case. Empty means the condition is always true. The condition is evaluated against form parameters or session parameters. See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition).
             */
            condition?: pulumi.Input<string>;
        }
        /**
         * The list of messages or conditional cases to activate for this case.
         */
        interface GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCasesCaseCaseContent {
            /**
             * Additional cases to be evaluated.
             */
            additionalCases?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1FulfillmentConditionalCases>;
            /**
             * Returned message.
             */
            message?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessage>;
        }
        /**
         * Setting a parameter value.
         */
        interface GoogleCloudDialogflowCxV3beta1FulfillmentSetParameterAction {
            /**
             * Display name of the parameter.
             */
            parameter?: pulumi.Input<string>;
            /**
             * The new value of the parameter. A null value clears the parameter.
             */
            value?: any;
        }
        /**
         * Instructs the speech recognizer on how to process the audio content.
         */
        interface GoogleCloudDialogflowCxV3beta1InputAudioConfig {
            /**
             * Required. Audio encoding of the audio content to process.
             */
            audioEncoding?: pulumi.Input<string>;
            /**
             * Optional. If `true`, Dialogflow returns SpeechWordInfo in StreamingRecognitionResult with information about the recognized speech words, e.g. start and end time offsets. If false or unspecified, Speech doesn't return any word-level information.
             */
            enableWordInfo?: pulumi.Input<boolean>;
            /**
             * Optional. Which Speech model to select for the given request. Select the model best suited to your domain to get best results. If a model is not explicitly specified, then we auto-select a model based on the parameters in the InputAudioConfig. If enhanced speech model is enabled for the agent and an enhanced version of the specified model for the language does not exist, then the speech is recognized using the standard version of the specified model. Refer to [Cloud Speech API documentation](https://cloud.google.com/speech-to-text/docs/basics#select-model) for more details.
             */
            model?: pulumi.Input<string>;
            /**
             * Optional. Which variant of the Speech model to use.
             */
            modelVariant?: pulumi.Input<string>;
            /**
             * Optional. A list of strings containing words and phrases that the speech recognizer should recognize with higher likelihood. See [the Cloud Speech documentation](https://cloud.google.com/speech-to-text/docs/basics#phrase-hints) for more details.
             */
            phraseHints?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Sample rate (in Hertz) of the audio content sent in the query. Refer to [Cloud Speech API documentation](https://cloud.google.com/speech-to-text/docs/basics) for more details.
             */
            sampleRateHertz?: pulumi.Input<number>;
            /**
             * Optional. If `false` (default), recognition does not cease until the client closes the stream. If `true`, the recognizer will detect a single spoken utterance in input audio. Recognition ceases when it detects the audio's voice has stopped or paused. In this case, once a detected intent is received, the client should close the stream and start a new request with a new stream as needed. Note: This setting is relevant only for streaming methods.
             */
            singleUtterance?: pulumi.Input<boolean>;
        }
        /**
         * An intent represents a user's intent to interact with a conversational agent. You can provide information for the Dialogflow API to use to match user input to an intent by adding training phrases (i.e., examples of user input) to your intent.
         */
        interface GoogleCloudDialogflowCxV3beta1Intent {
            /**
             * Optional. Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters.
             */
            description?: pulumi.Input<string>;
            /**
             * Required. The human-readable name of the intent, unique within the agent.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation. Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.
             */
            isFallback?: pulumi.Input<boolean>;
            /**
             * Optional. The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes. Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys-contextual" means the intent is a contextual intent.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The unique identifier of the intent. Required for the Intents.UpdateIntent method. Intents.CreateIntent populates the name automatically. Format: `projects//locations//agents//intents/`.
             */
            name?: pulumi.Input<string>;
            /**
             * The collection of parameters associated with the intent.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1IntentParameter>[]>;
            /**
             * The priority of this intent. Higher numbers represent higher priorities. - If the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the `Normal` priority in the console. - If the supplied value is negative, the intent is ignored in runtime detect intent requests.
             */
            priority?: pulumi.Input<number>;
            /**
             * The collection of training phrases the agent is trained on to identify the intent.
             */
            trainingPhrases?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1IntentTrainingPhrase>[]>;
        }
        /**
         * Represents the intent to trigger programmatically rather than as a result of natural language processing.
         */
        interface GoogleCloudDialogflowCxV3beta1IntentInput {
            /**
             * Required. The unique identifier of the intent. Format: `projects//locations//agents//intents/`.
             */
            intent?: pulumi.Input<string>;
        }
        /**
         * Represents an intent parameter.
         */
        interface GoogleCloudDialogflowCxV3beta1IntentParameter {
            /**
             * Required. The entity type of the parameter. Format: `projects/-/locations/-/agents/-/entityTypes/` for system entity types (for example, `projects/-/locations/-/agents/-/entityTypes/sys.date`), or `projects//locations//agents//entityTypes/` for developer entity types.
             */
            entityType?: pulumi.Input<string>;
            /**
             * Required. The unique identifier of the parameter. This field is used by training phrases to annotate their parts.
             */
            id?: pulumi.Input<string>;
            /**
             * Indicates whether the parameter represents a list of values.
             */
            isList?: pulumi.Input<boolean>;
            /**
             * Indicates whether the parameter content should be redacted in log. If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled.
             */
            redact?: pulumi.Input<boolean>;
        }
        /**
         * Represents an example that the agent is trained on to identify the intent.
         */
        interface GoogleCloudDialogflowCxV3beta1IntentTrainingPhrase {
            /**
             * The unique identifier of the training phrase.
             */
            id?: pulumi.Input<string>;
            /**
             * Required. The ordered list of training phrase parts. The parts are concatenated in order to form the training phrase. Note: The API does not automatically annotate training phrases like the Dialogflow Console does. Note: Do not forget to include whitespace at part boundaries, so the training phrase is well formatted when the parts are concatenated. If the training phrase does not need to be annotated with parameters, you just need a single part with only the Part.text field set. If you want to annotate the training phrase, you must create multiple parts, where the fields of each part are populated in one of two ways: - `Part.text` is set to a part of the phrase that has no parameters. - `Part.text` is set to a part of the phrase that you want to annotate, and the `parameter_id` field is set.
             */
            parts?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1IntentTrainingPhrasePart>[]>;
            /**
             * Indicates how many times this example was added to the intent.
             */
            repeatCount?: pulumi.Input<number>;
        }
        /**
         * Represents a part of a training phrase.
         */
        interface GoogleCloudDialogflowCxV3beta1IntentTrainingPhrasePart {
            /**
             * The parameter used to annotate this part of the training phrase. This field is required for annotated parts of the training phrase.
             */
            parameterId?: pulumi.Input<string>;
            /**
             * Required. The text for this part.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Settings related to NLU.
         */
        interface GoogleCloudDialogflowCxV3beta1NluSettings {
            /**
             * To filter out false positive results and still get variety in matched natural language inputs for your agent, you can tune the machine learning classification threshold. If the returned score value is less than the threshold value, then a no-match event will be triggered. The score values range from 0.0 (completely uncertain) to 1.0 (completely certain). If set to 0.0, the default of 0.3 is used.
             */
            classificationThreshold?: pulumi.Input<number>;
            /**
             * Indicates NLU model training mode.
             */
            modelTrainingMode?: pulumi.Input<string>;
            /**
             * Indicates the type of NLU model.
             */
            modelType?: pulumi.Input<string>;
        }
        /**
         * A Dialogflow CX conversation (session) can be described and visualized as a state machine. The states of a CX session are represented by pages. For each flow, you define many pages, where your combined pages can handle a complete conversation on the topics the flow is designed for. At any given moment, exactly one page is the current page, the current page is considered active, and the flow associated with that page is considered active. Every flow has a special start page. When a flow initially becomes active, the start page page becomes the current page. For each conversational turn, the current page will either stay the same or transition to another page. You configure each page to collect information from the end-user that is relevant for the conversational state represented by the page. For more information, see the [Page guide](https://cloud.google.com/dialogflow/cx/docs/concept/page).
         */
        interface GoogleCloudDialogflowCxV3beta1Page {
            /**
             * Required. The human-readable name of the page, unique within the agent.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the session is entering the page.
             */
            entryFulfillment?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Fulfillment>;
            /**
             * Handlers associated with the page to handle events such as webhook errors, no match or no input.
             */
            eventHandlers?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1EventHandler>[]>;
            /**
             * The form associated with the page, used for collecting parameters relevant to the page.
             */
            form?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Form>;
            /**
             * The unique identifier of the page. Required for the Pages.UpdatePage method. Pages.CreatePage populates the name automatically. Format: `projects//locations//agents//flows//pages/`.
             */
            name?: pulumi.Input<string>;
            /**
             * Ordered list of `TransitionRouteGroups` associated with the page. Transition route groups must be unique within a page. * If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes. * If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence. Format:`projects//locations//agents//flows//transitionRouteGroups/`.
             */
            transitionRouteGroups?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow. When we are in a certain page, the TransitionRoutes are evalauted in the following order: * TransitionRoutes defined in the page with intent specified. * TransitionRoutes defined in the transition route groups with intent specified. * TransitionRoutes defined in flow with intent specified. * TransitionRoutes defined in the transition route groups with intent specified. * TransitionRoutes defined in the page with only condition specified. * TransitionRoutes defined in the transition route groups with only condition specified.
             */
            transitionRoutes?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1TransitionRoute>[]>;
        }
        /**
         * Represents the query input. It can contain one of: 1. A conversational query in the form of text. 2. An intent query that specifies which intent to trigger. 3. Natural language speech audio to be processed. 4. An event to be triggered.
         */
        interface GoogleCloudDialogflowCxV3beta1QueryInput {
            /**
             * The natural language speech audio to be processed.
             */
            audio?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1AudioInput>;
            /**
             * The DTMF event to be handled.
             */
            dtmf?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1DtmfInput>;
            /**
             * The event to be triggered.
             */
            event?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1EventInput>;
            /**
             * The intent to be triggered.
             */
            intent?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1IntentInput>;
            /**
             * Required. The language of the input. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes. Note that queries in the same session do not necessarily need to specify the same language.
             */
            languageCode?: pulumi.Input<string>;
            /**
             * The natural language text to be processed.
             */
            text?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1TextInput>;
        }
        /**
         * Represents a response message that can be returned by a conversational agent. Response messages are also used for output audio synthesis. The approach is as follows: * If at least one OutputAudioText response is present, then all OutputAudioText responses are linearly concatenated, and the result is used for output audio synthesis. * If the OutputAudioText responses are a mixture of text and SSML, then the concatenated result is treated as SSML; otherwise, the result is treated as either text or SSML as appropriate. The agent designer should ideally use either text or SSML consistently throughout the bot design. * Otherwise, all Text responses are linearly concatenated, and the result is used for output audio synthesis. This approach allows for more sophisticated user experience scenarios, where the text displayed to the user may differ from what is heard.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessage {
            /**
             * Indicates that the conversation succeeded.
             */
            conversationSuccess?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessageConversationSuccess>;
            /**
             * Hands off conversation to a human agent.
             */
            liveAgentHandoff?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessageLiveAgentHandoff>;
            /**
             * A text or ssml response that is preferentially used for TTS output audio synthesis, as described in the comment on the ResponseMessage message.
             */
            outputAudioText?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessageOutputAudioText>;
            /**
             * Returns a response containing a custom, platform-specific payload.
             */
            payload?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Signal that the client should play an audio clip hosted at a client-specific URI. Dialogflow uses this to construct mixed_audio. However, Dialogflow itself does not try to read or process the URI in any way.
             */
            playAudio?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessagePlayAudio>;
            /**
             * Returns a text response.
             */
            text?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ResponseMessageText>;
        }
        /**
         * Indicates that the conversation succeeded, i.e., the bot handled the issue that the customer talked to it about. Dialogflow only uses this to determine which conversations should be counted as successful and doesn't process the metadata in this message in any way. Note that Dialogflow also considers conversations that get to the conversation end page as successful even if they don't return ConversationSuccess. You may set this, for example: * In the entry_fulfillment of a Page if entering the page indicates that the conversation succeeded. * In a webhook response when you determine that you handled the customer issue.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessageConversationSuccess {
            /**
             * Custom metadata. Dialogflow doesn't impose any structure on this.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Indicates that the conversation should be handed off to a live agent. Dialogflow only uses this to determine which conversations were handed off to a human agent for measurement purposes. What else to do with this signal is up to you and your handoff procedures. You may set this, for example: * In the entry_fulfillment of a Page if entering the page indicates something went extremely wrong in the conversation. * In a webhook response when you determine that the customer issue can only be handled by a human.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessageLiveAgentHandoff {
            /**
             * Custom metadata for your handoff procedure. Dialogflow doesn't impose any structure on this.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A text or ssml response that is preferentially used for TTS output audio synthesis, as described in the comment on the ResponseMessage message.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessageOutputAudioText {
            /**
             * The SSML text to be synthesized. For more information, see [SSML](/speech/text-to-speech/docs/ssml).
             */
            ssml?: pulumi.Input<string>;
            /**
             * The raw text to be synthesized.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * Specifies an audio clip to be played by the client as part of the response.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessagePlayAudio {
            /**
             * Required. URI of the audio clip. Dialogflow does not impose any validation on this value. It is specific to the client that reads it.
             */
            audioUri?: pulumi.Input<string>;
        }
        /**
         * The text response message.
         */
        interface GoogleCloudDialogflowCxV3beta1ResponseMessageText {
            /**
             * Required. A collection of text responses.
             */
            text?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Settings related to speech recognition.
         */
        interface GoogleCloudDialogflowCxV3beta1SpeechToTextSettings {
            /**
             * Whether to use speech adaptation for speech recognition.
             */
            enableSpeechAdaptation?: pulumi.Input<boolean>;
        }
        /**
         * Represents a result from running a test case in an agent environment.
         */
        interface GoogleCloudDialogflowCxV3beta1TestCaseResult {
            /**
             * The conversation turns uttered during the test case replay in chronological order.
             */
            conversationTurns?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1ConversationTurn>[]>;
            /**
             * Environment where the test was run. If not set, it indicates the draft environment.
             */
            environment?: pulumi.Input<string>;
            /**
             * The resource name for the test case result. Format: `projects//locations//agents//testCases/ /results/`.
             */
            name?: pulumi.Input<string>;
            /**
             * Whether the test case passed in the agent environment.
             */
            testResult?: pulumi.Input<string>;
            /**
             * The time that the test was run.
             */
            testTime?: pulumi.Input<string>;
        }
        /**
         * Represents configurations for a test case.
         */
        interface GoogleCloudDialogflowCxV3beta1TestConfig {
            /**
             * Flow name. If not set, default start flow is assumed. Format: `projects//locations//agents//flows/`.
             */
            flow?: pulumi.Input<string>;
            /**
             * Session parameters to be compared when calculating differences.
             */
            trackingParameters?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents the natural language text to be processed.
         */
        interface GoogleCloudDialogflowCxV3beta1TextInput {
            /**
             * Required. The UTF-8 encoded natural language text to be processed. Text length must not exceed 256 characters.
             */
            text?: pulumi.Input<string>;
        }
        /**
         * A transition route specifies a intent that can be matched and/or a data condition that can be evaluated during a session. When a specified transition is matched, the following actions are taken in order: * If there is a `trigger_fulfillment` associated with the transition, it will be called. * If there is a `target_page` associated with the transition, the session will transition into the specified page. * If there is a `target_flow` associated with the transition, the session will transition into the specified flow.
         */
        interface GoogleCloudDialogflowCxV3beta1TransitionRoute {
            /**
             * The condition to evaluate against form parameters or session parameters. See the [conditions reference](https://cloud.google.com/dialogflow/cx/docs/reference/condition). At least one of `intent` or `condition` must be specified. When both `intent` and `condition` are specified, the transition can only happen when both are fulfilled.
             */
            condition?: pulumi.Input<string>;
            /**
             * The unique identifier of an Intent. Format: `projects//locations//agents//intents/`. Indicates that the transition can only happen when the given intent is matched. At least one of `intent` or `condition` must be specified. When both `intent` and `condition` are specified, the transition can only happen when both are fulfilled.
             */
            intent?: pulumi.Input<string>;
            /**
             * The target flow to transition to. Format: `projects//locations//agents//flows/`.
             */
            targetFlow?: pulumi.Input<string>;
            /**
             * The target page to transition to. Format: `projects//locations//agents//flows//pages/`.
             */
            targetPage?: pulumi.Input<string>;
            /**
             * The fulfillment to call when the condition is satisfied. At least one of `trigger_fulfillment` and `target` must be specified. When both are defined, `trigger_fulfillment` is executed first.
             */
            triggerFulfillment?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1Fulfillment>;
        }
        /**
         * The history of variants update.
         */
        interface GoogleCloudDialogflowCxV3beta1VariantsHistory {
            /**
             * Update time of the variants.
             */
            updateTime?: pulumi.Input<string>;
            /**
             * The flow versions as the variants.
             */
            versionVariants?: pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1VersionVariants>;
        }
        /**
         * A list of flow version variants.
         */
        interface GoogleCloudDialogflowCxV3beta1VersionVariants {
            /**
             * A list of flow version variants.
             */
            variants?: pulumi.Input<pulumi.Input<inputs.dialogflow.v3beta1.GoogleCloudDialogflowCxV3beta1VersionVariantsVariant>[]>;
        }
        /**
         * A single flow version with specified traffic allocation.
         */
        interface GoogleCloudDialogflowCxV3beta1VersionVariantsVariant {
            /**
             * Whether the variant is for the control group.
             */
            isControlGroup?: pulumi.Input<boolean>;
            /**
             * Percentage of the traffic which should be routed to this version of flow. Traffic allocation for a single flow must sum up to 1.0.
             */
            trafficAllocation?: pulumi.Input<number>;
            /**
             * The name of the flow version. Format: `projects//locations//agents//flows//versions/`.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Represents configuration for a generic web service.
         */
        interface GoogleCloudDialogflowCxV3beta1WebhookGenericWebService {
            /**
             * The password for HTTP Basic authentication.
             */
            password?: pulumi.Input<string>;
            /**
             * The HTTP request headers to send together with webhook requests.
             */
            requestHeaders?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Required. The webhook URI for receiving POST requests. It must use https protocol.
             */
            uri?: pulumi.Input<string>;
            /**
             * The user name for HTTP Basic authentication.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface GoogleRpcStatus {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
}
export declare namespace dlp {
    namespace v2 {
        /**
         * A task to execute on the completion of a job. See https://cloud.google.com/dlp/docs/concepts-actions to learn more.
         */
        interface GooglePrivacyDlpV2Action {
            /**
             * Enable email notification for project owners and editors on job's completion/failure.
             */
            jobNotificationEmails?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2JobNotificationEmails>;
            /**
             * Publish a notification to a pubsub topic.
             */
            pubSub?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PublishToPubSub>;
            /**
             * Publish findings to Cloud Datahub.
             */
            publishFindingsToCloudDataCatalog?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PublishFindingsToCloudDataCatalog>;
            /**
             * Publish summary to Cloud Security Command Center (Alpha).
             */
            publishSummaryToCscc?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PublishSummaryToCscc>;
            /**
             * Enable Stackdriver metric dlp.googleapis.com/finding_count.
             */
            publishToStackdriver?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PublishToStackdriver>;
            /**
             * Save resulting findings in a provided location.
             */
            saveFindings?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2SaveFindings>;
        }
        /**
         * An auxiliary table contains statistical information on the relative frequency of different quasi-identifiers values. It has one or several quasi-identifiers columns, and one column that indicates the relative frequency of each quasi-identifier tuple. If a tuple is present in the data but not in the auxiliary table, the corresponding relative frequency is assumed to be zero (and thus, the tuple is highly reidentifiable).
         */
        interface GooglePrivacyDlpV2AuxiliaryTable {
            /**
             * Required. Quasi-identifier columns.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2QuasiIdField>[]>;
            /**
             * Required. The relative frequency column must contain a floating-point number between 0 and 1 (inclusive). Null values are assumed to be zero.
             */
            relativeFrequency?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Required. Auxiliary table location.
             */
            table?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * Message defining a field of a BigQuery table.
         */
        interface GooglePrivacyDlpV2BigQueryField {
            /**
             * Designated field in the BigQuery table.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Source table of the field.
             */
            table?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * Options defining BigQuery table and row identifiers.
         */
        interface GooglePrivacyDlpV2BigQueryOptions {
            /**
             * References to fields excluded from scanning. This allows you to skip inspection of entire columns which you know have no findings.
             */
            excludedFields?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
            /**
             * Table fields that may uniquely identify a row within the table. When `actions.saveFindings.outputConfig.table` is specified, the values of columns specified here are available in the output table under `location.content_locations.record_location.record_key.id_values`. Nested fields such as `person.birthdate.year` are allowed.
             */
            identifyingFields?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
            /**
             * Max number of rows to scan. If the table has more rows than this value, the rest of the rows are omitted. If not set, or if set to 0, all rows will be scanned. Only one of rows_limit and rows_limit_percent can be specified. Cannot be used in conjunction with TimespanConfig.
             */
            rowsLimit?: pulumi.Input<string>;
            /**
             * Max percentage of rows to scan. The rest are omitted. The number of rows scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0. Only one of rows_limit and rows_limit_percent can be specified. Cannot be used in conjunction with TimespanConfig.
             */
            rowsLimitPercent?: pulumi.Input<number>;
            sampleMethod?: pulumi.Input<string>;
            /**
             * Complete BigQuery table reference.
             */
            tableReference?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * Message defining the location of a BigQuery table. A table is uniquely identified by its project_id, dataset_id, and table_name. Within a query a table is often referenced with a string in the format of: `:.` or `..`.
         */
        interface GooglePrivacyDlpV2BigQueryTable {
            /**
             * Dataset ID of the table.
             */
            datasetId?: pulumi.Input<string>;
            /**
             * The Google Cloud Platform project ID of the project containing the table. If omitted, project ID is inferred from the API call.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Name of the table.
             */
            tableId?: pulumi.Input<string>;
        }
        /**
         * Bucket is represented as a range, along with replacement values.
         */
        interface GooglePrivacyDlpV2Bucket {
            /**
             * Upper bound of the range, exclusive; type must match min.
             */
            max?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
            /**
             * Lower bound of the range, inclusive. Type should be the same as max if used.
             */
            min?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
            /**
             * Required. Replacement value for this bucket.
             */
            replacementValue?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
        }
        /**
         * Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
         */
        interface GooglePrivacyDlpV2BucketingConfig {
            /**
             * Set of buckets. Ranges must be non-overlapping.
             */
            buckets?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Bucket>[]>;
        }
        /**
         * Compute numerical stats over an individual column, including number of distinct values and value count distribution.
         */
        interface GooglePrivacyDlpV2CategoricalStatsConfig {
            /**
             * Field to compute categorical stats on. All column types are supported except for arrays and structs. However, it may be more informative to use NumericalStats when the field type is supported, depending on the data.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3.
         */
        interface GooglePrivacyDlpV2CharacterMaskConfig {
            /**
             * When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.
             */
            charactersToIgnore?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CharsToIgnore>[]>;
            /**
             * Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.
             */
            maskingCharacter?: pulumi.Input<string>;
            /**
             * Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.
             */
            numberToMask?: pulumi.Input<number>;
            /**
             * Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.
             */
            reverseOrder?: pulumi.Input<boolean>;
        }
        /**
         * Characters to skip when doing deidentification of a value. These will be left alone and skipped.
         */
        interface GooglePrivacyDlpV2CharsToIgnore {
            /**
             * Characters to not transform when masking.
             */
            charactersToSkip?: pulumi.Input<string>;
            /**
             * Common characters to not transform when masking. Useful to avoid removing punctuation.
             */
            commonCharactersToIgnore?: pulumi.Input<string>;
        }
        /**
         * Message representing a set of files in Cloud Storage.
         */
        interface GooglePrivacyDlpV2CloudStorageFileSet {
            /**
             * The url, in the format `gs:///`. Trailing wildcard in the path is allowed.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Options defining a file or a set of files within a Google Cloud Storage bucket.
         */
        interface GooglePrivacyDlpV2CloudStorageOptions {
            /**
             * Max number of bytes to scan from a file. If a scanned file's size is bigger than this value then the rest of the bytes are omitted. Only one of bytes_limit_per_file and bytes_limit_per_file_percent can be specified. Cannot be set if de-identification is requested.
             */
            bytesLimitPerFile?: pulumi.Input<string>;
            /**
             * Max percentage of bytes to scan from a file. The rest are omitted. The number of bytes scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0. Only one of bytes_limit_per_file and bytes_limit_per_file_percent can be specified. Cannot be set if de-identification is requested.
             */
            bytesLimitPerFilePercent?: pulumi.Input<number>;
            /**
             * The set of one or more files to scan.
             */
            fileSet?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FileSet>;
            /**
             * List of file type groups to include in the scan. If empty, all files are scanned and available data format processors are applied. In addition, the binary content of the selected files is always scanned as well. Images are scanned only as binary if the specified region does not support image inspection and no file_types were specified. Image inspection is restricted to 'global', 'us', 'asia', and 'europe'.
             */
            fileTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Limits the number of files to scan to this percentage of the input FileSet. Number of files scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0.
             */
            filesLimitPercent?: pulumi.Input<number>;
            sampleMethod?: pulumi.Input<string>;
        }
        /**
         * Message representing a single file or path in Cloud Storage.
         */
        interface GooglePrivacyDlpV2CloudStoragePath {
            /**
             * A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt
             */
            path?: pulumi.Input<string>;
        }
        /**
         * Message representing a set of files in a Cloud Storage bucket. Regular expressions are used to allow fine-grained control over which files in the bucket to include. Included files are those that match at least one item in `include_regex` and do not match any items in `exclude_regex`. Note that a file that matches items from both lists will _not_ be included. For a match to occur, the entire file path (i.e., everything in the url after the bucket name) must match the regular expression. For example, given the input `{bucket_name: "mybucket", include_regex: ["directory1/.*"], exclude_regex: ["directory1/excluded.*"]}`: * `gs://mybucket/directory1/myfile` will be included * `gs://mybucket/directory1/directory2/myfile` will be included (`.*` matches across `/`) * `gs://mybucket/directory0/directory1/myfile` will _not_ be included (the full path doesn't match any items in `include_regex`) * `gs://mybucket/directory1/excludedfile` will _not_ be included (the path matches an item in `exclude_regex`) If `include_regex` is left empty, it will match all files by default (this is equivalent to setting `include_regex: [".*"]`). Some other common use cases: * `{bucket_name: "mybucket", exclude_regex: [".*\.pdf"]}` will include all files in `mybucket` except for .pdf files * `{bucket_name: "mybucket", include_regex: ["directory/[^/]+"]}` will include all files directly under `gs://mybucket/directory/`, without matching across `/`
         */
        interface GooglePrivacyDlpV2CloudStorageRegexFileSet {
            /**
             * The name of a Cloud Storage bucket. Required.
             */
            bucketName?: pulumi.Input<string>;
            /**
             * A list of regular expressions matching file paths to exclude. All files in the bucket that match at least one of these regular expressions will be excluded from the scan. Regular expressions use RE2 [syntax](https://github.com/google/re2/wiki/Syntax); a guide can be found under the google/re2 repository on GitHub.
             */
            excludeRegex?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of regular expressions matching file paths to include. All files in the bucket that match at least one of these regular expressions will be included in the set of files, except for those that also match an item in `exclude_regex`. Leaving this field empty will match all files by default (this is equivalent to including `.*` in the list). Regular expressions use RE2 [syntax](https://github.com/google/re2/wiki/Syntax); a guide can be found under the google/re2 repository on GitHub.
             */
            includeRegex?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.
         */
        interface GooglePrivacyDlpV2Condition {
            /**
             * Required. Field within the record this condition is evaluated against.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Required. Operator used to compare the field or infoType to the value.
             */
            operator?: pulumi.Input<string>;
            /**
             * Value to compare against. [Mandatory, except for `EXISTS` tests.]
             */
            value?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
        }
        /**
         * A collection of conditions.
         */
        interface GooglePrivacyDlpV2Conditions {
            /**
             * A collection of conditions.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Condition>[]>;
        }
        /**
         * Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.
         */
        interface GooglePrivacyDlpV2CryptoDeterministicConfig {
            /**
             * A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.
             */
            context?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use.
             */
            cryptoKey?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoKey>;
            /**
             * The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.
             */
            surrogateInfoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
        }
        /**
         * Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
         */
        interface GooglePrivacyDlpV2CryptoHashConfig {
            /**
             * The key used by the hash function.
             */
            cryptoKey?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoKey>;
        }
        /**
         * This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key.
         */
        interface GooglePrivacyDlpV2CryptoKey {
            /**
             * Kms wrapped key
             */
            kmsWrapped?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2KmsWrappedCryptoKey>;
            /**
             * Transient crypto key
             */
            transient?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TransientCryptoKey>;
            /**
             * Unwrapped crypto key
             */
            unwrapped?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2UnwrappedCryptoKey>;
        }
        /**
         * Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity.
         */
        interface GooglePrivacyDlpV2CryptoReplaceFfxFpeConfig {
            /**
             * Common alphabets.
             */
            commonAlphabet?: pulumi.Input<string>;
            /**
             * The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2
             */
            context?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Required. The key used by the encryption algorithm.
             */
            cryptoKey?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoKey>;
            /**
             * This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/
             */
            customAlphabet?: pulumi.Input<string>;
            /**
             * The native way to select the alphabet. Must be in the range [2, 95].
             */
            radix?: pulumi.Input<number>;
            /**
             * The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE
             */
            surrogateInfoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
        }
        /**
         * Custom information type provided by the user. Used to find domain-specific sensitive information configurable to the data in question.
         */
        interface GooglePrivacyDlpV2CustomInfoType {
            /**
             * Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order that they are specified. Not supported for the `surrogate_type` CustomInfoType.
             */
            detectionRules?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2DetectionRule>[]>;
            /**
             * A list of phrases to detect as a CustomInfoType.
             */
            dictionary?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Dictionary>;
            /**
             * If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.
             */
            exclusionType?: pulumi.Input<string>;
            /**
             * CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing infoTypes and that infoType is specified in `InspectContent.info_types` field. Specifying the latter adds findings to the one detected by the system. If built-in info type is not specified in `InspectContent.info_types` list then the name is treated as a custom info type.
             */
            infoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
            /**
             * Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria specified by the rule. Defaults to `VERY_LIKELY` if not specified.
             */
            likelihood?: pulumi.Input<string>;
            /**
             * Regular expression based CustomInfoType.
             */
            regex?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Regex>;
            /**
             * Load an existing `StoredInfoType` resource for use in `InspectDataSource`. Not currently supported in `InspectContent`.
             */
            storedType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2StoredType>;
            /**
             * Message for detecting output from deidentification transformations that support reversing.
             */
            surrogateType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2SurrogateType>;
        }
        /**
         * Options defining a data set within Google Cloud Datastore.
         */
        interface GooglePrivacyDlpV2DatastoreOptions {
            /**
             * The kind to process.
             */
            kind?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2KindExpression>;
            /**
             * A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty.
             */
            partitionId?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PartitionId>;
        }
        /**
         * Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more.
         */
        interface GooglePrivacyDlpV2DateShiftConfig {
            /**
             * Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.
             */
            context?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.
             */
            cryptoKey?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoKey>;
            /**
             * Required. For example, -5 means shift date to at most 5 days back in the past.
             */
            lowerBoundDays?: pulumi.Input<number>;
            /**
             * Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.
             */
            upperBoundDays?: pulumi.Input<number>;
        }
        /**
         * The configuration that controls how the data will change.
         */
        interface GooglePrivacyDlpV2DeidentifyConfig {
            /**
             * Treat the dataset as free-form text and apply the same free text transformation everywhere.
             */
            infoTypeTransformations?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoTypeTransformations>;
            /**
             * Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.
             */
            recordTransformations?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2RecordTransformations>;
            /**
             * Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.
             */
            transformationErrorHandling?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TransformationErrorHandling>;
        }
        /**
         * δ-presence metric, used to estimate how likely it is for an attacker to figure out that one given individual appears in a de-identified dataset. Similarly to the k-map metric, we cannot compute δ-presence exactly without knowing the attack dataset, so we use a statistical model instead.
         */
        interface GooglePrivacyDlpV2DeltaPresenceEstimationConfig {
            /**
             * Several auxiliary tables can be used in the analysis. Each custom_tag used to tag a quasi-identifiers field must appear in exactly one field of one auxiliary table.
             */
            auxiliaryTables?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2StatisticalTable>[]>;
            /**
             * Required. Fields considered to be quasi-identifiers. No two fields can have the same tag.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2QuasiId>[]>;
            /**
             * ISO 3166-1 alpha-2 region code to use in the statistical modeling. Set if no column is tagged with a region-specific InfoType (like US_ZIP_5) or a region code.
             */
            regionCode?: pulumi.Input<string>;
        }
        /**
         * Deprecated; use `InspectionRuleSet` instead. Rule for modifying a `CustomInfoType` to alter behavior under certain circumstances, depending on the specific details of the rule. Not supported for the `surrogate_type` custom infoType.
         */
        interface GooglePrivacyDlpV2DetectionRule {
            /**
             * Hotword-based detection rule.
             */
            hotwordRule?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2HotwordRule>;
        }
        /**
         * Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API.
         */
        interface GooglePrivacyDlpV2Dictionary {
            /**
             * Newline-delimited file of words in Cloud Storage. Only a single file is accepted.
             */
            cloudStoragePath?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CloudStoragePath>;
            /**
             * List of words or phrases to search for.
             */
            wordList?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2WordList>;
        }
        /**
         * An entity in a dataset is a field or set of fields that correspond to a single person. For example, in medical records the `EntityId` might be a patient identifier, or for financial records it might be an account identifier. This message is used when generalizations or analysis must take into account that multiple rows correspond to the same entity.
         */
        interface GooglePrivacyDlpV2EntityId {
            /**
             * Composite key indicating which field contains the entity identifier.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * List of exclude infoTypes.
         */
        interface GooglePrivacyDlpV2ExcludeInfoTypes {
            /**
             * InfoType list in ExclusionRule rule drops a finding when it overlaps or contained within with a finding of an infoType from this list. For example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and `exclusion_rule` containing `exclude_info_types.info_types` with "EMAIL_ADDRESS" the phone number findings are dropped if they overlap with EMAIL_ADDRESS finding. That leads to "555-222-2222@example.org" to generate only a single finding, namely email address.
             */
            infoTypes?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>[]>;
        }
        /**
         * The rule that specifies conditions when findings of infoTypes specified in `InspectionRuleSet` are removed from results.
         */
        interface GooglePrivacyDlpV2ExclusionRule {
            /**
             * Dictionary which defines the rule.
             */
            dictionary?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Dictionary>;
            /**
             * Set of infoTypes for which findings would affect this rule.
             */
            excludeInfoTypes?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2ExcludeInfoTypes>;
            /**
             * How the rule is applied, see MatchingType documentation for details.
             */
            matchingType?: pulumi.Input<string>;
            /**
             * Regular expression which defines the rule.
             */
            regex?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Regex>;
        }
        /**
         * An expression, consisting or an operator and conditions.
         */
        interface GooglePrivacyDlpV2Expressions {
            /**
             * Conditions to apply to the expression.
             */
            conditions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Conditions>;
            /**
             * The operator to apply to the result of conditions. Default and currently only supported value is `AND`.
             */
            logicalOperator?: pulumi.Input<string>;
        }
        /**
         * General identifier of a data field in a storage service.
         */
        interface GooglePrivacyDlpV2FieldId {
            /**
             * Name describing the field.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The transformation to apply to the field.
         */
        interface GooglePrivacyDlpV2FieldTransformation {
            /**
             * Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.
             */
            condition?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2RecordCondition>;
            /**
             * Required. Input field(s) to apply the transformation to.
             */
            fields?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
            /**
             * Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.
             */
            infoTypeTransformations?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoTypeTransformations>;
            /**
             * Apply the transformation to the entire field.
             */
            primitiveTransformation?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PrimitiveTransformation>;
        }
        /**
         * Set of files to scan.
         */
        interface GooglePrivacyDlpV2FileSet {
            /**
             * The regex-filtered set of files to scan. Exactly one of `url` or `regex_file_set` must be set.
             */
            regexFileSet?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CloudStorageRegexFileSet>;
            /**
             * The Cloud Storage url of the file(s) to scan, in the format `gs:///`. Trailing wildcard in the path is allowed. If the url ends in a trailing slash, the bucket or directory represented by the url will be scanned non-recursively (content in sub-directories will not be scanned). This means that `gs://mybucket/` is equivalent to `gs://mybucket/*`, and `gs://mybucket/directory/` is equivalent to `gs://mybucket/directory/*`. Exactly one of `url` or `regex_file_set` must be set.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Configuration to control the number of findings returned. Cannot be set if de-identification is requested.
         */
        interface GooglePrivacyDlpV2FindingLimits {
            /**
             * Configuration of findings limit given for specified infoTypes.
             */
            maxFindingsPerInfoType?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoTypeLimit>[]>;
            /**
             * Max number of findings that will be returned for each item scanned. When set within `InspectJobConfig`, the maximum returned is 2000 regardless if this is set higher. When set within `InspectContentRequest`, this field is ignored.
             */
            maxFindingsPerItem?: pulumi.Input<number>;
            /**
             * Max number of findings that will be returned per request/job. When set within `InspectContentRequest`, the maximum returned is 2000 regardless if this is set higher.
             */
            maxFindingsPerRequest?: pulumi.Input<number>;
        }
        /**
         * Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
         */
        interface GooglePrivacyDlpV2FixedSizeBucketingConfig {
            /**
             * Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.
             */
            bucketSize?: pulumi.Input<number>;
            /**
             * Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".
             */
            lowerBound?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
            /**
             * Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".
             */
            upperBound?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
        }
        /**
         * The rule that adjusts the likelihood of findings within a certain proximity of hotwords.
         */
        interface GooglePrivacyDlpV2HotwordRule {
            /**
             * Regular expression pattern defining what qualifies as a hotword.
             */
            hotwordRegex?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Regex>;
            /**
             * Likelihood adjustment to apply to all matching findings.
             */
            likelihoodAdjustment?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2LikelihoodAdjustment>;
            /**
             * Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "\(xxx\)", where "xxx" is the area code in question.
             */
            proximity?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Proximity>;
        }
        /**
         * Configuration to control jobs where the content being inspected is outside of Google Cloud Platform.
         */
        interface GooglePrivacyDlpV2HybridOptions {
            /**
             * A short description of where the data is coming from. Will be stored once in the job. 256 max length.
             */
            description?: pulumi.Input<string>;
            /**
             * To organize findings, these labels will be added to each finding. Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`. Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`. No more than 10 labels can be associated with a given finding. Examples: * `"environment" : "production"` * `"pipeline" : "etl"`
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * These are labels that each inspection request must include within their 'finding_labels' map. Request may contain others, but any missing one of these will be rejected. Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`. No more than 10 keys can be required.
             */
            requiredFindingLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If the container is a table, additional information to make findings meaningful such as the columns that are primary keys.
             */
            tableOptions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TableOptions>;
        }
        /**
         * Type of information detected by the API.
         */
        interface GooglePrivacyDlpV2InfoType {
            /**
             * Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Max findings configuration per infoType, per content item or long running DlpJob.
         */
        interface GooglePrivacyDlpV2InfoTypeLimit {
            /**
             * Type of information the findings limit applies to. Only one limit per info_type should be provided. If InfoTypeLimit does not have an info_type, the DLP API applies the limit against all info_types that are found but not specified in another InfoTypeLimit.
             */
            infoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
            /**
             * Max findings limit for the given infoType.
             */
            maxFindings?: pulumi.Input<number>;
        }
        /**
         * A transformation to apply to text that is identified as a specific info_type.
         */
        interface GooglePrivacyDlpV2InfoTypeTransformation {
            /**
             * InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.
             */
            infoTypes?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>[]>;
            /**
             * Required. Primitive transformation to apply to the infoType.
             */
            primitiveTransformation?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PrimitiveTransformation>;
        }
        /**
         * A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type.
         */
        interface GooglePrivacyDlpV2InfoTypeTransformations {
            /**
             * Required. Transformation for each infoType. Cannot specify more than one for a given infoType.
             */
            transformations?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoTypeTransformation>[]>;
        }
        /**
         * Configuration description of the scanning process. When used with redactContent only info_types and min_likelihood are currently used.
         */
        interface GooglePrivacyDlpV2InspectConfig {
            /**
             * List of options defining data content to scan. If empty, text, images, and other content will be included.
             */
            contentOptions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * CustomInfoTypes provided by the user. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
             */
            customInfoTypes?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CustomInfoType>[]>;
            /**
             * When true, excludes type information of the findings.
             */
            excludeInfoTypes?: pulumi.Input<boolean>;
            /**
             * When true, a contextual quote from the data that triggered a finding is included in the response; see Finding.quote.
             */
            includeQuote?: pulumi.Input<boolean>;
            /**
             * Restricts what info_types to look for. The values must correspond to InfoType values returned by ListInfoTypes or listed at https://cloud.google.com/dlp/docs/infotypes-reference. When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. If you need precise control and predictability as to what detectors are run you should specify specific InfoTypes listed in the reference, otherwise a default list will be used, which may change over time.
             */
            infoTypes?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>[]>;
            /**
             * Configuration to control the number of findings returned.
             */
            limits?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FindingLimits>;
            /**
             * Only returns findings equal or above this threshold. The default is POSSIBLE. See https://cloud.google.com/dlp/docs/likelihood to learn more.
             */
            minLikelihood?: pulumi.Input<string>;
            /**
             * Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end, other rules are executed in the order they are specified for each info type.
             */
            ruleSet?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InspectionRuleSet>[]>;
        }
        /**
         * Controls what and how to inspect for findings.
         */
        interface GooglePrivacyDlpV2InspectJobConfig {
            /**
             * Actions to execute at the completion of the job.
             */
            actions?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Action>[]>;
            /**
             * How and what to scan for.
             */
            inspectConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InspectConfig>;
            /**
             * If provided, will be used as the default for all values in InspectConfig. `inspect_config` will be merged into the values persisted as part of the template.
             */
            inspectTemplateName?: pulumi.Input<string>;
            /**
             * The data to scan.
             */
            storageConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2StorageConfig>;
        }
        /**
         * A single inspection rule to be applied to infoTypes, specified in `InspectionRuleSet`.
         */
        interface GooglePrivacyDlpV2InspectionRule {
            /**
             * Exclusion rule.
             */
            exclusionRule?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2ExclusionRule>;
            /**
             * Hotword-based detection rule.
             */
            hotwordRule?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2HotwordRule>;
        }
        /**
         * Rule set for modifying a set of infoTypes to alter behavior under certain circumstances, depending on the specific details of the rules within the set.
         */
        interface GooglePrivacyDlpV2InspectionRuleSet {
            /**
             * List of infoTypes this rule set is applied to.
             */
            infoTypes?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>[]>;
            /**
             * Set of rules to be applied to infoTypes. The rules are applied in order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InspectionRule>[]>;
        }
        /**
         * Enable email notification to project owners and editors on jobs's completion/failure.
         */
        interface GooglePrivacyDlpV2JobNotificationEmails {
        }
        /**
         * k-anonymity metric, used for analysis of reidentification risk.
         */
        interface GooglePrivacyDlpV2KAnonymityConfig {
            /**
             * Message indicating that multiple rows might be associated to a single individual. If the same entity_id is associated to multiple quasi-identifier tuples over distinct rows, we consider the entire collection of tuples as the composite quasi-identifier. This collection is a multiset: the order in which the different tuples appear in the dataset is ignored, but their frequency is taken into account. Important note: a maximum of 1000 rows can be associated to a single entity ID. If more rows are associated with the same entity ID, some might be ignored.
             */
            entityId?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2EntityId>;
            /**
             * Set of fields to compute k-anonymity over. When multiple fields are specified, they are considered a single composite key. Structs and repeated data types are not supported; however, nested fields are supported so long as they are not structs themselves or nested within a repeated field.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
        }
        /**
         * Reidentifiability metric. This corresponds to a risk model similar to what is called "journalist risk" in the literature, except the attack dataset is statistically modeled instead of being perfectly known. This can be done using publicly available data (like the US Census), or using a custom statistical model (indicated as one or several BigQuery tables), or by extrapolating from the distribution of values in the input dataset.
         */
        interface GooglePrivacyDlpV2KMapEstimationConfig {
            /**
             * Several auxiliary tables can be used in the analysis. Each custom_tag used to tag a quasi-identifiers column must appear in exactly one column of one auxiliary table.
             */
            auxiliaryTables?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2AuxiliaryTable>[]>;
            /**
             * Required. Fields considered to be quasi-identifiers. No two columns can have the same tag.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TaggedField>[]>;
            /**
             * ISO 3166-1 alpha-2 region code to use in the statistical modeling. Set if no column is tagged with a region-specific InfoType (like US_ZIP_5) or a region code.
             */
            regionCode?: pulumi.Input<string>;
        }
        /**
         * A representation of a Datastore kind.
         */
        interface GooglePrivacyDlpV2KindExpression {
            /**
             * The name of the kind.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt
         */
        interface GooglePrivacyDlpV2KmsWrappedCryptoKey {
            /**
             * Required. The resource name of the KMS CryptoKey to use for unwrapping.
             */
            cryptoKeyName?: pulumi.Input<string>;
            /**
             * Required. The wrapped data crypto key.
             */
            wrappedKey?: pulumi.Input<string>;
        }
        /**
         * l-diversity metric, used for analysis of reidentification risk.
         */
        interface GooglePrivacyDlpV2LDiversityConfig {
            /**
             * Set of quasi-identifiers indicating how equivalence classes are defined for the l-diversity computation. When multiple fields are specified, they are considered a single composite key.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
            /**
             * Sensitive field for computing the l-value.
             */
            sensitiveAttribute?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * Configuration for a custom dictionary created from a data source of any size up to the maximum size defined in the [limits](https://cloud.google.com/dlp/limits) page. The artifacts of dictionary creation are stored in the specified Google Cloud Storage location. Consider using `CustomInfoType.Dictionary` for smaller dictionaries that satisfy the size requirements.
         */
        interface GooglePrivacyDlpV2LargeCustomDictionaryConfig {
            /**
             * Field in a BigQuery table where each cell represents a dictionary phrase.
             */
            bigQueryField?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryField>;
            /**
             * Set of files containing newline-delimited lists of dictionary phrases.
             */
            cloudStorageFileSet?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CloudStorageFileSet>;
            /**
             * Location to store dictionary artifacts in Google Cloud Storage. These files will only be accessible by project owners and the DLP API. If any of these artifacts are modified, the dictionary is considered invalid and can no longer be used.
             */
            outputPath?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CloudStoragePath>;
        }
        /**
         * Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response.
         */
        interface GooglePrivacyDlpV2LeaveUntransformed {
        }
        /**
         * Message for specifying an adjustment to the likelihood of a finding as part of a detection rule.
         */
        interface GooglePrivacyDlpV2LikelihoodAdjustment {
            /**
             * Set the likelihood of a finding to a fixed value.
             */
            fixedLikelihood?: pulumi.Input<string>;
            /**
             * Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.
             */
            relativeLikelihood?: pulumi.Input<number>;
        }
        /**
         * Job trigger option for hybrid jobs. Jobs must be manually created and finished.
         */
        interface GooglePrivacyDlpV2Manual {
        }
        /**
         * Compute numerical stats over an individual column, including min, max, and quantiles.
         */
        interface GooglePrivacyDlpV2NumericalStatsConfig {
            /**
             * Field to compute numerical stats on. Supported types are integer, float, date, datetime, timestamp, time.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * Cloud repository for storing output.
         */
        interface GooglePrivacyDlpV2OutputStorageConfig {
            /**
             * Schema used for writing the findings for Inspect jobs. This field is only used for Inspect and must be unspecified for Risk jobs. Columns are derived from the `Finding` object. If appending to an existing table, any columns from the predefined schema that are missing will be added. No columns in the existing table will be deleted. If unspecified, then all available columns will be used for a new table or an (existing) table with no schema, and no changes will be made to an existing table that has a schema. Only for use with external storage.
             */
            outputSchema?: pulumi.Input<string>;
            /**
             * Store findings in an existing table or a new table in an existing dataset. If table_id is not set a new one will be generated for you with the following format: dlp_googleapis_yyyy_mm_dd_[dlp_job_id]. Pacific timezone will be used for generating the date details. For Inspect, each column in an existing output table must have the same name, type, and mode of a field in the `Finding` object. For Risk, an existing output table should be the output of a previous Risk analysis job run on the same source table, with the same privacy metric and quasi-identifiers. Risk jobs that analyze the same table but compute a different privacy metric, or use different sets of quasi-identifiers, cannot store their results in the same table.
             */
            table?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * Datastore partition ID. A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID.
         */
        interface GooglePrivacyDlpV2PartitionId {
            /**
             * If not empty, the ID of the namespace to which the entities belong.
             */
            namespaceId?: pulumi.Input<string>;
            /**
             * The ID of the project to which the entities belong.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * A rule for transforming a value.
         */
        interface GooglePrivacyDlpV2PrimitiveTransformation {
            /**
             * Bucketing
             */
            bucketingConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BucketingConfig>;
            /**
             * Mask
             */
            characterMaskConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CharacterMaskConfig>;
            /**
             * Deterministic Crypto
             */
            cryptoDeterministicConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoDeterministicConfig>;
            /**
             * Crypto
             */
            cryptoHashConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoHashConfig>;
            /**
             * Ffx-Fpe
             */
            cryptoReplaceFfxFpeConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CryptoReplaceFfxFpeConfig>;
            /**
             * Date Shift
             */
            dateShiftConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2DateShiftConfig>;
            /**
             * Fixed size bucketing
             */
            fixedSizeBucketingConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FixedSizeBucketingConfig>;
            /**
             * Redact
             */
            redactConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2RedactConfig>;
            /**
             * Replace
             */
            replaceConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2ReplaceValueConfig>;
            /**
             * Replace with infotype
             */
            replaceWithInfoTypeConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2ReplaceWithInfoTypeConfig>;
            /**
             * Time extraction
             */
            timePartConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TimePartConfig>;
        }
        /**
         * Privacy metric to compute for reidentification risk analysis.
         */
        interface GooglePrivacyDlpV2PrivacyMetric {
            /**
             * Categorical stats
             */
            categoricalStatsConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CategoricalStatsConfig>;
            /**
             * delta-presence
             */
            deltaPresenceEstimationConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2DeltaPresenceEstimationConfig>;
            /**
             * K-anonymity
             */
            kAnonymityConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2KAnonymityConfig>;
            /**
             * k-map
             */
            kMapEstimationConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2KMapEstimationConfig>;
            /**
             * l-diversity
             */
            lDiversityConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2LDiversityConfig>;
            /**
             * Numerical stats
             */
            numericalStatsConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2NumericalStatsConfig>;
        }
        /**
         * Message for specifying a window around a finding to apply a detection rule.
         */
        interface GooglePrivacyDlpV2Proximity {
            /**
             * Number of characters after the finding to consider.
             */
            windowAfter?: pulumi.Input<number>;
            /**
             * Number of characters before the finding to consider.
             */
            windowBefore?: pulumi.Input<number>;
        }
        /**
         * Publish findings of a DlpJob to Cloud Data Catalog. Labels summarizing the results of the DlpJob will be applied to the entry for the resource scanned in Cloud Data Catalog. Any labels previously written by another DlpJob will be deleted. InfoType naming patterns are strictly enforced when using this feature. Note that the findings will be persisted in Cloud Data Catalog storage and are governed by Data Catalog service-specific policy, see https://cloud.google.com/terms/service-terms Only a single instance of this action can be specified and only allowed if all resources being scanned are BigQuery tables. Compatible with: Inspect
         */
        interface GooglePrivacyDlpV2PublishFindingsToCloudDataCatalog {
        }
        /**
         * Publish the result summary of a DlpJob to the Cloud Security Command Center (CSCC Alpha). This action is only available for projects which are parts of an organization and whitelisted for the alpha Cloud Security Command Center. The action will publish count of finding instances and their info types. The summary of findings will be persisted in CSCC and are governed by CSCC service-specific policy, see https://cloud.google.com/terms/service-terms Only a single instance of this action can be specified. Compatible with: Inspect
         */
        interface GooglePrivacyDlpV2PublishSummaryToCscc {
        }
        /**
         * Publish a message into given Pub/Sub topic when DlpJob has completed. The message contains a single field, `DlpJobName`, which is equal to the finished job's [`DlpJob.name`](https://cloud.google.com/dlp/docs/reference/rest/v2/projects.dlpJobs#DlpJob). Compatible with: Inspect, Risk
         */
        interface GooglePrivacyDlpV2PublishToPubSub {
            /**
             * Cloud Pub/Sub topic to send notifications to. The topic must have given publishing access rights to the DLP API service account executing the long running DlpJob sending the notifications. Format is projects/{project}/topics/{topic}.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Enable Stackdriver metric dlp.googleapis.com/finding_count. This will publish a metric to stack driver on each infotype requested and how many findings were found for it. CustomDetectors will be bucketed as 'Custom' under the Stackdriver label 'info_type'.
         */
        interface GooglePrivacyDlpV2PublishToStackdriver {
        }
        /**
         * A column with a semantic tag attached.
         */
        interface GooglePrivacyDlpV2QuasiId {
            /**
             * A column can be tagged with a custom tag. In this case, the user must indicate an auxiliary table that contains statistical information on the possible values of this column (below).
             */
            customTag?: pulumi.Input<string>;
            /**
             * Required. Identifies the column.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * If no semantic tag is indicated, we infer the statistical model from the distribution of values in the input data
             */
            inferred?: pulumi.Input<inputs.dlp.v2.GoogleProtobufEmpty>;
            /**
             * A column can be tagged with a InfoType to use the relevant public dataset as a statistical model of population, if available. We currently support US ZIP codes, region codes, ages and genders. To programmatically obtain the list of supported InfoTypes, use ListInfoTypes with the supported_by=RISK_ANALYSIS filter.
             */
            infoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
        }
        /**
         * A quasi-identifier column has a custom_tag, used to know which column in the data corresponds to which column in the statistical model.
         */
        interface GooglePrivacyDlpV2QuasiIdField {
            /**
             * A auxiliary field.
             */
            customTag?: pulumi.Input<string>;
            /**
             * Identifies the column.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * A quasi-identifier column has a custom_tag, used to know which column in the data corresponds to which column in the statistical model.
         */
        interface GooglePrivacyDlpV2QuasiIdentifierField {
            /**
             * A column can be tagged with a custom tag. In this case, the user must indicate an auxiliary table that contains statistical information on the possible values of this column (below).
             */
            customTag?: pulumi.Input<string>;
            /**
             * Identifies the column.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * A condition for determining whether a transformation should be applied to a field.
         */
        interface GooglePrivacyDlpV2RecordCondition {
            /**
             * An expression.
             */
            expressions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Expressions>;
        }
        /**
         * Configuration to suppress records whose suppression conditions evaluate to true.
         */
        interface GooglePrivacyDlpV2RecordSuppression {
            /**
             * A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.
             */
            condition?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2RecordCondition>;
        }
        /**
         * A type of transformation that is applied over structured data such as a table.
         */
        interface GooglePrivacyDlpV2RecordTransformations {
            /**
             * Transform the record by applying various field transformations.
             */
            fieldTransformations?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldTransformation>[]>;
            /**
             * Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.
             */
            recordSuppressions?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2RecordSuppression>[]>;
        }
        /**
         * Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
         */
        interface GooglePrivacyDlpV2RedactConfig {
        }
        /**
         * Message defining a custom regular expression.
         */
        interface GooglePrivacyDlpV2Regex {
            /**
             * The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.
             */
            groupIndexes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.
             */
            pattern?: pulumi.Input<string>;
        }
        /**
         * Replace each input value with a given `Value`.
         */
        interface GooglePrivacyDlpV2ReplaceValueConfig {
            /**
             * Value to replace it with.
             */
            newValue?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Value>;
        }
        /**
         * Replace each matching finding with the name of the info_type.
         */
        interface GooglePrivacyDlpV2ReplaceWithInfoTypeConfig {
        }
        /**
         * Configuration for a risk analysis job. See https://cloud.google.com/dlp/docs/concepts-risk-analysis to learn more.
         */
        interface GooglePrivacyDlpV2RiskAnalysisJobConfig {
            /**
             * Actions to execute at the completion of the job. Are executed in the order provided.
             */
            actions?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Action>[]>;
            /**
             * Privacy metric to compute.
             */
            privacyMetric?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2PrivacyMetric>;
            /**
             * Input dataset to compute metrics over.
             */
            sourceTable?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * If set, the detailed findings will be persisted to the specified OutputStorageConfig. Only a single instance of this action can be specified. Compatible with: Inspect, Risk
         */
        interface GooglePrivacyDlpV2SaveFindings {
            /**
             * Location to store findings outside of DLP.
             */
            outputConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2OutputStorageConfig>;
        }
        /**
         * Schedule for inspect job triggers.
         */
        interface GooglePrivacyDlpV2Schedule {
            /**
             * With this option a job is started a regular periodic basis. For example: every day (86400 seconds). A scheduled start time will be skipped if the previous execution has not ended when its scheduled time occurs. This value must be set to a time duration greater than or equal to 1 day and can be no longer than 60 days.
             */
            recurrencePeriodDuration?: pulumi.Input<string>;
        }
        /**
         * An auxiliary table containing statistical information on the relative frequency of different quasi-identifiers values. It has one or several quasi-identifiers columns, and one column that indicates the relative frequency of each quasi-identifier tuple. If a tuple is present in the data but not in the auxiliary table, the corresponding relative frequency is assumed to be zero (and thus, the tuple is highly reidentifiable).
         */
        interface GooglePrivacyDlpV2StatisticalTable {
            /**
             * Required. Quasi-identifier columns.
             */
            quasiIds?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2QuasiIdentifierField>[]>;
            /**
             * Required. The relative frequency column must contain a floating-point number between 0 and 1 (inclusive). Null values are assumed to be zero.
             */
            relativeFrequency?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * Required. Auxiliary table location.
             */
            table?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryTable>;
        }
        /**
         * Shared message indicating Cloud storage type.
         */
        interface GooglePrivacyDlpV2StorageConfig {
            /**
             * BigQuery options.
             */
            bigQueryOptions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2BigQueryOptions>;
            /**
             * Google Cloud Storage options.
             */
            cloudStorageOptions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2CloudStorageOptions>;
            /**
             * Google Cloud Datastore options.
             */
            datastoreOptions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2DatastoreOptions>;
            /**
             * Hybrid inspection options.
             */
            hybridOptions?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2HybridOptions>;
            timespanConfig?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2TimespanConfig>;
        }
        /**
         * Configuration for stored infoTypes. All fields and subfield are provided by the user. For more information, see https://cloud.google.com/dlp/docs/creating-custom-infotypes.
         */
        interface GooglePrivacyDlpV2StoredInfoTypeConfig {
            /**
             * Description of the StoredInfoType (max 256 characters).
             */
            description?: pulumi.Input<string>;
            /**
             * Store dictionary-based CustomInfoType.
             */
            dictionary?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Dictionary>;
            /**
             * Display name of the StoredInfoType (max 256 characters).
             */
            displayName?: pulumi.Input<string>;
            /**
             * StoredInfoType where findings are defined by a dictionary of phrases.
             */
            largeCustomDictionary?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2LargeCustomDictionaryConfig>;
            /**
             * Store regular expression-based StoredInfoType.
             */
            regex?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Regex>;
        }
        /**
         * A reference to a StoredInfoType to use with scanning.
         */
        interface GooglePrivacyDlpV2StoredType {
            /**
             * Timestamp indicating when the version of the `StoredInfoType` used for inspection was created. Output-only field, populated by the system.
             */
            createTime?: pulumi.Input<string>;
            /**
             * Resource name of the requested `StoredInfoType`, for example `organizations/433245324/storedInfoTypes/432452342` or `projects/project-id/storedInfoTypes/432452342`.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Message for detecting output from deidentification transformations such as [`CryptoReplaceFfxFpeConfig`](https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig). These types of transformations are those that perform pseudonymization, thereby producing a "surrogate" as output. This should be used in conjunction with a field on the transformation such as `surrogate_info_type`. This CustomInfoType does not support the use of `detection_rules`.
         */
        interface GooglePrivacyDlpV2SurrogateType {
        }
        /**
         * Instructions regarding the table content being inspected.
         */
        interface GooglePrivacyDlpV2TableOptions {
            /**
             * The columns that are the primary keys for table objects included in ContentItem. A copy of this cell's value will stored alongside alongside each finding so that the finding can be traced to the specific row it came from. No more than 3 may be provided.
             */
            identifyingFields?: pulumi.Input<pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>[]>;
        }
        /**
         * A column with a semantic tag attached.
         */
        interface GooglePrivacyDlpV2TaggedField {
            /**
             * A column can be tagged with a custom tag. In this case, the user must indicate an auxiliary table that contains statistical information on the possible values of this column (below).
             */
            customTag?: pulumi.Input<string>;
            /**
             * Required. Identifies the column.
             */
            field?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
            /**
             * If no semantic tag is indicated, we infer the statistical model from the distribution of values in the input data
             */
            inferred?: pulumi.Input<inputs.dlp.v2.GoogleProtobufEmpty>;
            /**
             * A column can be tagged with a InfoType to use the relevant public dataset as a statistical model of population, if available. We currently support US ZIP codes, region codes, ages and genders. To programmatically obtain the list of supported InfoTypes, use ListInfoTypes with the supported_by=RISK_ANALYSIS filter.
             */
            infoType?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2InfoType>;
        }
        /**
         * Throw an error and fail the request when a transformation error occurs.
         */
        interface GooglePrivacyDlpV2ThrowError {
        }
        /**
         * For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value.
         */
        interface GooglePrivacyDlpV2TimePartConfig {
            /**
             * The part of the time to keep.
             */
            partToExtract?: pulumi.Input<string>;
        }
        /**
         * Configuration of the timespan of the items to include in scanning. Currently only supported when inspecting Google Cloud Storage and BigQuery.
         */
        interface GooglePrivacyDlpV2TimespanConfig {
            /**
             * When the job is started by a JobTrigger we will automatically figure out a valid start_time to avoid scanning files that have not been modified since the last time the JobTrigger executed. This will be based on the time of the execution of the last run of the JobTrigger.
             */
            enableAutoPopulationOfTimespanConfig?: pulumi.Input<boolean>;
            /**
             * Exclude files, tables, or rows newer than this value. If not set, no upper time limit is applied.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Exclude files, tables, or rows older than this value. If not set, no lower time limit is applied.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Specification of the field containing the timestamp of scanned items. Used for data sources like Datastore and BigQuery. For BigQuery: If this value is not specified and the table was modified between the given start and end times, the entire table will be scanned. If this value is specified, then rows are filtered based on the given start and end times. Rows with a `NULL` value in the provided BigQuery column are skipped. Valid data types of the provided BigQuery column are: `INTEGER`, `DATE`, `TIMESTAMP`, and `DATETIME`. For Datastore: If this value is specified, then entities are filtered based on the given start and end times. If an entity does not contain the provided timestamp property or contains empty or invalid values, then it is included. Valid data types of the provided timestamp property are: `TIMESTAMP`.
             */
            timestampField?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2FieldId>;
        }
        /**
         * How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`.
         */
        interface GooglePrivacyDlpV2TransformationErrorHandling {
            /**
             * Ignore errors
             */
            leaveUntransformed?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2LeaveUntransformed>;
            /**
             * Throw an error
             */
            throwError?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2ThrowError>;
        }
        /**
         * Use this to have a random data crypto key generated. It will be discarded after the request finishes.
         */
        interface GooglePrivacyDlpV2TransientCryptoKey {
            /**
             * Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
             */
            name?: pulumi.Input<string>;
        }
        /**
         * What event needs to occur for a new job to be started.
         */
        interface GooglePrivacyDlpV2Trigger {
            /**
             * For use with hybrid jobs. Jobs must be manually created and finished.
             */
            manual?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Manual>;
            /**
             * Create a job on a repeating basis based on the elapse of time.
             */
            schedule?: pulumi.Input<inputs.dlp.v2.GooglePrivacyDlpV2Schedule>;
        }
        /**
         * Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.
         */
        interface GooglePrivacyDlpV2UnwrappedCryptoKey {
            /**
             * Required. A 128/192/256 bit key.
             */
            key?: pulumi.Input<string>;
        }
        /**
         * Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.
         */
        interface GooglePrivacyDlpV2Value {
            /**
             * boolean
             */
            booleanValue?: pulumi.Input<boolean>;
            /**
             * date
             */
            dateValue?: pulumi.Input<inputs.dlp.v2.GoogleTypeDate>;
            /**
             * day of week
             */
            dayOfWeekValue?: pulumi.Input<string>;
            /**
             * float
             */
            floatValue?: pulumi.Input<number>;
            /**
             * integer
             */
            integerValue?: pulumi.Input<string>;
            /**
             * string
             */
            stringValue?: pulumi.Input<string>;
            /**
             * time of day
             */
            timeValue?: pulumi.Input<inputs.dlp.v2.GoogleTypeTimeOfDay>;
            /**
             * timestamp
             */
            timestampValue?: pulumi.Input<string>;
        }
        /**
         * Message defining a list of words or phrases to search for in the data.
         */
        interface GooglePrivacyDlpV2WordList {
            /**
             * Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]
             */
            words?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
         */
        interface GoogleProtobufEmpty {
        }
        /**
         * Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
         */
        interface GoogleTypeDate {
            /**
             * Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
             */
            day?: pulumi.Input<number>;
            /**
             * Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
             */
            month?: pulumi.Input<number>;
            /**
             * Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             */
            year?: pulumi.Input<number>;
        }
        /**
         * Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`.
         */
        interface GoogleTypeTimeOfDay {
            /**
             * Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
             */
            hours?: pulumi.Input<number>;
            /**
             * Minutes of hour of day. Must be from 0 to 59.
             */
            minutes?: pulumi.Input<number>;
            /**
             * Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
             */
            seconds?: pulumi.Input<number>;
        }
    }
}
export declare namespace dns {
    namespace v1 {
        /**
         * Parameters for DnsKey key generation. Used for generating initial keys for a new ManagedZone and as default when adding a new DnsKey.
         */
        interface DnsKeySpec {
            /**
             * String mnemonic specifying the DNSSEC algorithm of this key.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * Length of the keys in bits.
             */
            keyLength?: pulumi.Input<number>;
            /**
             * Specifies whether this is a key signing key (KSK) or a zone signing key (ZSK). Key signing keys have the Secure Entry Point flag set and, when active, are only used to sign resource record sets of type DNSKEY. Zone signing keys do not have the Secure Entry Point flag set and are used to sign all other types of resource record sets.
             */
            keyType?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface ManagedZoneDnsSecConfig {
            /**
             * Specifies parameters for generating initial DnsKeys for this ManagedZone. Can only be changed while the state is OFF.
             */
            defaultKeySpecs?: pulumi.Input<pulumi.Input<inputs.dns.v1.DnsKeySpec>[]>;
            kind?: pulumi.Input<string>;
            /**
             * Specifies the mechanism for authenticated denial-of-existence responses. Can only be changed while the state is OFF.
             */
            nonExistence?: pulumi.Input<string>;
            /**
             * Specifies whether DNSSEC is enabled, and what mode it is in.
             */
            state?: pulumi.Input<string>;
        }
        interface ManagedZoneForwardingConfig {
            kind?: pulumi.Input<string>;
            /**
             * List of target name servers to forward to. Cloud DNS selects the best available name server if more than one target is given.
             */
            targetNameServers?: pulumi.Input<pulumi.Input<inputs.dns.v1.ManagedZoneForwardingConfigNameServerTarget>[]>;
        }
        interface ManagedZoneForwardingConfigNameServerTarget {
            /**
             * Forwarding path for this NameServerTarget. If unset or set to DEFAULT, Cloud DNS makes forwarding decisions based on IP address ranges; that is, RFC1918 addresses go to the VPC network, non-RFC1918 addresses go to the internet. When set to PRIVATE, Cloud DNS always sends queries through the VPC network for this target.
             */
            forwardingPath?: pulumi.Input<string>;
            /**
             * IPv4 address of a target name server.
             */
            ipv4Address?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface ManagedZonePeeringConfig {
            kind?: pulumi.Input<string>;
            /**
             * The network with which to peer.
             */
            targetNetwork?: pulumi.Input<inputs.dns.v1.ManagedZonePeeringConfigTargetNetwork>;
        }
        interface ManagedZonePeeringConfigTargetNetwork {
            /**
             * The time at which the zone was deactivated, in RFC 3339 date-time format. An empty string indicates that the peering connection is active. The producer network can deactivate a zone. The zone is automatically deactivated if the producer network that the zone targeted is deleted. Output only.
             */
            deactivateTime?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to forward queries to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        interface ManagedZonePrivateVisibilityConfig {
            kind?: pulumi.Input<string>;
            /**
             * The list of VPC networks that can see this zone.
             */
            networks?: pulumi.Input<pulumi.Input<inputs.dns.v1.ManagedZonePrivateVisibilityConfigNetwork>[]>;
        }
        interface ManagedZonePrivateVisibilityConfigNetwork {
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to bind to. Format this URL like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        interface ManagedZoneReverseLookupConfig {
            kind?: pulumi.Input<string>;
        }
        /**
         * Contains information about Service Directory-backed zones.
         */
        interface ManagedZoneServiceDirectoryConfig {
            kind?: pulumi.Input<string>;
            /**
             * Contains information about the namespace associated with the zone.
             */
            namespace?: pulumi.Input<inputs.dns.v1.ManagedZoneServiceDirectoryConfigNamespace>;
        }
        interface ManagedZoneServiceDirectoryConfigNamespace {
            /**
             * The time that the namespace backing this zone was deleted; an empty string if it still exists. This is in RFC3339 text format. Output only.
             */
            deletionTime?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the namespace associated with the zone. Format must be https://servicedirectory.googleapis.com/v1/projects/{project}/locations/{location}/namespaces/{namespace}
             */
            namespaceUrl?: pulumi.Input<string>;
        }
        interface PolicyAlternativeNameServerConfig {
            kind?: pulumi.Input<string>;
            /**
             * Sets an alternative name server for the associated networks. When specified, all DNS queries are forwarded to a name server that you choose. Names such as .internal are not available when an alternative name server is specified.
             */
            targetNameServers?: pulumi.Input<pulumi.Input<inputs.dns.v1.PolicyAlternativeNameServerConfigTargetNameServer>[]>;
        }
        interface PolicyAlternativeNameServerConfigTargetNameServer {
            /**
             * Forwarding path for this TargetNameServer. If unset or set to DEFAULT, Cloud DNS makes forwarding decisions based on address ranges; that is, RFC1918 addresses go to the VPC network, non-RFC1918 addresses go to the internet. When set to PRIVATE, Cloud DNS always sends queries through the VPC network for this target.
             */
            forwardingPath?: pulumi.Input<string>;
            /**
             * IPv4 address to forward to.
             */
            ipv4Address?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface PolicyNetwork {
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to bind to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        /**
         * A unit of data that is returned by the DNS servers.
         */
        interface ResourceRecordSet {
            kind?: pulumi.Input<string>;
            /**
             * For example, www.example.com.
             */
            name?: pulumi.Input<string>;
            /**
             * As defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1) -- see examples.
             */
            rrdatas?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * As defined in RFC 4034 (section 3.2).
             */
            signatureRrdatas?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Number of seconds that this ResourceRecordSet can be cached by resolvers.
             */
            ttl?: pulumi.Input<number>;
            /**
             * The identifier of a supported record type. See the list of Supported DNS record types.
             */
            type?: pulumi.Input<string>;
        }
    }
    namespace v1beta2 {
        /**
         * Parameters for DnsKey key generation. Used for generating initial keys for a new ManagedZone and as default when adding a new DnsKey.
         */
        interface DnsKeySpec {
            /**
             * String mnemonic specifying the DNSSEC algorithm of this key.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * Length of the keys in bits.
             */
            keyLength?: pulumi.Input<number>;
            /**
             * Specifies whether this is a key signing key (KSK) or a zone signing key (ZSK). Key signing keys have the Secure Entry Point flag set and, when active, are only used to sign resource record sets of type DNSKEY. Zone signing keys do not have the Secure Entry Point flag set and are used to sign all other types of resource record sets.
             */
            keyType?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface ManagedZoneDnsSecConfig {
            /**
             * Specifies parameters for generating initial DnsKeys for this ManagedZone. Can only be changed while the state is OFF.
             */
            defaultKeySpecs?: pulumi.Input<pulumi.Input<inputs.dns.v1beta2.DnsKeySpec>[]>;
            kind?: pulumi.Input<string>;
            /**
             * Specifies the mechanism for authenticated denial-of-existence responses. Can only be changed while the state is OFF.
             */
            nonExistence?: pulumi.Input<string>;
            /**
             * Specifies whether DNSSEC is enabled, and what mode it is in.
             */
            state?: pulumi.Input<string>;
        }
        interface ManagedZoneForwardingConfig {
            kind?: pulumi.Input<string>;
            /**
             * List of target name servers to forward to. Cloud DNS selects the best available name server if more than one target is given.
             */
            targetNameServers?: pulumi.Input<pulumi.Input<inputs.dns.v1beta2.ManagedZoneForwardingConfigNameServerTarget>[]>;
        }
        interface ManagedZoneForwardingConfigNameServerTarget {
            /**
             * Forwarding path for this NameServerTarget. If unset or set to DEFAULT, Cloud DNS makes forwarding decisions based on IP address ranges; that is, RFC1918 addresses go to the VPC network, non-RFC1918 addresses go to the internet. When set to PRIVATE, Cloud DNS always sends queries through the VPC network for this target.
             */
            forwardingPath?: pulumi.Input<string>;
            /**
             * IPv4 address of a target name server.
             */
            ipv4Address?: pulumi.Input<string>;
            /**
             * IPv6 address of a target name server. Does not accept both fields (ipv4 & ipv6) being populated.
             */
            ipv6Address?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface ManagedZonePeeringConfig {
            kind?: pulumi.Input<string>;
            /**
             * The network with which to peer.
             */
            targetNetwork?: pulumi.Input<inputs.dns.v1beta2.ManagedZonePeeringConfigTargetNetwork>;
        }
        interface ManagedZonePeeringConfigTargetNetwork {
            /**
             * The time at which the zone was deactivated, in RFC 3339 date-time format. An empty string indicates that the peering connection is active. The producer network can deactivate a zone. The zone is automatically deactivated if the producer network that the zone targeted is deleted. Output only.
             */
            deactivateTime?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to forward queries to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        interface ManagedZonePrivateVisibilityConfig {
            kind?: pulumi.Input<string>;
            /**
             * The list of VPC networks that can see this zone.
             */
            networks?: pulumi.Input<pulumi.Input<inputs.dns.v1beta2.ManagedZonePrivateVisibilityConfigNetwork>[]>;
        }
        interface ManagedZonePrivateVisibilityConfigNetwork {
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to bind to. Format this URL like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        interface ManagedZoneReverseLookupConfig {
            kind?: pulumi.Input<string>;
        }
        /**
         * Contains information about Service Directory-backed zones.
         */
        interface ManagedZoneServiceDirectoryConfig {
            kind?: pulumi.Input<string>;
            /**
             * Contains information about the namespace associated with the zone.
             */
            namespace?: pulumi.Input<inputs.dns.v1beta2.ManagedZoneServiceDirectoryConfigNamespace>;
        }
        interface ManagedZoneServiceDirectoryConfigNamespace {
            /**
             * The time that the namespace backing this zone was deleted; an empty string if it still exists. This is in RFC3339 text format. Output only.
             */
            deletionTime?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the namespace associated with the zone. Format must be https://servicedirectory.googleapis.com/v1/projects/{project}/locations/{location}/namespaces/{namespace}
             */
            namespaceUrl?: pulumi.Input<string>;
        }
        interface PolicyAlternativeNameServerConfig {
            kind?: pulumi.Input<string>;
            /**
             * Sets an alternative name server for the associated networks. When specified, all DNS queries are forwarded to a name server that you choose. Names such as .internal are not available when an alternative name server is specified.
             */
            targetNameServers?: pulumi.Input<pulumi.Input<inputs.dns.v1beta2.PolicyAlternativeNameServerConfigTargetNameServer>[]>;
        }
        interface PolicyAlternativeNameServerConfigTargetNameServer {
            /**
             * Forwarding path for this TargetNameServer. If unset or set to DEFAULT, Cloud DNS makes forwarding decisions based on address ranges; that is, RFC1918 addresses go to the VPC network, non-RFC1918 addresses go to the internet. When set to PRIVATE, Cloud DNS always sends queries through the VPC network for this target.
             */
            forwardingPath?: pulumi.Input<string>;
            /**
             * IPv4 address to forward to.
             */
            ipv4Address?: pulumi.Input<string>;
            /**
             * IPv6 address to forward to. Does not accept both fields (ipv4 & ipv6) being populated.
             */
            ipv6Address?: pulumi.Input<string>;
            kind?: pulumi.Input<string>;
        }
        interface PolicyNetwork {
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to bind to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        /**
         * A unit of data that is returned by the DNS servers.
         */
        interface ResourceRecordSet {
            kind?: pulumi.Input<string>;
            /**
             * For example, www.example.com.
             */
            name?: pulumi.Input<string>;
            /**
             * As defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1) -- see examples.
             */
            rrdatas?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * As defined in RFC 4034 (section 3.2).
             */
            signatureRrdatas?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Number of seconds that this ResourceRecordSet can be cached by resolvers.
             */
            ttl?: pulumi.Input<number>;
            /**
             * The identifier of a supported record type. See the list of Supported DNS record types.
             */
            type?: pulumi.Input<string>;
        }
        interface ResponsePolicyNetwork {
            kind?: pulumi.Input<string>;
            /**
             * The fully qualified URL of the VPC network to bind to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}
             */
            networkUrl?: pulumi.Input<string>;
        }
        interface ResponsePolicyRuleLocalData {
            /**
             * All resource record sets for this selector, one per resource record type. The name must match the dns_name.
             */
            localDatas?: pulumi.Input<pulumi.Input<inputs.dns.v1beta2.ResourceRecordSet>[]>;
        }
    }
}
export declare namespace domains {
    namespace v1alpha2 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.domains.v1alpha2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.domains.v1alpha2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.domains.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.domains.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace eventarc {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.eventarc.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.eventarc.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a Cloud Run destination.
         */
        interface CloudRun {
            /**
             * Optional. The relative path on the Cloud Run service the events should be sent to. The value must conform to the definition of URI path segment (section 3.3 of RFC2396). Examples: "/route", "route", "route/subroute".
             */
            path?: pulumi.Input<string>;
            /**
             * Required. The region the Cloud Run service is deployed in.
             */
            region?: pulumi.Input<string>;
            /**
             * Required. The name of the Cloud Run service being addressed. See https://cloud.google.com/run/docs/reference/rest/v1/namespaces.services. Only services located in the same project of the trigger object can be addressed.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Represents a target of an invocation over HTTP.
         */
        interface Destination {
            /**
             * Cloud Run fully-managed service that receives the events. The service should be running in the same project of the trigger.
             */
            cloudRun?: pulumi.Input<inputs.eventarc.v1.CloudRun>;
        }
        /**
         * Filters events based on exact matches on the CloudEvents attributes.
         */
        interface EventFilter {
            /**
             * Required. The name of a CloudEvents attribute. Currently, only a subset of attributes are supported for filtering. All triggers MUST provide a filter for the 'type' attribute.
             */
            attribute?: pulumi.Input<string>;
            /**
             * Required. The value for the attribute.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Represents a Pub/Sub transport.
         */
        interface Pubsub {
            /**
             * Optional. The name of the Pub/Sub topic created and managed by Eventarc system as a transport for the event delivery. Format: `projects/{PROJECT_ID}/topics/{TOPIC_NAME}`. You may set an existing topic for triggers of the type `google.cloud.pubsub.topic.v1.messagePublished` only. The topic you provide here will not be deleted by Eventarc at trigger deletion.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Represents the transport intermediaries created for the trigger in order to deliver events.
         */
        interface Transport {
            /**
             * The Pub/Sub topic and subscription used by Eventarc as delivery intermediary.
             */
            pubsub?: pulumi.Input<inputs.eventarc.v1.Pubsub>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.eventarc.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.eventarc.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a Cloud Run service destination.
         */
        interface CloudRunService {
            /**
             * Optional. The relative path on the Cloud Run service the events should be sent to. The value must conform to the definition of URI path segment (section 3.3 of RFC2396). Examples: "/route", "route", "route/subroute".
             */
            path?: pulumi.Input<string>;
            /**
             * Required. The region the Cloud Run service is deployed in.
             */
            region?: pulumi.Input<string>;
            /**
             * Required. The name of the Cloud run service being addressed (see https://cloud.google.com/run/docs/reference/rest/v1/namespaces.services). Only services located in the same project of the trigger object can be addressed.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Represents a target of an invocation over HTTP.
         */
        interface Destination {
            /**
             * Cloud Run fully-managed service that receives the events. The service should be running in the same project as the trigger.
             */
            cloudRunService?: pulumi.Input<inputs.eventarc.v1beta1.CloudRunService>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Matches events based on exact matches on the CloudEvents attributes.
         */
        interface MatchingCriteria {
            /**
             * Required. The name of a CloudEvents attribute. Currently, only a subset of attributes can be specified. All triggers MUST provide a matching criteria for the 'type' attribute.
             */
            attribute?: pulumi.Input<string>;
            /**
             * Required. The value for the attribute.
             */
            value?: pulumi.Input<string>;
        }
    }
}
export declare namespace file {
    namespace v1 {
        /**
         * File share configuration for the instance.
         */
        interface FileShareConfig {
            /**
             * File share capacity in gigabytes (GB). Cloud Filestore defines 1 GB as 1024^3 bytes.
             */
            capacityGb?: pulumi.Input<string>;
            /**
             * The name of the file share (must be 16 characters or less).
             */
            name?: pulumi.Input<string>;
            /**
             * Nfs Export Options. There is a limit of 10 export options per file share.
             */
            nfsExportOptions?: pulumi.Input<pulumi.Input<inputs.file.v1.NfsExportOptions>[]>;
            /**
             * The resource name of the backup, in the format projects/{project_number}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
             */
            sourceBackup?: pulumi.Input<string>;
        }
        /**
         * Network configuration for the instance.
         */
        interface NetworkConfig {
            /**
             * Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
             */
            modes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
             */
            network?: pulumi.Input<string>;
            /**
             * A /29 CIDR block in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/29. The range you specify can't overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
             */
            reservedIpRange?: pulumi.Input<string>;
        }
        /**
         * NFS export options specifications.
         */
        interface NfsExportOptions {
            /**
             * Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
             */
            accessMode?: pulumi.Input<string>;
            /**
             * An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
             */
            anonGid?: pulumi.Input<string>;
            /**
             * An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
             */
            anonUid?: pulumi.Input<string>;
            /**
             * List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             */
            ipRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
             */
            squashMode?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * File share configuration for the instance.
         */
        interface FileShareConfig {
            /**
             * File share capacity in gigabytes (GB). Cloud Filestore defines 1 GB as 1024^3 bytes.
             */
            capacityGb?: pulumi.Input<string>;
            /**
             * The name of the file share (must be 16 characters or less).
             */
            name?: pulumi.Input<string>;
            /**
             * Nfs Export Options. There is a limit of 10 export options per file share.
             */
            nfsExportOptions?: pulumi.Input<pulumi.Input<inputs.file.v1beta1.NfsExportOptions>[]>;
            /**
             * The resource name of the backup, in the format projects/{project_id}/locations/{location_id}/backups/{backup_id}, that this file share has been restored from.
             */
            sourceBackup?: pulumi.Input<string>;
        }
        /**
         * Network configuration for the instance.
         */
        interface NetworkConfig {
            /**
             * Internet protocol versions for which the instance has IP addresses assigned. For this version, only MODE_IPV4 is supported.
             */
            modes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The name of the Google Compute Engine [VPC network](/compute/docs/networks-and-firewalls#networks) to which the instance is connected.
             */
            network?: pulumi.Input<string>;
            /**
             * A /29 CIDR block for Basic or a /23 CIDR block for High Scale in one of the [internal IP address ranges](https://www.arin.net/knowledge/address_filters.html) that identifies the range of IP addresses reserved for this instance. For example, 10.0.0.0/29 or 192.168.0.0/23. The range you specify can't overlap with either existing subnets or assigned IP address ranges for other Cloud Filestore instances in the selected VPC network.
             */
            reservedIpRange?: pulumi.Input<string>;
        }
        /**
         * NFS export options specifications.
         */
        interface NfsExportOptions {
            /**
             * Either READ_ONLY, for allowing only read requests on the exported directory, or READ_WRITE, for allowing both read and write requests. The default is READ_WRITE.
             */
            accessMode?: pulumi.Input<string>;
            /**
             * An integer representing the anonymous group id with a default value of 65534. Anon_gid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
             */
            anonGid?: pulumi.Input<string>;
            /**
             * An integer representing the anonymous user id with a default value of 65534. Anon_uid may only be set with squash_mode of ROOT_SQUASH. An error will be returned if this field is specified for other squash_mode settings.
             */
            anonUid?: pulumi.Input<string>;
            /**
             * List of either an IPv4 addresses in the format {octet 1}.{octet 2}.{octet 3}.{octet 4} or CIDR ranges in the format {octet 1}.{octet 2}.{octet 3}.{octet 4}/{mask size} which may mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error will be returned. The limit is 64 IP ranges/addresses for each FileShareConfig among all NfsExportOptions.
             */
            ipRanges?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Either NO_ROOT_SQUASH, for allowing root access on the exported directory, or ROOT_SQUASH, for not allowing root access. The default is NO_ROOT_SQUASH.
             */
            squashMode?: pulumi.Input<string>;
        }
    }
}
export declare namespace firebasedynamiclinks {
    namespace v1 {
        /**
         * Tracking parameters supported by Dynamic Link.
         */
        interface AnalyticsInfo {
            /**
             * Google Play Campaign Measurements.
             */
            googlePlayAnalytics?: pulumi.Input<inputs.firebasedynamiclinks.v1.GooglePlayAnalytics>;
            /**
             * iTunes Connect App Analytics.
             */
            itunesConnectAnalytics?: pulumi.Input<inputs.firebasedynamiclinks.v1.ITunesConnectAnalytics>;
        }
        /**
         * Android related attributes to the Dynamic Link.
         */
        interface AndroidInfo {
            /**
             * Link to open on Android if the app is not installed.
             */
            androidFallbackLink?: pulumi.Input<string>;
            /**
             * If specified, this overrides the ‘link’ parameter on Android.
             */
            androidLink?: pulumi.Input<string>;
            /**
             * Minimum version code for the Android app. If the installed app’s version code is lower, then the user is taken to the Play Store.
             */
            androidMinPackageVersionCode?: pulumi.Input<string>;
            /**
             * Android package name of the app.
             */
            androidPackageName?: pulumi.Input<string>;
        }
        /**
         * Desktop related attributes to the Dynamic Link.
         */
        interface DesktopInfo {
            /**
             * Link to open on desktop.
             */
            desktopFallbackLink?: pulumi.Input<string>;
        }
        /**
         * Information about a Dynamic Link.
         */
        interface DynamicLinkInfo {
            /**
             * Parameters used for tracking. See all tracking parameters in the [documentation](https://firebase.google.com/docs/dynamic-links/create-manually).
             */
            analyticsInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.AnalyticsInfo>;
            /**
             * Android related information. See Android related parameters in the [documentation](https://firebase.google.com/docs/dynamic-links/create-manually).
             */
            androidInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.AndroidInfo>;
            /**
             * Desktop related information. See desktop related parameters in the [documentation](https://firebase.google.com/docs/dynamic-links/create-manually).
             */
            desktopInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.DesktopInfo>;
            /**
             * E.g. https://maps.app.goo.gl, https://maps.page.link, https://g.co/maps More examples can be found in description of getNormalizedUriPrefix in j/c/g/firebase/dynamiclinks/uri/DdlDomain.java Will fallback to dynamic_link_domain is this field is missing
             */
            domainUriPrefix?: pulumi.Input<string>;
            /**
             * Dynamic Links domain that the project owns, e.g. abcd.app.goo.gl [Learn more](https://firebase.google.com/docs/dynamic-links/android/receive) on how to set up Dynamic Link domain associated with your Firebase project. Required if missing domain_uri_prefix.
             */
            dynamicLinkDomain?: pulumi.Input<string>;
            /**
             * iOS related information. See iOS related parameters in the [documentation](https://firebase.google.com/docs/dynamic-links/create-manually).
             */
            iosInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.IosInfo>;
            /**
             * The link your app will open, You can specify any URL your app can handle. This link must be a well-formatted URL, be properly URL-encoded, and use the HTTP or HTTPS scheme. See 'link' parameters in the [documentation](https://firebase.google.com/docs/dynamic-links/create-manually). Required.
             */
            link?: pulumi.Input<string>;
            /**
             * Information of navigation behavior of a Firebase Dynamic Links.
             */
            navigationInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.NavigationInfo>;
            /**
             * Parameters for social meta tag params. Used to set meta tag data for link previews on social sites.
             */
            socialMetaTagInfo?: pulumi.Input<inputs.firebasedynamiclinks.v1.SocialMetaTagInfo>;
        }
        /**
         * Parameters for Google Play Campaign Measurements. [Learn more](https://developers.google.com/analytics/devguides/collection/android/v4/campaigns#campaign-params)
         */
        interface GooglePlayAnalytics {
            /**
             * [AdWords autotagging parameter](https://support.google.com/analytics/answer/1033981?hl=en); used to measure Google AdWords ads. This value is generated dynamically and should never be modified.
             */
            gclid?: pulumi.Input<string>;
            /**
             * Campaign name; used for keyword analysis to identify a specific product promotion or strategic campaign.
             */
            utmCampaign?: pulumi.Input<string>;
            /**
             * Campaign content; used for A/B testing and content-targeted ads to differentiate ads or links that point to the same URL.
             */
            utmContent?: pulumi.Input<string>;
            /**
             * Campaign medium; used to identify a medium such as email or cost-per-click.
             */
            utmMedium?: pulumi.Input<string>;
            /**
             * Campaign source; used to identify a search engine, newsletter, or other source.
             */
            utmSource?: pulumi.Input<string>;
            /**
             * Campaign term; used with paid search to supply the keywords for ads.
             */
            utmTerm?: pulumi.Input<string>;
        }
        /**
         * Parameters for iTunes Connect App Analytics.
         */
        interface ITunesConnectAnalytics {
            /**
             * Affiliate token used to create affiliate-coded links.
             */
            at?: pulumi.Input<string>;
            /**
             * Campaign text that developers can optionally add to any link in order to track sales from a specific marketing campaign.
             */
            ct?: pulumi.Input<string>;
            /**
             * iTune media types, including music, podcasts, audiobooks and so on.
             */
            mt?: pulumi.Input<string>;
            /**
             * Provider token that enables analytics for Dynamic Links from within iTunes Connect.
             */
            pt?: pulumi.Input<string>;
        }
        /**
         * iOS related attributes to the Dynamic Link..
         */
        interface IosInfo {
            /**
             * iOS App Store ID.
             */
            iosAppStoreId?: pulumi.Input<string>;
            /**
             * iOS bundle ID of the app.
             */
            iosBundleId?: pulumi.Input<string>;
            /**
             * Custom (destination) scheme to use for iOS. By default, we’ll use the bundle ID as the custom scheme. Developer can override this behavior using this param.
             */
            iosCustomScheme?: pulumi.Input<string>;
            /**
             * Link to open on iOS if the app is not installed.
             */
            iosFallbackLink?: pulumi.Input<string>;
            /**
             * iPad bundle ID of the app.
             */
            iosIpadBundleId?: pulumi.Input<string>;
            /**
             * If specified, this overrides the ios_fallback_link value on iPads.
             */
            iosIpadFallbackLink?: pulumi.Input<string>;
            /**
             * iOS minimum version.
             */
            iosMinimumVersion?: pulumi.Input<string>;
        }
        /**
         * Information of navigation behavior.
         */
        interface NavigationInfo {
            /**
             * If this option is on, FDL click will be forced to redirect rather than show an interstitial page.
             */
            enableForcedRedirect?: pulumi.Input<boolean>;
        }
        /**
         * Parameters for social meta tag params. Used to set meta tag data for link previews on social sites.
         */
        interface SocialMetaTagInfo {
            /**
             * A short description of the link. Optional.
             */
            socialDescription?: pulumi.Input<string>;
            /**
             * An image url string. Optional.
             */
            socialImageLink?: pulumi.Input<string>;
            /**
             * Title to be displayed. Optional.
             */
            socialTitle?: pulumi.Input<string>;
        }
        /**
         * Short Dynamic Link suffix.
         */
        interface Suffix {
            /**
             * Only applies to Option.CUSTOM.
             */
            customSuffix?: pulumi.Input<string>;
            /**
             * Suffix option.
             */
            option?: pulumi.Input<string>;
        }
    }
}
export declare namespace firebasehosting {
    namespace v1beta1 {
        /**
         * Contains metadata about the user who performed an action, such as creating a release or finalizing a version.
         */
        interface ActingUser {
            /**
             * The email address of the user when the user performed the action.
             */
            email?: pulumi.Input<string>;
            /**
             * A profile image URL for the user. May not be present if the user has changed their email address or deleted their account.
             */
            imageUrl?: pulumi.Input<string>;
        }
        /**
         * Represents a DNS certificate challenge.
         */
        interface CertDnsChallenge {
            /**
             * The domain name upon which the DNS challenge must be satisfied.
             */
            domainName?: pulumi.Input<string>;
            /**
             * The value that must be present as a TXT record on the domain name to satisfy the challenge.
             */
            token?: pulumi.Input<string>;
        }
        /**
         * Represents an HTTP certificate challenge.
         */
        interface CertHttpChallenge {
            /**
             * The URL path on which to serve the specified token to satisfy the certificate challenge.
             */
            path?: pulumi.Input<string>;
            /**
             * The token to serve at the specified URL path to satisfy the certificate challenge.
             */
            token?: pulumi.Input<string>;
        }
        /**
         * A configured rewrite that directs requests to a Cloud Run service. If the Cloud Run service does not exist when setting or updating your Firebase Hosting configuration, then the request fails. Any errors from the Cloud Run service are passed to the end user (for example, if you delete a service, any requests directed to that service receive a `404` error).
         */
        interface CloudRunRewrite {
            /**
             * Optional. User-provided region where the Cloud Run service is hosted. Defaults to `us-central1` if not supplied.
             */
            region?: pulumi.Input<string>;
            /**
             * Required. User-defined ID of the Cloud Run service.
             */
            serviceId?: pulumi.Input<string>;
        }
        /**
         * The current certificate provisioning status information for a domain.
         */
        interface DomainProvisioning {
            /**
             * The TXT records (for the certificate challenge) that were found at the last DNS fetch.
             */
            certChallengeDiscoveredTxt?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The DNS challenge for generating a certificate.
             */
            certChallengeDns?: pulumi.Input<inputs.firebasehosting.v1beta1.CertDnsChallenge>;
            /**
             * The HTTP challenge for generating a certificate.
             */
            certChallengeHttp?: pulumi.Input<inputs.firebasehosting.v1beta1.CertHttpChallenge>;
            /**
             * The certificate provisioning status; updated when Firebase Hosting provisions an SSL certificate for the domain.
             */
            certStatus?: pulumi.Input<string>;
            /**
             * The IPs found at the last DNS fetch.
             */
            discoveredIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The time at which the last DNS fetch occurred.
             */
            dnsFetchTime?: pulumi.Input<string>;
            /**
             * The DNS record match status as of the last DNS fetch.
             */
            dnsStatus?: pulumi.Input<string>;
            /**
             * The list of IPs to which the domain is expected to resolve.
             */
            expectedIps?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Defines the behavior of a domain-level redirect. Domain redirects preserve the path of the redirect but replace the requested domain with the one specified in the redirect configuration.
         */
        interface DomainRedirect {
            /**
             * Required. The domain name to redirect to.
             */
            domainName?: pulumi.Input<string>;
            /**
             * Required. The redirect status code.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A [`Header`](https://firebase.google.com/docs/hosting/full-config#headers) specifies a URL pattern that, if matched to the request URL path, triggers Hosting to apply the specified custom response headers.
         */
        interface Header {
            /**
             * The user-supplied [glob](https://firebase.google.com/docs/hosting/full-config#glob_pattern_matching) to match against the request URL path.
             */
            glob?: pulumi.Input<string>;
            /**
             * Required. The additional headers to add to the response.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The user-supplied RE2 regular expression to match against the request URL path.
             */
            regex?: pulumi.Input<string>;
        }
        /**
         * If provided, i18n rewrites are enabled.
         */
        interface I18nConfig {
            /**
             * Required. The user-supplied path where country and language specific content will be looked for within the public directory.
             */
            root?: pulumi.Input<string>;
        }
        /**
         * Deprecated in favor of [site channels](sites.channels).
         */
        interface PreviewConfig {
            /**
             * If true, preview URLs are enabled for this version.
             */
            active?: pulumi.Input<boolean>;
            /**
             * Indicates the expiration time for previewing this version; preview URL requests received after this time will 404.
             */
            expireTime?: pulumi.Input<string>;
        }
        /**
         * A [`Redirect`](https://firebase.google.com/docs/hosting/full-config#redirects) specifies a URL pattern that, if matched to the request URL path, triggers Hosting to respond with a redirect to the specified destination path.
         */
        interface Redirect {
            /**
             * The user-supplied [glob](https://firebase.google.com/docs/hosting/full-config#glob_pattern_matching) to match against the request URL path.
             */
            glob?: pulumi.Input<string>;
            /**
             * Required. The value to put in the HTTP location header of the response. The location can contain capture group values from the pattern using a `:` prefix to identify the segment and an optional `*` to capture the rest of the URL. For example: "glob": "/:capture*", "statusCode": 301, "location": "https://example.com/foo/:capture"
             */
            location?: pulumi.Input<string>;
            /**
             * The user-supplied RE2 regular expression to match against the request URL path.
             */
            regex?: pulumi.Input<string>;
            /**
             * Required. The status HTTP code to return in the response. It must be a valid 3xx status code.
             */
            statusCode?: pulumi.Input<number>;
        }
        /**
         * A [`Rewrite`](https://firebase.google.com/docs/hosting/full-config#rewrites) specifies a URL pattern that, if matched to the request URL path, triggers Hosting to respond as if the service were given the specified destination URL.
         */
        interface Rewrite {
            /**
             * The request will be forwarded to Firebase Dynamic Links.
             */
            dynamicLinks?: pulumi.Input<boolean>;
            /**
             * The function to proxy requests to. Must match the exported function name exactly.
             */
            function?: pulumi.Input<string>;
            /**
             * The user-supplied [glob](https://firebase.google.com/docs/hosting/full-config#glob_pattern_matching) to match against the request URL path.
             */
            glob?: pulumi.Input<string>;
            /**
             * The URL path to rewrite the request to.
             */
            path?: pulumi.Input<string>;
            /**
             * The user-supplied RE2 regular expression to match against the request URL path.
             */
            regex?: pulumi.Input<string>;
            /**
             * The request will be forwarded to Cloud Run.
             */
            run?: pulumi.Input<inputs.firebasehosting.v1beta1.CloudRunRewrite>;
        }
        /**
         * The configuration for how incoming requests to a site should be routed and processed before serving content. The URL request paths are matched against the specified URL patterns in the configuration, then Hosting applies the applicable configuration according to a specific [priority order](https://firebase.google.com/docs/hosting/full-config#hosting_priority_order).
         */
        interface ServingConfig {
            /**
             * How to handle well known App Association files.
             */
            appAssociation?: pulumi.Input<string>;
            /**
             * Defines whether to drop the file extension from uploaded files.
             */
            cleanUrls?: pulumi.Input<boolean>;
            /**
             * An array of objects, where each object specifies a URL pattern that, if matched to the request URL path, triggers Hosting to apply the specified custom response headers.
             */
            headers?: pulumi.Input<pulumi.Input<inputs.firebasehosting.v1beta1.Header>[]>;
            /**
             * Optional. Defines i18n rewrite behavior.
             */
            i18n?: pulumi.Input<inputs.firebasehosting.v1beta1.I18nConfig>;
            /**
             * An array of objects (called redirect rules), where each rule specifies a URL pattern that, if matched to the request URL path, triggers Hosting to respond with a redirect to the specified destination path.
             */
            redirects?: pulumi.Input<pulumi.Input<inputs.firebasehosting.v1beta1.Redirect>[]>;
            /**
             * An array of objects (called rewrite rules), where each rule specifies a URL pattern that, if matched to the request URL path, triggers Hosting to respond as if the service were given the specified destination URL.
             */
            rewrites?: pulumi.Input<pulumi.Input<inputs.firebasehosting.v1beta1.Rewrite>[]>;
            /**
             * Defines how to handle a trailing slash in the URL path.
             */
            trailingSlashBehavior?: pulumi.Input<string>;
        }
        /**
         * A `Version` is a configuration and a collection of static files which determine how a site is displayed.
         */
        interface Version {
            /**
             * The configuration for the behavior of the site. This configuration exists in the [`firebase.json`](https://firebase.google.com/docs/cli/#the_firebasejson_file) file.
             */
            config?: pulumi.Input<inputs.firebasehosting.v1beta1.ServingConfig>;
            /**
             * The time at which the version was created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * Identifies the user who created the version.
             */
            createUser?: pulumi.Input<inputs.firebasehosting.v1beta1.ActingUser>;
            /**
             * The time at which the version was `DELETED`.
             */
            deleteTime?: pulumi.Input<string>;
            /**
             * Identifies the user who `DELETED` the version.
             */
            deleteUser?: pulumi.Input<inputs.firebasehosting.v1beta1.ActingUser>;
            /**
             * The total number of files associated with the version. This value is calculated after a version is `FINALIZED`.
             */
            fileCount?: pulumi.Input<string>;
            /**
             * The time at which the version was `FINALIZED`.
             */
            finalizeTime?: pulumi.Input<string>;
            /**
             * Identifies the user who `FINALIZED` the version.
             */
            finalizeUser?: pulumi.Input<inputs.firebasehosting.v1beta1.ActingUser>;
            /**
             * The labels used for extra metadata and/or filtering.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The fully-qualified resource name for the version, in the format: sites/ SITE_ID/versions/VERSION_ID This name is provided in the response body when you call [`CreateVersion`](sites.versions/create).
             */
            name?: pulumi.Input<string>;
            /**
             * Deprecated in favor of [site channels](sites.channels).
             */
            preview?: pulumi.Input<inputs.firebasehosting.v1beta1.PreviewConfig>;
            /**
             * The deploy status of the version. For a successful deploy, call [`CreateVersion`](sites.versions/create) to make a new version (`CREATED` status), [upload all desired files](sites.versions/populateFiles) to the version, then [update](sites.versions/patch) the version to the `FINALIZED` status. Note that if you leave the version in the `CREATED` state for more than 12 hours, the system will automatically mark the version as `ABANDONED`. You can also change the status of a version to `DELETED` by calling [`DeleteVersion`](sites.versions/delete).
             */
            status?: pulumi.Input<string>;
            /**
             * The total stored bytesize of the version. This value is calculated after a version is `FINALIZED`.
             */
            versionBytes?: pulumi.Input<string>;
        }
    }
}
export declare namespace firebaseml {
    namespace v1beta2 {
        /**
         * State common to all model types. Includes publishing and validation information.
         */
        interface ModelState {
            /**
             * Indicates if this model has been published.
             */
            published?: pulumi.Input<boolean>;
        }
        /**
         * Information that is specific to TfLite models.
         */
        interface TfLiteModel {
            /**
             * The AutoML model id referencing a model you created with the AutoML API. The name should have format 'projects//locations//models/' (This is the model resource name returned from the AutoML API)
             */
            automlModel?: pulumi.Input<string>;
            /**
             * The TfLite file containing the model. (Stored in Google Cloud). The gcs_tflite_uri should have form: gs://some-bucket/some-model.tflite Note: If you update the file in the original location, it is necessary to call UpdateModel for ML to pick up and validate the updated file.
             */
            gcsTfliteUri?: pulumi.Input<string>;
        }
    }
}
export declare namespace firebaserules {
    namespace v1 {
        /**
         * `File` containing source content.
         */
        interface File {
            /**
             * Textual Content.
             */
            content?: pulumi.Input<string>;
            /**
             * Fingerprint (e.g. github sha) associated with the `File`.
             */
            fingerprint?: pulumi.Input<string>;
            /**
             * File name.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Metadata for a Ruleset.
         */
        interface Metadata {
            /**
             * Services that this ruleset has declarations for (e.g., "cloud.firestore"). There may be 0+ of these.
             */
            services?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * `Source` is one or more `File` messages comprising a logical set of rules.
         */
        interface Source {
            /**
             * `File` set constituting the `Source` bundle.
             */
            files?: pulumi.Input<pulumi.Input<inputs.firebaserules.v1.File>[]>;
        }
    }
}
export declare namespace firestore {
    namespace v1 {
        /**
         * A field in an index. The field_path describes which field is indexed, the value_mode describes how the field value is indexed.
         */
        interface GoogleFirestoreAdminV1IndexField {
            /**
             * Indicates that this field supports operations on `array_value`s.
             */
            arrayConfig?: pulumi.Input<string>;
            /**
             * Can be __name__. For single field indexes, this must match the name of the field or may be omitted.
             */
            fieldPath?: pulumi.Input<string>;
            /**
             * Indicates that this field supports ordering by the specified order or comparing using =, !=, <, <=, >, >=.
             */
            order?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * A field of an index.
         */
        interface GoogleFirestoreAdminV1beta1IndexField {
            /**
             * The path of the field. Must match the field path specification described by google.firestore.v1beta1.Document.fields. Special field path `__name__` may be used by itself or at the end of a path. `__type__` may be used only at the end of path.
             */
            fieldPath?: pulumi.Input<string>;
            /**
             * The field's mode.
             */
            mode?: pulumi.Input<string>;
        }
    }
    namespace v1beta2 {
        /**
         * A field in an index. The field_path describes which field is indexed, the value_mode describes how the field value is indexed.
         */
        interface GoogleFirestoreAdminV1beta2IndexField {
            /**
             * Indicates that this field supports operations on `array_value`s.
             */
            arrayConfig?: pulumi.Input<string>;
            /**
             * Can be __name__. For single field indexes, this must match the name of the field or may be omitted.
             */
            fieldPath?: pulumi.Input<string>;
            /**
             * Indicates that this field supports ordering by the specified order or comparing using =, <, <=, >, >=.
             */
            order?: pulumi.Input<string>;
        }
    }
}
export declare namespace gameservices {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.AuditLogConfig>[]>;
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            ignoreChildExemptions?: pulumi.Input<boolean>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authorization-related information used by Cloud Audit Logging.
         */
        interface AuthorizationLoggingOptions {
            /**
             * The type of the permission that was checked.
             */
            permissionType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            bindingId?: pulumi.Input<string>;
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gameservices.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Write a Cloud Audit log
         */
        interface CloudAuditOptions {
            /**
             * Information used by the Cloud Audit Logging pipeline.
             */
            authorizationLoggingOptions?: pulumi.Input<inputs.gameservices.v1.AuthorizationLoggingOptions>;
            /**
             * The log_name to populate in the Cloud Audit Record.
             */
            logName?: pulumi.Input<string>;
        }
        /**
         * A condition to be met.
         */
        interface Condition {
            /**
             * Trusted attributes supplied by the IAM system.
             */
            iam?: pulumi.Input<string>;
            /**
             * An operator to apply the subject with.
             */
            op?: pulumi.Input<string>;
            /**
             * Trusted attributes discharged by the service.
             */
            svc?: pulumi.Input<string>;
            /**
             * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
             */
            sys?: pulumi.Input<string>;
            /**
             * The objects of the condition.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Increment a streamz counter with the specified metric and field names. Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended. Field names correspond to IAM request parameters and field values are their respective values. Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields. Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/debug_access_count {iam_principal=[value of IAMContext.principal]}
         */
        interface CounterOptions {
            /**
             * Custom fields.
             */
            customFields?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.CustomField>[]>;
            /**
             * The field value to attribute.
             */
            field?: pulumi.Input<string>;
            /**
             * The metric to update.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Custom fields. These can be used to create a counter with arbitrary field/value pairs. See: go/rpcsp-custom-fields.
         */
        interface CustomField {
            /**
             * Name is the field name.
             */
            name?: pulumi.Input<string>;
            /**
             * Value is the field value. It is important that in contrast to the CounterOptions.field, the value here is a constant that is not derived from the IAMContext.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Write a Data Access (Gin) log
         */
        interface DataAccessOptions {
            logMode?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Fleet configs for Agones.
         */
        interface FleetConfig {
            /**
             * Agones fleet spec. Example spec: `https://agones.dev/site/docs/reference/fleet/`.
             */
            fleetSpec?: pulumi.Input<string>;
            /**
             * The name of the FleetConfig.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The game server cluster connection information.
         */
        interface GameServerClusterConnectionInfo {
            /**
             * Reference to the GKE cluster where the game servers are installed.
             */
            gkeClusterReference?: pulumi.Input<inputs.gameservices.v1.GkeClusterReference>;
            /**
             * Namespace designated on the game server cluster where the Agones game server instances will be created. Existence of the namespace will be validated during creation.
             */
            namespace?: pulumi.Input<string>;
        }
        /**
         * A reference to a GKE cluster.
         */
        interface GkeClusterReference {
            /**
             * The full or partial name of a GKE cluster, using one of the following forms: * `projects/{project}/locations/{location}/clusters/{cluster}` * `locations/{location}/clusters/{cluster}` * `{cluster}` If project and location are not specified, the project and location of the GameServerCluster resource are used to generate the full name of the GKE cluster.
             */
            cluster?: pulumi.Input<string>;
        }
        /**
         * The label selector, used to group labels on the resources.
         */
        interface LabelSelector {
            /**
             * Resource labels for this selector.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Specifies what kind of log the caller must write
         */
        interface LogConfig {
            /**
             * Cloud audit options.
             */
            cloudAudit?: pulumi.Input<inputs.gameservices.v1.CloudAuditOptions>;
            /**
             * Counter options.
             */
            counter?: pulumi.Input<inputs.gameservices.v1.CounterOptions>;
            /**
             * Data access options.
             */
            dataAccess?: pulumi.Input<inputs.gameservices.v1.DataAccessOptions>;
        }
        /**
         * A rule to be applied in a Policy.
         */
        interface Rule {
            /**
             * Required
             */
            action?: pulumi.Input<string>;
            /**
             * Additional restrictions that must be met. All conditions must pass for the rule to match.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.Condition>[]>;
            /**
             * Human-readable description of the rule.
             */
            description?: pulumi.Input<string>;
            /**
             * If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
             */
            in?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
             */
            logConfig?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.LogConfig>[]>;
            /**
             * If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. The format for in and not_in entries can be found at in the Local IAM documentation (see go/local-iam#features).
             */
            notIn?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
             */
            permissions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Autoscaling config for an Agones fleet.
         */
        interface ScalingConfig {
            /**
             * Required. Agones fleet autoscaler spec. Example spec: https://agones.dev/site/docs/reference/fleetautoscaler/
             */
            fleetAutoscalerSpec?: pulumi.Input<string>;
            /**
             * Required. The name of the Scaling Config
             */
            name?: pulumi.Input<string>;
            /**
             * The schedules to which this Scaling Config applies.
             */
            schedules?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.Schedule>[]>;
            /**
             * Labels used to identify the game server clusters to which this Agones scaling config applies. A game server cluster is subject to this Agones scaling config if its labels match any of the selector entries.
             */
            selectors?: pulumi.Input<pulumi.Input<inputs.gameservices.v1.LabelSelector>[]>;
        }
        /**
         * The schedule of a recurring or one time event. The event's time span is specified by start_time and end_time. If the scheduled event's timespan is larger than the cron_spec + cron_job_duration, the event will be recurring. If only cron_spec + cron_job_duration are specified, the event is effective starting at the local time specified by cron_spec, and is recurring. start_time|-------[cron job]-------[cron job]-------[cron job]---|end_time cron job: cron spec start time + duration
         */
        interface Schedule {
            /**
             * The duration for the cron job event. The duration of the event is effective after the cron job's start time.
             */
            cronJobDuration?: pulumi.Input<string>;
            /**
             * The cron definition of the scheduled event. See https://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as defined by the realm.
             */
            cronSpec?: pulumi.Input<string>;
            /**
             * The end time of the event.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The start time of the event.
             */
            startTime?: pulumi.Input<string>;
        }
    }
    namespace v1beta {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.AuditLogConfig>[]>;
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            ignoreChildExemptions?: pulumi.Input<boolean>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authorization-related information used by Cloud Audit Logging.
         */
        interface AuthorizationLoggingOptions {
            /**
             * The type of the permission that was checked.
             */
            permissionType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            bindingId?: pulumi.Input<string>;
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gameservices.v1beta.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Write a Cloud Audit log
         */
        interface CloudAuditOptions {
            /**
             * Information used by the Cloud Audit Logging pipeline.
             */
            authorizationLoggingOptions?: pulumi.Input<inputs.gameservices.v1beta.AuthorizationLoggingOptions>;
            /**
             * The log_name to populate in the Cloud Audit Record.
             */
            logName?: pulumi.Input<string>;
        }
        /**
         * A condition to be met.
         */
        interface Condition {
            /**
             * Trusted attributes supplied by the IAM system.
             */
            iam?: pulumi.Input<string>;
            /**
             * An operator to apply the subject with.
             */
            op?: pulumi.Input<string>;
            /**
             * Trusted attributes discharged by the service.
             */
            svc?: pulumi.Input<string>;
            /**
             * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
             */
            sys?: pulumi.Input<string>;
            /**
             * The objects of the condition.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Increment a streamz counter with the specified metric and field names. Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended. Field names correspond to IAM request parameters and field values are their respective values. Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields. Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/debug_access_count {iam_principal=[value of IAMContext.principal]}
         */
        interface CounterOptions {
            /**
             * Custom fields.
             */
            customFields?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.CustomField>[]>;
            /**
             * The field value to attribute.
             */
            field?: pulumi.Input<string>;
            /**
             * The metric to update.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Custom fields. These can be used to create a counter with arbitrary field/value pairs. See: go/rpcsp-custom-fields.
         */
        interface CustomField {
            /**
             * Name is the field name.
             */
            name?: pulumi.Input<string>;
            /**
             * Value is the field value. It is important that in contrast to the CounterOptions.field, the value here is a constant that is not derived from the IAMContext.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Write a Data Access (Gin) log
         */
        interface DataAccessOptions {
            logMode?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Fleet configs for Agones.
         */
        interface FleetConfig {
            /**
             * Agones fleet spec. Example spec: `https://agones.dev/site/docs/reference/fleet/`.
             */
            fleetSpec?: pulumi.Input<string>;
            /**
             * The name of the FleetConfig.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The game server cluster connection information.
         */
        interface GameServerClusterConnectionInfo {
            /**
             * Reference to the GKE cluster where the game servers are installed.
             */
            gkeClusterReference?: pulumi.Input<inputs.gameservices.v1beta.GkeClusterReference>;
            /**
             * Reference to a Kubernetes cluster registered through GKE Hub. See https://cloud.google.com/anthos/multicluster-management/ for more information about registering Kubernetes clusters.
             */
            gkeHubClusterReference?: pulumi.Input<inputs.gameservices.v1beta.GkeHubClusterReference>;
            /**
             * Namespace designated on the game server cluster where the Agones game server instances will be created. Existence of the namespace will be validated during creation.
             */
            namespace?: pulumi.Input<string>;
        }
        /**
         * A reference to a GKE cluster.
         */
        interface GkeClusterReference {
            /**
             * The full or partial name of a GKE cluster, using one of the following forms: * `projects/{project}/locations/{location}/clusters/{cluster}` * `locations/{location}/clusters/{cluster}` * `{cluster}` If project and location are not specified, the project and location of the GameServerCluster resource are used to generate the full name of the GKE cluster.
             */
            cluster?: pulumi.Input<string>;
        }
        /**
         * GkeHubClusterReference represents a reference to a Kubernetes cluster registered through GKE Hub.
         */
        interface GkeHubClusterReference {
            /**
             * The full or partial name of a GKE Hub membership, using one of the following forms: * `https://gkehub.googleapis.com/v1beta1/projects/{project_id}/locations/global/memberships/{membership_id}` * `projects/{project_id}/locations/global/memberships/{membership_id}` * `{membership_id}` If project is not specified, the project of the GameServerCluster resource is used to generate the full name of the GKE Hub membership.
             */
            membership?: pulumi.Input<string>;
        }
        /**
         * The label selector, used to group labels on the resources.
         */
        interface LabelSelector {
            /**
             * Resource labels for this selector.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Specifies what kind of log the caller must write
         */
        interface LogConfig {
            /**
             * Cloud audit options.
             */
            cloudAudit?: pulumi.Input<inputs.gameservices.v1beta.CloudAuditOptions>;
            /**
             * Counter options.
             */
            counter?: pulumi.Input<inputs.gameservices.v1beta.CounterOptions>;
            /**
             * Data access options.
             */
            dataAccess?: pulumi.Input<inputs.gameservices.v1beta.DataAccessOptions>;
        }
        /**
         * A rule to be applied in a Policy.
         */
        interface Rule {
            /**
             * Required
             */
            action?: pulumi.Input<string>;
            /**
             * Additional restrictions that must be met. All conditions must pass for the rule to match.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.Condition>[]>;
            /**
             * Human-readable description of the rule.
             */
            description?: pulumi.Input<string>;
            /**
             * If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
             */
            in?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
             */
            logConfig?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.LogConfig>[]>;
            /**
             * If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. The format for in and not_in entries can be found at in the Local IAM documentation (see go/local-iam#features).
             */
            notIn?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
             */
            permissions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Autoscaling config for an Agones fleet.
         */
        interface ScalingConfig {
            /**
             * Required. Agones fleet autoscaler spec. Example spec: https://agones.dev/site/docs/reference/fleetautoscaler/
             */
            fleetAutoscalerSpec?: pulumi.Input<string>;
            /**
             * Required. The name of the Scaling Config
             */
            name?: pulumi.Input<string>;
            /**
             * The schedules to which this Scaling Config applies.
             */
            schedules?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.Schedule>[]>;
            /**
             * Labels used to identify the game server clusters to which this Agones scaling config applies. A game server cluster is subject to this Agones scaling config if its labels match any of the selector entries.
             */
            selectors?: pulumi.Input<pulumi.Input<inputs.gameservices.v1beta.LabelSelector>[]>;
        }
        /**
         * The schedule of a recurring or one time event. The event's time span is specified by start_time and end_time. If the scheduled event's timespan is larger than the cron_spec + cron_job_duration, the event will be recurring. If only cron_spec + cron_job_duration are specified, the event is effective starting at the local time specified by cron_spec, and is recurring. start_time|-------[cron job]-------[cron job]-------[cron job]---|end_time cron job: cron spec start time + duration
         */
        interface Schedule {
            /**
             * The duration for the cron job event. The duration of the event is effective after the cron job's start time.
             */
            cronJobDuration?: pulumi.Input<string>;
            /**
             * The cron definition of the scheduled event. See https://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as defined by the realm.
             */
            cronSpec?: pulumi.Input<string>;
            /**
             * The end time of the event.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The start time of the event.
             */
            startTime?: pulumi.Input<string>;
        }
    }
}
export declare namespace genomics {
    namespace v1alpha2 {
        /**
         * A Google Compute Engine disk resource specification.
         */
        interface Disk {
            /**
             * Required at create time and cannot be overridden at run time. Specifies the path in the docker container where files on this disk should be located. For example, if `mountPoint` is `/mnt/disk`, and the parameter has `localPath` `inputs/file.txt`, the docker container can access the data at `/mnt/disk/inputs/file.txt`.
             */
            mountPoint?: pulumi.Input<string>;
            /**
             * Required. The name of the disk that can be used in the pipeline parameters. Must be 1 - 63 characters. The name "boot" is reserved for system use.
             */
            name?: pulumi.Input<string>;
            /**
             * Specifies how a sourced-base persistent disk will be mounted. See https://cloud.google.com/compute/docs/disks/persistent-disks#use_multi_instances for more details. Can only be set at create time.
             */
            readOnly?: pulumi.Input<boolean>;
            /**
             * The size of the disk. Defaults to 500 (GB). This field is not applicable for local SSD.
             */
            sizeGb?: pulumi.Input<number>;
            /**
             * The full or partial URL of the persistent disk to attach. See https://cloud.google.com/compute/docs/reference/latest/instances#resource and https://cloud.google.com/compute/docs/disks/persistent-disks#snapshots for more details.
             */
            source?: pulumi.Input<string>;
            /**
             * Required. The type of the disk to create.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * The Docker execuctor specification.
         */
        interface DockerExecutor {
            /**
             * Required. The command or newline delimited script to run. The command string will be executed within a bash shell. If the command exits with a non-zero exit code, output parameter de-localization will be skipped and the pipeline operation's `error` field will be populated. Maximum command string length is 16384.
             */
            cmd?: pulumi.Input<string>;
            /**
             * Required. Image name from either Docker Hub or Google Container Registry. Users that run pipelines must have READ access to the image.
             */
            imageName?: pulumi.Input<string>;
        }
        /**
         * LocalCopy defines how a remote file should be copied to and from the VM.
         */
        interface LocalCopy {
            /**
             * Required. The name of the disk where this parameter is located. Can be the name of one of the disks specified in the Resources field, or "boot", which represents the Docker instance's boot disk and has a mount point of `/`.
             */
            disk?: pulumi.Input<string>;
            /**
             * Required. The path within the user's docker container where this input should be localized to and from, relative to the specified disk's mount point. For example: file.txt,
             */
            path?: pulumi.Input<string>;
        }
        /**
         * Parameters facilitate setting and delivering data into the pipeline's execution environment. They are defined at create time, with optional defaults, and can be overridden at run time. If `localCopy` is unset, then the parameter specifies a string that is passed as-is into the pipeline, as the value of the environment variable with the given name. A default value can be optionally specified at create time. The default can be overridden at run time using the inputs map. If no default is given, a value must be supplied at runtime. If `localCopy` is defined, then the parameter specifies a data source or sink, both in Google Cloud Storage and on the Docker container where the pipeline computation is run. The service account associated with the Pipeline (by default the project's Compute Engine service account) must have access to the Google Cloud Storage paths. At run time, the Google Cloud Storage paths can be overridden if a default was provided at create time, or must be set otherwise. The pipeline runner should add a key/value pair to either the inputs or outputs map. The indicated data copies will be carried out before/after pipeline execution, just as if the corresponding arguments were provided to `gsutil cp`. For example: Given the following `PipelineParameter`, specified in the `inputParameters` list: ``` {name: "input_file", localCopy: {path: "file.txt", disk: "pd1"}} ``` where `disk` is defined in the `PipelineResources` object as: ``` {name: "pd1", mountPoint: "/mnt/disk/"} ``` We create a disk named `pd1`, mount it on the host VM, and map `/mnt/pd1` to `/mnt/disk` in the docker container. At runtime, an entry for `input_file` would be required in the inputs map, such as: ``` inputs["input_file"] = "gs://my-bucket/bar.txt" ``` This would generate the following gsutil call: ``` gsutil cp gs://my-bucket/bar.txt /mnt/pd1/file.txt ``` The file `/mnt/pd1/file.txt` maps to `/mnt/disk/file.txt` in the Docker container. Acceptable paths are: Google Cloud storage pathLocal path file file glob directory For outputs, the direction of the copy is reversed: ``` gsutil cp /mnt/disk/file.txt gs://my-bucket/bar.txt ``` Acceptable paths are: Local pathGoogle Cloud Storage path file file file directory - directory must already exist glob directory - directory will be created if it doesn't exist One restriction due to docker limitations, is that for outputs that are found on the boot disk, the local path cannot be a glob and must be a file.
         */
        interface PipelineParameter {
            /**
             * The default value for this parameter. Can be overridden at runtime. If `localCopy` is present, then this must be a Google Cloud Storage path beginning with `gs://`.
             */
            defaultValue?: pulumi.Input<string>;
            /**
             * Human-readable description.
             */
            description?: pulumi.Input<string>;
            /**
             * If present, this parameter is marked for copying to and from the VM. `LocalCopy` indicates where on the VM the file should be. The value given to this parameter (either at runtime or using `defaultValue`) must be the remote path where the file should be.
             */
            localCopy?: pulumi.Input<inputs.genomics.v1alpha2.LocalCopy>;
            /**
             * Required. Name of the parameter - the pipeline runner uses this string as the key to the input and output maps in RunPipeline.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * The system resources for the pipeline run.
         */
        interface PipelineResources {
            /**
             * Optional. The number of accelerators of the specified type to attach. By specifying this parameter, you will download and install the following third-party software onto your managed Compute Engine instances: NVIDIA® Tesla® drivers and NVIDIA® CUDA toolkit.
             */
            acceleratorCount?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine defined accelerator type. By specifying this parameter, you will download and install the following third-party software onto your managed Compute Engine instances: NVIDIA® Tesla® drivers and NVIDIA® CUDA toolkit. Please see https://cloud.google.com/compute/docs/gpus/ for a list of available accelerator types.
             */
            acceleratorType?: pulumi.Input<string>;
            /**
             * The size of the boot disk. Defaults to 10 (GB).
             */
            bootDiskSizeGb?: pulumi.Input<number>;
            /**
             * Disks to attach.
             */
            disks?: pulumi.Input<pulumi.Input<inputs.genomics.v1alpha2.Disk>[]>;
            /**
             * The minimum number of cores to use. Defaults to 1.
             */
            minimumCpuCores?: pulumi.Input<number>;
            /**
             * The minimum amount of RAM to use. Defaults to 3.75 (GB)
             */
            minimumRamGb?: pulumi.Input<number>;
            /**
             * Whether to assign an external IP to the instance. This is an experimental feature that may go away. Defaults to false. Corresponds to `--no_address` flag for [gcloud compute instances create] (https://cloud.google.com/sdk/gcloud/reference/compute/instances/create). In order to use this, must be true for both create time and run time. Cannot be true at run time if false at create time. If you need to ssh into a private IP VM for debugging, you can ssh to a public VM and then ssh into the private VM's Internal IP. If noAddress is set, this pipeline run may only load docker images from Google Container Registry and not Docker Hub. Before using this, you must [configure access to Google services from internal IPs](https://cloud.google.com/compute/docs/configure-private-google-access#configuring_access_to_google_services_from_internal_ips).
             */
            noAddress?: pulumi.Input<boolean>;
            /**
             * Whether to use preemptible VMs. Defaults to `false`. In order to use this, must be true for both create time and run time. Cannot be true at run time if false at create time.
             */
            preemptible?: pulumi.Input<boolean>;
            /**
             * List of Google Compute Engine availability zones to which resource creation will restricted. If empty, any zone may be chosen.
             */
            zones?: pulumi.Input<pulumi.Input<string>[]>;
        }
    }
}
export declare namespace gkehub {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gkehub.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
         */
        interface Authority {
            /**
             * Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length <2000 characters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
             */
            issuer?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gkehub.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * GkeCluster contains information specific to GKE clusters.
         */
        interface GkeCluster {
            /**
             * Immutable. Self-link of the GCP resource for the GKE cluster. For example: //container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster Zonal clusters are also supported.
             */
            resourceLink?: pulumi.Input<string>;
        }
        /**
         * MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.
         */
        interface MembershipEndpoint {
            /**
             * Optional. GKE-specific information. Only present if this Membership is a GKE cluster.
             */
            gkeCluster?: pulumi.Input<inputs.gkehub.v1.GkeCluster>;
        }
    }
    namespace v1alpha {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gkehub.v1alpha.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gkehub.v1alpha.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Spec for Audit Logging Allowlisting.
         */
        interface CloudAuditLoggingFeatureSpec {
            /**
             * Service account that should be allowlisted to send the audit logs; eg cloudauditlogging@gcp-project.iam.gserviceaccount.com. These accounts must already exist, but do not need to have any permissions granted to them. The customer's entitlements will be checked prior to allowlisting (i.e. the customer must be an Anthos customer.)
             */
            allowlistedServiceAccounts?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * CommonFeatureSpec contains Hub-wide configuration information
         */
        interface CommonFeatureSpec {
            /**
             * Cloud Audit Logging-specific spec.
             */
            cloudauditlogging?: pulumi.Input<inputs.gkehub.v1alpha.CloudAuditLoggingFeatureSpec>;
            /**
             * Multicluster Ingress-specific spec.
             */
            multiclusteringress?: pulumi.Input<inputs.gkehub.v1alpha.MultiClusterIngressFeatureSpec>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * FeatureSpec contains the input for the MultiClusterIngress feature.
         */
        interface MultiClusterIngressFeatureSpec {
            /**
             * Fully-qualified Membership name which hosts the MultiClusterIngress CRD. Example: `projects/foo-proj/locations/global/memberships/bar`
             */
            configMembership?: pulumi.Input<string>;
        }
    }
    namespace v1alpha2 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gkehub.v1alpha2.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
         */
        interface Authority {
            /**
             * Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length <2000 characters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer, unless `oidc_jwks` is set. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
             */
            issuer?: pulumi.Input<string>;
            /**
             * Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
             */
            oidcJwks?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gkehub.v1alpha2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * GkeCluster contains information specific to GKE clusters.
         */
        interface GkeCluster {
            /**
             * Immutable. Self-link of the GCP resource for the GKE cluster. For example: //container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster Zonal clusters are also supported.
             */
            resourceLink?: pulumi.Input<string>;
        }
        /**
         * KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After CreateMembership or UpdateMembership, these resources should be re-applied in the cluster.
         */
        interface KubernetesResource {
            /**
             * Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly. Callers should provide the CR that is currently present in the cluster during Create or Update, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.
             */
            membershipCrManifest?: pulumi.Input<string>;
            /**
             * Optional. Options for Kubernetes resource generation.
             */
            resourceOptions?: pulumi.Input<inputs.gkehub.v1alpha2.ResourceOptions>;
        }
        /**
         * MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.
         */
        interface MembershipEndpoint {
            /**
             * Optional. GKE-specific information. Only present if this Membership is a GKE cluster.
             */
            gkeCluster?: pulumi.Input<inputs.gkehub.v1alpha2.GkeCluster>;
            /**
             * Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources: * Ensure that the cluster is exclusively registered to one and only one Hub Membership. * Propagate Workload Pool Information available in the Membership Authority field. * Ensure proper initial configuration of default Hub Features.
             */
            kubernetesResource?: pulumi.Input<inputs.gkehub.v1alpha2.KubernetesResource>;
        }
        /**
         * ResourceOptions represent options for Kubernetes resource generation.
         */
        interface ResourceOptions {
            /**
             * Optional. The Connect agent version to use for connect_resources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.
             */
            connectVersion?: pulumi.Input<string>;
            /**
             * Optional. Use `apiextensions/v1beta1` instead of `apiextensions/v1` for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.
             */
            v1beta1Crd?: pulumi.Input<boolean>;
        }
    }
    namespace v1beta {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gkehub.v1beta.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gkehub.v1beta.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * CommonFeatureSpec contains Hub-wide configuration information
         */
        interface CommonFeatureSpec {
            /**
             * Multicluster Ingress-specific spec.
             */
            multiclusteringress?: pulumi.Input<inputs.gkehub.v1beta.MultiClusterIngressFeatureSpec>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * FeatureSpec contains the input for the MultiClusterIngress feature.
         */
        interface MultiClusterIngressFeatureSpec {
            /**
             * Fully-qualified Membership name which hosts the MultiClusterIngress CRD. Example: `projects/foo-proj/locations/global/memberships/bar`
             */
            configMembership?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.gkehub.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
         */
        interface Authority {
            /**
             * Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length <2000 characters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
             */
            issuer?: pulumi.Input<string>;
            /**
             * Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
             */
            oidcJwks?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.gkehub.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * GkeCluster contains information specific to GKE clusters.
         */
        interface GkeCluster {
            /**
             * Immutable. Self-link of the GCP resource for the GKE cluster. For example: //container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster Zonal clusters are also supported.
             */
            resourceLink?: pulumi.Input<string>;
        }
        /**
         * KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After CreateMembership or UpdateMembership, these resources should be re-applied in the cluster.
         */
        interface KubernetesResource {
            /**
             * Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly. Callers should provide the CR that is currently present in the cluster during CreateMembership or UpdateMembership, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.
             */
            membershipCrManifest?: pulumi.Input<string>;
            /**
             * Optional. Options for Kubernetes resource generation.
             */
            resourceOptions?: pulumi.Input<inputs.gkehub.v1beta1.ResourceOptions>;
        }
        /**
         * MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.
         */
        interface MembershipEndpoint {
            /**
             * Optional. GKE-specific information. Only present if this Membership is a GKE cluster.
             */
            gkeCluster?: pulumi.Input<inputs.gkehub.v1beta1.GkeCluster>;
            /**
             * Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources: * Ensure that the cluster is exclusively registered to one and only one Hub Membership. * Propagate Workload Pool Information available in the Membership Authority field. * Ensure proper initial configuration of default Hub Features.
             */
            kubernetesResource?: pulumi.Input<inputs.gkehub.v1beta1.KubernetesResource>;
        }
        /**
         * ResourceOptions represent options for Kubernetes resource generation.
         */
        interface ResourceOptions {
            /**
             * Optional. The Connect agent version to use for connect_resources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.
             */
            connectVersion?: pulumi.Input<string>;
            /**
             * Optional. Use `apiextensions/v1beta1` instead of `apiextensions/v1` for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.
             */
            v1beta1Crd?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace healthcare {
    namespace v1 {
        /**
         * An attribute value for a Consent or User data mapping. Each Attribute must have a corresponding AttributeDefinition in the consent store that defines the default and allowed values.
         */
        interface Attribute {
            /**
             * Indicates the name of an attribute defined in the consent store.
             */
            attributeDefinitionId?: pulumi.Input<string>;
            /**
             * Required. The value of the attribute. Must be an acceptable value as defined in the consent store. For example, if the consent store defines "data type" with acceptable values "questionnaire" and "step-count", when the attribute name is data type, this field must contain one of those values.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.healthcare.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A (sub) field of a type.
         */
        interface Field {
            /**
             * The maximum number of times this field can be repeated. 0 or -1 means unbounded.
             */
            maxOccurs?: pulumi.Input<number>;
            /**
             * The minimum number of times this field must be present/repeated.
             */
            minOccurs?: pulumi.Input<number>;
            /**
             * The name of the field. For example, "PID-1" or just "1".
             */
            name?: pulumi.Input<string>;
            /**
             * The HL7v2 table this field refers to. For example, PID-15 (Patient's Primary Language) usually refers to table "0296".
             */
            table?: pulumi.Input<string>;
            /**
             * The type of this field. A Type with this name must be defined in an Hl7TypesConfig.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a user's consent in terms of the resources that can be accessed and under what conditions.
         */
        interface GoogleCloudHealthcareV1ConsentPolicy {
            /**
             * Required. The request conditions to meet to grant access. In addition to any supported comparison operators, authorization rules may have `IN` operator as well as at most 10 logical operators that are limited to `AND` (`&&`), `OR` (`||`).
             */
            authorizationRule?: pulumi.Input<inputs.healthcare.v1.Expr>;
            /**
             * The resources that this policy applies to. A resource is a match if it matches all the attributes listed here. If empty, this policy applies to all User data mappings for the given user.
             */
            resourceAttributes?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.Attribute>[]>;
        }
        /**
         * The configuration for exporting to BigQuery.
         */
        interface GoogleCloudHealthcareV1FhirBigQueryDestination {
            /**
             * BigQuery URI to an existing dataset, up to 2000 characters long, in the format `bq://projectId.bqDatasetId`.
             */
            datasetUri?: pulumi.Input<string>;
            /**
             * If this flag is `TRUE`, all tables are deleted from the dataset before the new exported tables are written. If the flag is not set and the destination dataset contains tables, the export call returns an error. If `write_disposition` is specified, this parameter is ignored. force=false is equivalent to write_disposition=WRITE_EMPTY and force=true is equivalent to write_disposition=WRITE_TRUNCATE.
             */
            force?: pulumi.Input<boolean>;
            /**
             * The configuration for the exported BigQuery schema.
             */
            schemaConfig?: pulumi.Input<inputs.healthcare.v1.SchemaConfig>;
            /**
             * Determines whether existing tables in the destination dataset are overwritten or appended to. If a write_disposition is specified, the `force` parameter is ignored.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        /**
         * Root config message for HL7v2 schema. This contains a schema structure of groups and segments, and filters that determine which messages to apply the schema structure to.
         */
        interface Hl7SchemaConfig {
            /**
             * Map from each HL7v2 message type and trigger event pair, such as ADT_A04, to its schema configuration root group.
             */
            messageSchemaConfigs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Each VersionSource is tested and only if they all match is the schema used for the message.
             */
            version?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.VersionSource>[]>;
        }
        /**
         * Root config for HL7v2 datatype definitions for a specific HL7v2 version.
         */
        interface Hl7TypesConfig {
            /**
             * The HL7v2 type definitions.
             */
            type?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.Type>[]>;
            /**
             * The version selectors that this config applies to. A message must match ALL version sources to apply.
             */
            version?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.VersionSource>[]>;
        }
        /**
         * Specifies where and whether to send notifications upon changes to a data store.
         */
        interface Hl7V2NotificationConfig {
            /**
             * Restricts notifications sent for messages matching a filter. If this is empty, all messages are matched. The following syntax is available: * A string field value can be written as text inside quotation marks, for example `"query text"`. The only valid relational operation for text fields is equality (`=`), where text is searched within the field, rather than having the field be equal to the text. For example, `"Comment = great"` returns messages with `great` in the comment field. * A number field value can be written as an integer, a decimal, or an exponential. The valid relational operators for number fields are the equality operator (`=`), along with the less than/greater than operators (`<`, `<=`, `>`, `>=`). Note that there is no inequality (`!=`) operator. You can prepend the `NOT` operator to an expression to negate it. * A date field value must be written in `yyyy-mm-dd` form. Fields with date and time use the RFC3339 time format. Leading zeros are required for one-digit months and days. The valid relational operators for date fields are the equality operator (`=`) , along with the less than/greater than operators (`<`, `<=`, `>`, `>=`). Note that there is no inequality (`!=`) operator. You can prepend the `NOT` operator to an expression to negate it. * Multiple field query expressions can be combined in one query by adding `AND` or `OR` operators between the expressions. If a boolean operator appears within a quoted string, it is not treated as special, it's just another part of the character string to be matched. You can prepend the `NOT` operator to an expression to negate it. The following fields and functions are available for filtering: * `message_type`, from the MSH-9.1 field. For example, `NOT message_type = "ADT"`. * `send_date` or `sendDate`, the YYYY-MM-DD date the message was sent in the dataset's time_zone, from the MSH-7 segment. For example, `send_date < "2017-01-02"`. * `send_time`, the timestamp when the message was sent, using the RFC3339 time format for comparisons, from the MSH-7 segment. For example, `send_time < "2017-01-02T00:00:00-05:00"`. * `create_time`, the timestamp when the message was created in the HL7v2 store. Use the RFC3339 time format for comparisons. For example, `create_time < "2017-01-02T00:00:00-05:00"`. * `send_facility`, the care center that the message came from, from the MSH-4 segment. For example, `send_facility = "ABC"`. * `PatientId(value, type)`, which matches if the message lists a patient having an ID of the given value and type in the PID-2, PID-3, or PID-4 segments. For example, `PatientId("123456", "MRN")`. * `labels.x`, a string value of the label with key `x` as set using the Message.labels map. For example, `labels."priority"="high"`. The operator `:*` can be used to assert the existence of a label. For example, `labels."priority":*`.
             */
            filter?: pulumi.Input<string>;
            /**
             * The [Pub/Sub](https://cloud.google.com/pubsub/docs/) topic that notifications of changes are published on. Supplied by the client. The notification is a `PubsubMessage` with the following fields: * `PubsubMessage.Data` contains the resource name. * `PubsubMessage.MessageId` is the ID of this notification. It's guaranteed to be unique within the topic. * `PubsubMessage.PublishTime` is the time when the message was published. Note that notifications are only sent if the topic is non-empty. [Topic names](https://cloud.google.com/pubsub/docs/overview#names) must be scoped to a project. The Cloud Healthcare API service account, service-PROJECT_NUMBER@gcp-sa-healthcare.iam.gserviceaccount.com, must have publisher permissions on the given Pub/Sub topic. Not having adequate permissions causes the calls that send notifications to fail. If a notification cannot be published to Pub/Sub, errors are logged to Cloud Logging. For more information, see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)).
             */
            pubsubTopic?: pulumi.Input<string>;
        }
        /**
         * Raw bytes representing consent artifact content.
         */
        interface Image {
            /**
             * Input only. Points to a Cloud Storage URI containing the consent artifact content. The URI must be in the following format: `gs://{bucket_id}/{object_id}`. The Cloud Healthcare API service account must have the `roles/storage.objectViewer` Cloud IAM role for this Cloud Storage location. The consent artifact content at this URI is copied to a Cloud Storage location managed by the Cloud Healthcare API. Responses to fetching requests return the consent artifact content in raw_bytes.
             */
            gcsUri?: pulumi.Input<string>;
            /**
             * Consent artifact content represented as a stream of bytes. This field is populated when returned in GetConsentArtifact response, but not included in CreateConsentArtifact and ListConsentArtifact response.
             */
            rawBytes?: pulumi.Input<string>;
        }
        /**
         * Specifies where to send notifications upon changes to a data store.
         */
        interface NotificationConfig {
            /**
             * The [Pub/Sub](https://cloud.google.com/pubsub/docs/) topic that notifications of changes are published on. Supplied by the client. PubsubMessage.Data contains the resource name. PubsubMessage.MessageId is the ID of this message. It is guaranteed to be unique within the topic. PubsubMessage.PublishTime is the time at which the message was published. Notifications are only sent if the topic is non-empty. [Topic names](https://cloud.google.com/pubsub/docs/overview#names) must be scoped to a project. Cloud Healthcare API service account must have publisher permissions on the given Pub/Sub topic. Not having adequate permissions causes the calls that send notifications to fail. If a notification can't be published to Pub/Sub, errors are logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)). If the number of errors exceeds a certain rate, some aren't submitted. Note that not all operations trigger notifications, see [Configuring Pub/Sub notifications](https://cloud.google.com/healthcare/docs/how-tos/pubsub) for specific details.
             */
            pubsubTopic?: pulumi.Input<string>;
        }
        /**
         * The configuration for the parser. It determines how the server parses the messages.
         */
        interface ParserConfig {
            /**
             * Determines whether messages with no header are allowed.
             */
            allowNullHeader?: pulumi.Input<boolean>;
            /**
             * Schemas used to parse messages in this store, if schematized parsing is desired.
             */
            schema?: pulumi.Input<inputs.healthcare.v1.SchemaPackage>;
            /**
             * Byte(s) to use as the segment terminator. If this is unset, '\r' is used as segment terminator, matching the HL7 version 2 specification.
             */
            segmentTerminator?: pulumi.Input<string>;
        }
        /**
         * A patient identifier and associated type.
         */
        interface PatientId {
            /**
             * ID type. For example, MRN or NHS.
             */
            type?: pulumi.Input<string>;
            /**
             * The patient's unique identifier.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Configuration for the FHIR BigQuery schema. Determines how the server generates the schema.
         */
        interface SchemaConfig {
            /**
             * The depth for all recursive structures in the output analytics schema. For example, `concept` in the CodeSystem resource is a recursive structure; when the depth is 2, the CodeSystem table will have a column called `concept.concept` but not `concept.concept.concept`. If not specified or set to 0, the server will use the default value 2. The maximum depth allowed is 5.
             */
            recursiveStructureDepth?: pulumi.Input<string>;
            /**
             * Specifies the output schema type. Schema type is required.
             */
            schemaType?: pulumi.Input<string>;
        }
        /**
         * A schema package contains a set of schemas and type definitions.
         */
        interface SchemaPackage {
            /**
             * Flag to ignore all min_occurs restrictions in the schema. This means that incoming messages can omit any group, segment, field, component, or subcomponent.
             */
            ignoreMinOccurs?: pulumi.Input<boolean>;
            /**
             * Schema configs that are layered based on their VersionSources that match the incoming message. Schema configs present in higher indices override those in lower indices with the same message type and trigger event if their VersionSources all match an incoming message.
             */
            schemas?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.Hl7SchemaConfig>[]>;
            /**
             * Determines how messages that fail to parse are handled.
             */
            schematizedParsingType?: pulumi.Input<string>;
            /**
             * Schema type definitions that are layered based on their VersionSources that match the incoming message. Type definitions present in higher indices override those in lower indices with the same type name if their VersionSources all match an incoming message.
             */
            types?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.Hl7TypesConfig>[]>;
        }
        /**
         * The content of an HL7v2 message in a structured format as specified by a schema.
         */
        interface SchematizedData {
            /**
             * JSON output of the parser.
             */
            data?: pulumi.Input<string>;
            /**
             * The error output of the parser.
             */
            error?: pulumi.Input<string>;
        }
        /**
         * User signature.
         */
        interface Signature {
            /**
             * Optional. An image of the user's signature.
             */
            image?: pulumi.Input<inputs.healthcare.v1.Image>;
            /**
             * Optional. Metadata associated with the user's signature. For example, the user's name or the user's title.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Timestamp of the signature.
             */
            signatureTime?: pulumi.Input<string>;
            /**
             * Required. User's UUID provided by the client.
             */
            userId?: pulumi.Input<string>;
        }
        /**
         * Contains configuration for streaming FHIR export.
         */
        interface StreamConfig {
            /**
             * The destination BigQuery structure that contains both the dataset location and corresponding schema config. The output is organized in one table per resource type. The server reuses the existing tables (if any) that are named after the resource types. For example, "Patient", "Observation". When there is no existing table for a given resource type, the server attempts to create one. When a table schema doesn't align with the schema config, either because of existing incompatible schema or out of band incompatible modification, the server does not stream in new data. BigQuery imposes a 1 MB limit on streaming insert row size, therefore any resource mutation that generates more than 1 MB of BigQuery data is not streamed. One resolution in this case is to delete the incompatible table and let the server recreate one, though the newly created table only contains data after the table recreation. Results are appended to the corresponding BigQuery tables. Different versions of the same resource are distinguishable by the meta.versionId and meta.lastUpdated columns. The operation (CREATE/UPDATE/DELETE) that results in the new version is recorded in the meta.tag. The tables contain all historical resource versions since streaming was enabled. For query convenience, the server also creates one view per table of the same name containing only the current resource version. The streamed data in the BigQuery dataset is not guaranteed to be completely unique. The combination of the id and meta.versionId columns should ideally identify a single unique row. But in rare cases, duplicates may exist. At query time, users may use the SQL select statement to keep only one of the duplicate rows given an id and meta.versionId pair. Alternatively, the server created view mentioned above also filters out duplicates. If a resource mutation cannot be streamed to BigQuery, errors are logged to Cloud Logging. For more information, see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)).
             */
            bigqueryDestination?: pulumi.Input<inputs.healthcare.v1.GoogleCloudHealthcareV1FhirBigQueryDestination>;
            /**
             * Supply a FHIR resource type (such as "Patient" or "Observation"). See https://www.hl7.org/fhir/valueset-resource-types.html for a list of all FHIR resource types. The server treats an empty list as an intent to stream all the supported resource types in this FHIR store.
             */
            resourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A type definition for some HL7v2 type (incl. Segments and Datatypes).
         */
        interface Type {
            /**
             * The (sub) fields this type has (if not primitive).
             */
            fields?: pulumi.Input<pulumi.Input<inputs.healthcare.v1.Field>[]>;
            /**
             * The name of this type. This would be the segment or datatype name. For example, "PID" or "XPN".
             */
            name?: pulumi.Input<string>;
            /**
             * If this is a primitive type then this field is the type of the primitive For example, STRING. Leave unspecified for composite types.
             */
            primitive?: pulumi.Input<string>;
        }
        /**
         * Describes a selector for extracting and matching an MSH field to a value.
         */
        interface VersionSource {
            /**
             * The field to extract from the MSH segment. For example, "3.1" or "18[1].1".
             */
            mshField?: pulumi.Input<string>;
            /**
             * The value to match with the field. For example, "My Application Name" or "2.3".
             */
            value?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * AnnotationSource holds the source information of the annotation.
         */
        interface AnnotationSource {
            /**
             * Cloud Healthcare API resource.
             */
            cloudHealthcareSource?: pulumi.Input<inputs.healthcare.v1beta1.CloudHealthcareSource>;
        }
        /**
         * An attribute value for a Consent or User data mapping. Each Attribute must have a corresponding AttributeDefinition in the consent store that defines the default and allowed values.
         */
        interface Attribute {
            /**
             * Indicates the name of an attribute defined in the consent store.
             */
            attributeDefinitionId?: pulumi.Input<string>;
            /**
             * The value of the attribute. Must be an acceptable value as defined in the consent store. For example, if the consent store defines "data type" with acceptable values "questionnaire" and "step-count", when the attribute name is data type, this field must contain one of those values.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.healthcare.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * A bounding polygon for the detected image annotation.
         */
        interface BoundingPoly {
            /**
             * A description of this polygon.
             */
            label?: pulumi.Input<string>;
            /**
             * List of the vertices of this polygon.
             */
            vertices?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Vertex>[]>;
        }
        /**
         * Cloud Healthcare API resource.
         */
        interface CloudHealthcareSource {
            /**
             * Full path of a Cloud Healthcare API resource.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A (sub) field of a type.
         */
        interface Field {
            /**
             * The maximum number of times this field can be repeated. 0 or -1 means unbounded.
             */
            maxOccurs?: pulumi.Input<number>;
            /**
             * The minimum number of times this field must be present/repeated.
             */
            minOccurs?: pulumi.Input<number>;
            /**
             * The name of the field. For example, "PID-1" or just "1".
             */
            name?: pulumi.Input<string>;
            /**
             * The HL7v2 table this field refers to. For example, PID-15 (Patient's Primary Language) usually refers to table "0296".
             */
            table?: pulumi.Input<string>;
            /**
             * The type of this field. A Type with this name must be defined in an Hl7TypesConfig.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a user's consent in terms of the resources that can be accessed and under what conditions.
         */
        interface GoogleCloudHealthcareV1beta1ConsentPolicy {
            /**
             * Required. The request conditions to meet to grant access. In addition to any supported comparison operators, authorization rules may have `IN` operator as well as at most 10 logical operators that are limited to `AND` (`&&`), `OR` (`||`).
             */
            authorizationRule?: pulumi.Input<inputs.healthcare.v1beta1.Expr>;
            /**
             * The resources that this policy applies to. A resource is a match if it matches all the attributes listed here. If empty, this policy applies to all User data mappings for the given user.
             */
            resourceAttributes?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Attribute>[]>;
        }
        /**
         * The BigQuery table where the server writes output.
         */
        interface GoogleCloudHealthcareV1beta1DicomBigQueryDestination {
            /**
             * Use `write_disposition` instead. If `write_disposition` is specified, this parameter is ignored. force=false is equivalent to write_disposition=WRITE_EMPTY and force=true is equivalent to write_disposition=WRITE_TRUNCATE.
             */
            force?: pulumi.Input<boolean>;
            /**
             * BigQuery URI to a table, up to 2000 characters long, in the format `bq://projectId.bqDatasetId.tableId`
             */
            tableUri?: pulumi.Input<string>;
            /**
             * Determines whether the existing table in the destination is to be overwritten or appended to. If a write_disposition is specified, the `force` parameter is ignored.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        /**
         * StreamConfig specifies configuration for a streaming DICOM export.
         */
        interface GoogleCloudHealthcareV1beta1DicomStreamConfig {
            /**
             * Results are appended to this table. The server creates a new table in the given BigQuery dataset if the specified table does not exist. To enable the Cloud Healthcare API to write to your BigQuery table, you must give the Cloud Healthcare API service account the bigquery.dataEditor role. The service account is: `service-{PROJECT_NUMBER}@gcp-sa-healthcare.iam.gserviceaccount.com`. The PROJECT_NUMBER identifies the project that the DICOM store resides in. To get the project number, go to the Cloud Console Dashboard. It is recommended to not have a custom schema in the destination table which could conflict with the schema created by the Cloud Healthcare API. Instance deletions are not applied to the destination table. The destination's table schema will be automatically updated in case a new instance's data is incompatible with the current schema. The schema should not be updated manually as this can cause incompatibilies that cannot be resolved automatically. One resolution in this case is to delete the incompatible table and let the server recreate one, though the newly created table only contains data after the table recreation. BigQuery imposes a 1 MB limit on streaming insert row size, therefore any instance that generates more than 1 MB of BigQuery data will not be streamed. If an instance cannot be streamed to BigQuery, errors will be logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)).
             */
            bigqueryDestination?: pulumi.Input<inputs.healthcare.v1beta1.GoogleCloudHealthcareV1beta1DicomBigQueryDestination>;
        }
        /**
         * The configuration for exporting to BigQuery.
         */
        interface GoogleCloudHealthcareV1beta1FhirBigQueryDestination {
            /**
             * BigQuery URI to an existing dataset, up to 2000 characters long, in the format `bq://projectId.bqDatasetId`.
             */
            datasetUri?: pulumi.Input<string>;
            /**
             * Use `write_disposition` instead. If `write_disposition` is specified, this parameter is ignored. force=false is equivalent to write_disposition=WRITE_EMPTY and force=true is equivalent to write_disposition=WRITE_TRUNCATE.
             */
            force?: pulumi.Input<boolean>;
            /**
             * The configuration for the exported BigQuery schema.
             */
            schemaConfig?: pulumi.Input<inputs.healthcare.v1beta1.SchemaConfig>;
            /**
             * Determines whether existing tables in the destination dataset are overwritten or appended to. If a write_disposition is specified, the `force` parameter is ignored.
             */
            writeDisposition?: pulumi.Input<string>;
        }
        /**
         * Root config message for HL7v2 schema. This contains a schema structure of groups and segments, and filters that determine which messages to apply the schema structure to.
         */
        interface Hl7SchemaConfig {
            /**
             * Map from each HL7v2 message type and trigger event pair, such as ADT_A04, to its schema configuration root group.
             */
            messageSchemaConfigs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Each VersionSource is tested and only if they all match is the schema used for the message.
             */
            version?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.VersionSource>[]>;
        }
        /**
         * Root config for HL7v2 datatype definitions for a specific HL7v2 version.
         */
        interface Hl7TypesConfig {
            /**
             * The HL7v2 type definitions.
             */
            type?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Type>[]>;
            /**
             * The version selectors that this config applies to. A message must match ALL version sources to apply.
             */
            version?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.VersionSource>[]>;
        }
        /**
         * Specifies where and whether to send notifications upon changes to a data store.
         */
        interface Hl7V2NotificationConfig {
            /**
             * Restricts notifications sent for messages matching a filter. If this is empty, all messages are matched. The following syntax is available: * A string field value can be written as text inside quotation marks, for example `"query text"`. The only valid relational operation for text fields is equality (`=`), where text is searched within the field, rather than having the field be equal to the text. For example, `"Comment = great"` returns messages with `great` in the comment field. * A number field value can be written as an integer, a decimal, or an exponential. The valid relational operators for number fields are the equality operator (`=`), along with the less than/greater than operators (`<`, `<=`, `>`, `>=`). Note that there is no inequality (`!=`) operator. You can prepend the `NOT` operator to an expression to negate it. * A date field value must be written in `yyyy-mm-dd` form. Fields with date and time use the RFC3339 time format. Leading zeros are required for one-digit months and days. The valid relational operators for date fields are the equality operator (`=`) , along with the less than/greater than operators (`<`, `<=`, `>`, `>=`). Note that there is no inequality (`!=`) operator. You can prepend the `NOT` operator to an expression to negate it. * Multiple field query expressions can be combined in one query by adding `AND` or `OR` operators between the expressions. If a boolean operator appears within a quoted string, it is not treated as special, it's just another part of the character string to be matched. You can prepend the `NOT` operator to an expression to negate it. Fields/functions available for filtering are: * `message_type`, from the MSH-9.1 field. For example, `NOT message_type = "ADT"`. * `send_date` or `sendDate`, the YYYY-MM-DD date the message was sent in the dataset's time_zone, from the MSH-7 segment. For example, `send_date < "2017-01-02"`. * `send_time`, the timestamp when the message was sent, using the RFC3339 time format for comparisons, from the MSH-7 segment. For example, `send_time < "2017-01-02T00:00:00-05:00"`. * `create_time`, the timestamp when the message was created in the HL7v2 store. Use the RFC3339 time format for comparisons. For example, `create_time < "2017-01-02T00:00:00-05:00"`. * `send_facility`, the care center that the message came from, from the MSH-4 segment. For example, `send_facility = "ABC"`. * `PatientId(value, type)`, which matches if the message lists a patient having an ID of the given value and type in the PID-2, PID-3, or PID-4 segments. For example, `PatientId("123456", "MRN")`. * `labels.x`, a string value of the label with key `x` as set using the Message.labels map. For example, `labels."priority"="high"`. The operator `:*` can be used to assert the existence of a label. For example, `labels."priority":*`.
             */
            filter?: pulumi.Input<string>;
            /**
             * The [Pub/Sub](https://cloud.google.com/pubsub/docs/) topic that notifications of changes are published on. Supplied by the client. The notification is a `PubsubMessage` with the following fields: * `PubsubMessage.Data` contains the resource name. * `PubsubMessage.MessageId` is the ID of this notification. It is guaranteed to be unique within the topic. * `PubsubMessage.PublishTime` is the time when the message was published. Note that notifications are only sent if the topic is non-empty. [Topic names](https://cloud.google.com/pubsub/docs/overview#names) must be scoped to a project. Cloud Healthcare API service account must have publisher permissions on the given Pub/Sub topic. Not having adequate permissions causes the calls that send notifications to fail. If a notification can't be published to Pub/Sub, errors are logged to Cloud Logging. For more information, see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging).
             */
            pubsubTopic?: pulumi.Input<string>;
        }
        /**
         * Raw bytes representing consent artifact content.
         */
        interface Image {
            /**
             * Input only. Points to a Cloud Storage URI containing the consent artifact content. The URI must be in the following format: `gs://{bucket_id}/{object_id}`. The Cloud Healthcare API service account must have the `roles/storage.objectViewer` Cloud IAM role for this Cloud Storage location. The consent artifact content at this URI is copied to a Cloud Storage location managed by the Cloud Healthcare API. Responses to fetching requests return the consent artifact content in raw_bytes.
             */
            gcsUri?: pulumi.Input<string>;
            /**
             * Consent artifact content represented as a stream of bytes. This field is populated when returned in GetConsentArtifact response, but not included in CreateConsentArtifact and ListConsentArtifact response.
             */
            rawBytes?: pulumi.Input<string>;
        }
        /**
         * Image annotation.
         */
        interface ImageAnnotation {
            /**
             * The list of polygons outlining the sensitive regions in the image.
             */
            boundingPolys?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.BoundingPoly>[]>;
            /**
             * 0-based index of the image frame. For example, an image frame in a DICOM instance.
             */
            frameIndex?: pulumi.Input<number>;
        }
        /**
         * Specifies where to send notifications upon changes to a data store.
         */
        interface NotificationConfig {
            /**
             * The [Pub/Sub](https://cloud.google.com/pubsub/docs/) topic that notifications of changes are published on. Supplied by the client. PubsubMessage.Data contains the resource name. PubsubMessage.MessageId is the ID of this message. It is guaranteed to be unique within the topic. PubsubMessage.PublishTime is the time at which the message was published. Notifications are only sent if the topic is non-empty. [Topic names](https://cloud.google.com/pubsub/docs/overview#names) must be scoped to a project. Cloud Healthcare API service account must have publisher permissions on the given Pub/Sub topic. Not having adequate permissions causes the calls that send notifications to fail. If a notification can't be published to Pub/Sub, errors are logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)). If the number of errors exceeds a certain rate, some aren't submitted. Note that not all operations trigger notifications, see [Configuring Pub/Sub notifications](https://cloud.google.com/healthcare/docs/how-tos/pubsub) for specific details.
             */
            pubsubTopic?: pulumi.Input<string>;
        }
        /**
         * The configuration for the parser. It determines how the server parses the messages.
         */
        interface ParserConfig {
            /**
             * Determines whether messages with no header are allowed.
             */
            allowNullHeader?: pulumi.Input<boolean>;
            /**
             * Schemas used to parse messages in this store, if schematized parsing is desired.
             */
            schema?: pulumi.Input<inputs.healthcare.v1beta1.SchemaPackage>;
            /**
             * Byte(s) to use as the segment terminator. If this is unset, '\r' is used as segment terminator, matching the HL7 version 2 specification.
             */
            segmentTerminator?: pulumi.Input<string>;
            /**
             * Immutable. Determines the version of the unschematized parser to be used when `schema` is not given. This field is immutable after store creation.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * A patient identifier and associated type.
         */
        interface PatientId {
            /**
             * ID type. For example, MRN or NHS.
             */
            type?: pulumi.Input<string>;
            /**
             * The patient's unique identifier.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Resource level annotation.
         */
        interface ResourceAnnotation {
            /**
             * A description of the annotation record.
             */
            label?: pulumi.Input<string>;
        }
        /**
         * Configuration for the FHIR BigQuery schema. Determines how the server generates the schema.
         */
        interface SchemaConfig {
            /**
             * The depth for all recursive structures in the output analytics schema. For example, `concept` in the CodeSystem resource is a recursive structure; when the depth is 2, the CodeSystem table will have a column called `concept.concept` but not `concept.concept.concept`. If not specified or set to 0, the server will use the default value 2. The maximum depth allowed is 5.
             */
            recursiveStructureDepth?: pulumi.Input<string>;
            /**
             * Specifies the output schema type. Schema type is required.
             */
            schemaType?: pulumi.Input<string>;
        }
        /**
         * A schema package contains a set of schemas and type definitions.
         */
        interface SchemaPackage {
            /**
             * Flag to ignore all min_occurs restrictions in the schema. This means that incoming messages can omit any group, segment, field, component, or subcomponent.
             */
            ignoreMinOccurs?: pulumi.Input<boolean>;
            /**
             * Schema configs that are layered based on their VersionSources that match the incoming message. Schema configs present in higher indices override those in lower indices with the same message type and trigger event if their VersionSources all match an incoming message.
             */
            schemas?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Hl7SchemaConfig>[]>;
            /**
             * Determines how messages that fail to parse are handled.
             */
            schematizedParsingType?: pulumi.Input<string>;
            /**
             * Schema type definitions that are layered based on their VersionSources that match the incoming message. Type definitions present in higher indices override those in lower indices with the same type name if their VersionSources all match an incoming message.
             */
            types?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Hl7TypesConfig>[]>;
            /**
             * Determines how unexpected segments (segments not matched to the schema) are handled.
             */
            unexpectedSegmentHandling?: pulumi.Input<string>;
        }
        /**
         * The content of an HL7v2 message in a structured format as specified by a schema.
         */
        interface SchematizedData {
            /**
             * JSON output of the parser.
             */
            data?: pulumi.Input<string>;
            /**
             * The error output of the parser.
             */
            error?: pulumi.Input<string>;
        }
        /**
         * A TextAnnotation specifies a text range that includes sensitive information.
         */
        interface SensitiveTextAnnotation {
            /**
             * Maps from a resource slice. For example, FHIR resource field path to a set of sensitive text findings. For example, Appointment.Narrative text1 --> {findings_1, findings_2, findings_3}
             */
            details?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * User signature.
         */
        interface Signature {
            /**
             * Optional. An image of the user's signature.
             */
            image?: pulumi.Input<inputs.healthcare.v1beta1.Image>;
            /**
             * Optional. Metadata associated with the user's signature. For example, the user's name or the user's title.
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Timestamp of the signature.
             */
            signatureTime?: pulumi.Input<string>;
            /**
             * Required. User's UUID provided by the client.
             */
            userId?: pulumi.Input<string>;
        }
        /**
         * Contains configuration for streaming FHIR export.
         */
        interface StreamConfig {
            /**
             * The destination BigQuery structure that contains both the dataset location and corresponding schema config. The output is organized in one table per resource type. The server reuses the existing tables (if any) that are named after the resource types, e.g. "Patient", "Observation". When there is no existing table for a given resource type, the server attempts to create one. When a table schema doesn't align with the schema config, either because of existing incompatible schema or out of band incompatible modification, the server does not stream in new data. One resolution in this case is to delete the incompatible table and let the server recreate one, though the newly created table only contains data after the table recreation. BigQuery imposes a 1 MB limit on streaming insert row size, therefore any resource mutation that generates more than 1 MB of BigQuery data will not be streamed. Results are appended to the corresponding BigQuery tables. Different versions of the same resource are distinguishable by the meta.versionId and meta.lastUpdated columns. The operation (CREATE/UPDATE/DELETE) that results in the new version is recorded in the meta.tag. The tables contain all historical resource versions since streaming was enabled. For query convenience, the server also creates one view per table of the same name containing only the current resource version. The streamed data in the BigQuery dataset is not guaranteed to be completely unique. The combination of the id and meta.versionId columns should ideally identify a single unique row. But in rare cases, duplicates may exist. At query time, users may use the SQL select statement to keep only one of the duplicate rows given an id and meta.versionId pair. Alternatively, the server created view mentioned above also filters out duplicates. If a resource mutation cannot be streamed to BigQuery, errors will be logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)).
             */
            bigqueryDestination?: pulumi.Input<inputs.healthcare.v1beta1.GoogleCloudHealthcareV1beta1FhirBigQueryDestination>;
            /**
             * Supply a FHIR resource type (such as "Patient" or "Observation"). See https://www.hl7.org/fhir/valueset-resource-types.html for a list of all FHIR resource types. The server treats an empty list as an intent to stream all the supported resource types in this FHIR store.
             */
            resourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A type definition for some HL7v2 type (incl. Segments and Datatypes).
         */
        interface Type {
            /**
             * The (sub) fields this type has (if not primitive).
             */
            fields?: pulumi.Input<pulumi.Input<inputs.healthcare.v1beta1.Field>[]>;
            /**
             * The name of this type. This would be the segment or datatype name. For example, "PID" or "XPN".
             */
            name?: pulumi.Input<string>;
            /**
             * If this is a primitive type then this field is the type of the primitive For example, STRING. Leave unspecified for composite types.
             */
            primitive?: pulumi.Input<string>;
        }
        /**
         * Contains the configuration for FHIR profiles and validation.
         */
        interface ValidationConfig {
            /**
             * Whether to disable profile validation for this FHIR store. Set this to true to disable checking incoming resources for conformance against StructureDefinitions in this FHIR store.
             */
            disableProfileValidation?: pulumi.Input<boolean>;
            /**
             * A list of ImplementationGuide URLs in this FHIR store that are used to configure the profiles to use for validation. For example, to use the US Core profiles for validation, set `enabled_implementation_guides` to `["http://hl7.org/fhir/us/core/ImplementationGuide/ig"]`. If `enabled_implementation_guides` is empty or omitted, then incoming resources are only required to conform to the base FHIR profiles. Otherwise, a resource must conform to at least one profile listed in the `global` property of one of the enabled ImplementationGuides. The Cloud Healthcare API does not currently enforce all of the rules in a StructureDefinition. The following rules are supported: - min/max - minValue/maxValue - maxLength - type - fixed[x] - pattern[x] on simple types - slicing, when using "value" as the discriminator type When a URL cannot be resolved (for example, in a type assertion), the server does not return an error.
             */
            enabledImplementationGuides?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Describes a selector for extracting and matching an MSH field to a value.
         */
        interface VersionSource {
            /**
             * The field to extract from the MSH segment. For example, "3.1" or "18[1].1".
             */
            mshField?: pulumi.Input<string>;
            /**
             * The value to match with the field. For example, "My Application Name" or "2.3".
             */
            value?: pulumi.Input<string>;
        }
        /**
         * A 2D coordinate in an image. The origin is the top-left.
         */
        interface Vertex {
            /**
             * X coordinate.
             */
            x?: pulumi.Input<number>;
            /**
             * Y coordinate.
             */
            y?: pulumi.Input<number>;
        }
    }
}
export declare namespace iam {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.iam.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Represents an Amazon Web Services identity provider.
         */
        interface Aws {
            /**
             * Required. The AWS account ID.
             */
            accountId?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.iam.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Represents an OpenId Connect 1.0 identity provider.
         */
        interface Oidc {
            /**
             * Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
             */
            allowedAudiences?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The OIDC issuer URL.
             */
            issuerUri?: pulumi.Input<string>;
        }
    }
}
export declare namespace iap {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.iap.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.iap.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace jobs {
    namespace v3 {
        /**
         * Application related details of a job posting.
         */
        interface ApplicationInfo {
            /**
             * Optional but at least one of uris, emails or instruction must be specified. Use this field to specify email address(es) to which resumes or applications can be sent. The maximum number of allowed characters for each entry is 255.
             */
            emails?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional but at least one of uris, emails or instruction must be specified. Use this field to provide instructions, such as "Mail your application to ...", that a candidate can follow to apply for the job. This field accepts and sanitizes HTML input, and also accepts bold, italic, ordered list, and unordered list markup tags. The maximum number of allowed characters is 3,000.
             */
            instruction?: pulumi.Input<string>;
            /**
             * Optional but at least one of uris, emails or instruction must be specified. Use this URI field to direct an applicant to a website, for example to link to an online application form. The maximum number of allowed characters for each entry is 2,000.
             */
            uris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * An event issued when an end user interacts with the application that implements Cloud Talent Solution. Providing this information improves the quality of search and recommendation for the API clients, enabling the service to perform optimally. The number of events sent must be consistent with other calls, such as job searches, issued to the service by the client.
         */
        interface ClientEvent {
            /**
             * Required. The timestamp of the event.
             */
            createTime?: pulumi.Input<string>;
            /**
             * Required. A unique identifier, generated by the client application. This `event_id` is used to establish the relationship between different events (see parent_event_id).
             */
            eventId?: pulumi.Input<string>;
            /**
             * Optional. Extra information about this event. Used for storing information with no matching field in event payload, for example, user application specific context or details. At most 20 keys are supported. The maximum total size of all keys and values is 2 KB.
             */
            extraInfo?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * A event issued when a job seeker interacts with the application that implements Cloud Talent Solution.
             */
            jobEvent?: pulumi.Input<inputs.jobs.v3.JobEvent>;
            /**
             * Optional. The event_id of an event that resulted in the current event. For example, a Job view event usually follows a parent impression event: A job seeker first does a search where a list of jobs appears (impression). The job seeker then selects a result and views the description of a particular job (Job view).
             */
            parentEventId?: pulumi.Input<string>;
            /**
             * Required. A unique ID generated in the API responses. It can be found in ResponseMetadata.request_id.
             */
            requestId?: pulumi.Input<string>;
        }
        /**
         * Derived details about the company.
         */
        interface CompanyDerivedInfo {
            /**
             * A structured headquarters location of the company, resolved from Company.hq_location if provided.
             */
            headquartersLocation?: pulumi.Input<inputs.jobs.v3.Location>;
        }
        /**
         * A compensation entry that represents one component of compensation, such as base pay, bonus, or other compensation type. Annualization: One compensation entry can be annualized if - it contains valid amount or range. - and its expected_units_per_year is set or can be derived. Its annualized range is determined as (amount or range) times expected_units_per_year.
         */
        interface CompensationEntry {
            /**
             * Optional. Compensation amount.
             */
            amount?: pulumi.Input<inputs.jobs.v3.Money>;
            /**
             * Optional. Compensation description. For example, could indicate equity terms or provide additional context to an estimated bonus.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Expected number of units paid each year. If not specified, when Job.employment_types is FULLTIME, a default value is inferred based on unit. Default values: - HOURLY: 2080 - DAILY: 260 - WEEKLY: 52 - MONTHLY: 12 - ANNUAL: 1
             */
            expectedUnitsPerYear?: pulumi.Input<number>;
            /**
             * Optional. Compensation range.
             */
            range?: pulumi.Input<inputs.jobs.v3.CompensationRange>;
            /**
             * Optional. Compensation type. Default is CompensationUnit.COMPENSATION_TYPE_UNSPECIFIED.
             */
            type?: pulumi.Input<string>;
            /**
             * Optional. Frequency of the specified amount. Default is CompensationUnit.COMPENSATION_UNIT_UNSPECIFIED.
             */
            unit?: pulumi.Input<string>;
        }
        /**
         * Job compensation details.
         */
        interface CompensationInfo {
            /**
             * Annualized base compensation range. Computed as base compensation entry's CompensationEntry.compensation times CompensationEntry.expected_units_per_year. See CompensationEntry for explanation on compensation annualization.
             */
            annualizedBaseCompensationRange?: pulumi.Input<inputs.jobs.v3.CompensationRange>;
            /**
             * Annualized total compensation range. Computed as all compensation entries' CompensationEntry.compensation times CompensationEntry.expected_units_per_year. See CompensationEntry for explanation on compensation annualization.
             */
            annualizedTotalCompensationRange?: pulumi.Input<inputs.jobs.v3.CompensationRange>;
            /**
             * Optional. Job compensation information. At most one entry can be of type CompensationInfo.CompensationType.BASE, which is referred as ** base compensation entry ** for the job.
             */
            entries?: pulumi.Input<pulumi.Input<inputs.jobs.v3.CompensationEntry>[]>;
        }
        /**
         * Compensation range.
         */
        interface CompensationRange {
            /**
             * Optional. The maximum amount of compensation. If left empty, the value is set to a maximal compensation value and the currency code is set to match the currency code of min_compensation.
             */
            maxCompensation?: pulumi.Input<inputs.jobs.v3.Money>;
            /**
             * Optional. The minimum amount of compensation. If left empty, the value is set to zero and the currency code is set to match the currency code of max_compensation.
             */
            minCompensation?: pulumi.Input<inputs.jobs.v3.Money>;
        }
        /**
         * Output only. Derived details about the job posting.
         */
        interface JobDerivedInfo {
            /**
             * Job categories derived from Job.title and Job.description.
             */
            jobCategories?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Structured locations of the job, resolved from Job.addresses. locations are exactly matched to Job.addresses in the same order.
             */
            locations?: pulumi.Input<pulumi.Input<inputs.jobs.v3.Location>[]>;
        }
        /**
         * An event issued when a job seeker interacts with the application that implements Cloud Talent Solution.
         */
        interface JobEvent {
            /**
             * Required. The job name(s) associated with this event. For example, if this is an impression event, this field contains the identifiers of all jobs shown to the job seeker. If this was a view event, this field contains the identifier of the viewed job.
             */
            jobs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The type of the event (see JobEventType).
             */
            type?: pulumi.Input<string>;
        }
        /**
         * An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this must conform to the WGS84 standard. Values must be within normalized ranges.
         */
        interface LatLng {
            /**
             * The latitude in degrees. It must be in the range [-90.0, +90.0].
             */
            latitude?: pulumi.Input<number>;
            /**
             * The longitude in degrees. It must be in the range [-180.0, +180.0].
             */
            longitude?: pulumi.Input<number>;
        }
        /**
         * Output only. A resource that represents a location with full geographic information.
         */
        interface Location {
            /**
             * An object representing a latitude/longitude pair.
             */
            latLng?: pulumi.Input<inputs.jobs.v3.LatLng>;
            /**
             * The type of a location, which corresponds to the address lines field of PostalAddress. For example, "Downtown, Atlanta, GA, USA" has a type of LocationType#NEIGHBORHOOD, and "Kansas City, KS, USA" has a type of LocationType#LOCALITY.
             */
            locationType?: pulumi.Input<string>;
            /**
             * Postal address of the location that includes human readable information, such as postal delivery and payments addresses. Given a postal address, a postal service can deliver items to a premises, P.O. Box, or other delivery location.
             */
            postalAddress?: pulumi.Input<inputs.jobs.v3.PostalAddress>;
            /**
             * Radius in miles of the job location. This value is derived from the location bounding box in which a circle with the specified radius centered from LatLng covers the area associated with the job location. For example, currently, "Mountain View, CA, USA" has a radius of 6.17 miles.
             */
            radiusInMiles?: pulumi.Input<number>;
        }
        /**
         * Represents an amount of money with its currency type.
         */
        interface Money {
            /**
             * The three-letter currency code defined in ISO 4217.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
             */
            nanos?: pulumi.Input<number>;
            /**
             * The whole units of the amount. For example if `currencyCode` is `"USD"`, then 1 unit is one US dollar.
             */
            units?: pulumi.Input<string>;
        }
        /**
         * Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478
         */
        interface PostalAddress {
            /**
             * Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. "Austin, TX"), it is important that the line order is clear. The order of address lines should be "envelope order" for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. "ja" for large-to-small ordering and "ja-Latn" or "en" for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
             */
            addressLines?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. "Barcelona" and not "Catalonia"). Many countries don't use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
             */
            administrativeArea?: pulumi.Input<string>;
            /**
             * Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address' country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: "zh-Hant", "ja", "ja-Latn", "en".
             */
            languageCode?: pulumi.Input<string>;
            /**
             * Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
             */
            locality?: pulumi.Input<string>;
            /**
             * Optional. The name of the organization at the address.
             */
            organization?: pulumi.Input<string>;
            /**
             * Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
             */
            postalCode?: pulumi.Input<string>;
            /**
             * Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain "care of" information.
             */
            recipients?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: "CH" for Switzerland.
             */
            regionCode?: pulumi.Input<string>;
            /**
             * The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
             */
            revision?: pulumi.Input<number>;
            /**
             * Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like "CEDEX", optionally followed by a number (e.g. "CEDEX 7"), or just a number alone, representing the "sector code" (Jamaica), "delivery area indicator" (Malawi) or "post office indicator" (e.g. Côte d'Ivoire).
             */
            sortingCode?: pulumi.Input<string>;
            /**
             * Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
             */
            sublocality?: pulumi.Input<string>;
        }
        /**
         * Input only. Options for job processing.
         */
        interface ProcessingOptions {
            /**
             * Optional. If set to `true`, the service does not attempt to resolve a more precise address for the job.
             */
            disableStreetAddressResolution?: pulumi.Input<boolean>;
            /**
             * Optional. Option for job HTML content sanitization. Applied fields are: * description * applicationInfo.instruction * incentives * qualifications * responsibilities HTML tags in these fields may be stripped if sanitiazation is not disabled. Defaults to HtmlSanitization.SIMPLE_FORMATTING_ONLY.
             */
            htmlSanitization?: pulumi.Input<string>;
        }
    }
    namespace v4 {
        /**
         * Application related details of a job posting.
         */
        interface ApplicationInfo {
            /**
             * Use this field to specify email address(es) to which resumes or applications can be sent. The maximum number of allowed characters for each entry is 255.
             */
            emails?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Use this field to provide instructions, such as "Mail your application to ...", that a candidate can follow to apply for the job. This field accepts and sanitizes HTML input, and also accepts bold, italic, ordered list, and unordered list markup tags. The maximum number of allowed characters is 3,000.
             */
            instruction?: pulumi.Input<string>;
            /**
             * Use this URI field to direct an applicant to a website, for example to link to an online application form. The maximum number of allowed characters for each entry is 2,000.
             */
            uris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A compensation entry that represents one component of compensation, such as base pay, bonus, or other compensation type. Annualization: One compensation entry can be annualized if - it contains valid amount or range. - and its expected_units_per_year is set or can be derived. Its annualized range is determined as (amount or range) times expected_units_per_year.
         */
        interface CompensationEntry {
            /**
             * Compensation amount.
             */
            amount?: pulumi.Input<inputs.jobs.v4.Money>;
            /**
             * Compensation description. For example, could indicate equity terms or provide additional context to an estimated bonus.
             */
            description?: pulumi.Input<string>;
            /**
             * Expected number of units paid each year. If not specified, when Job.employment_types is FULLTIME, a default value is inferred based on unit. Default values: - HOURLY: 2080 - DAILY: 260 - WEEKLY: 52 - MONTHLY: 12 - ANNUAL: 1
             */
            expectedUnitsPerYear?: pulumi.Input<number>;
            /**
             * Compensation range.
             */
            range?: pulumi.Input<inputs.jobs.v4.CompensationRange>;
            /**
             * Compensation type. Default is CompensationType.COMPENSATION_TYPE_UNSPECIFIED.
             */
            type?: pulumi.Input<string>;
            /**
             * Frequency of the specified amount. Default is CompensationUnit.COMPENSATION_UNIT_UNSPECIFIED.
             */
            unit?: pulumi.Input<string>;
        }
        /**
         * Job compensation details.
         */
        interface CompensationInfo {
            /**
             * Job compensation information. At most one entry can be of type CompensationInfo.CompensationType.BASE, which is referred as **base compensation entry** for the job.
             */
            entries?: pulumi.Input<pulumi.Input<inputs.jobs.v4.CompensationEntry>[]>;
        }
        /**
         * Compensation range.
         */
        interface CompensationRange {
            /**
             * The maximum amount of compensation. If left empty, the value is set to a maximal compensation value and the currency code is set to match the currency code of min_compensation.
             */
            maxCompensation?: pulumi.Input<inputs.jobs.v4.Money>;
            /**
             * The minimum amount of compensation. If left empty, the value is set to zero and the currency code is set to match the currency code of max_compensation.
             */
            minCompensation?: pulumi.Input<inputs.jobs.v4.Money>;
        }
        /**
         * An event issued when a job seeker interacts with the application that implements Cloud Talent Solution.
         */
        interface JobEvent {
            /**
             * Required. The job name(s) associated with this event. For example, if this is an impression event, this field contains the identifiers of all jobs shown to the job seeker. If this was a view event, this field contains the identifier of the viewed job. The format is "projects/{project_id}/tenants/{tenant_id}/jobs/{job_id}", for example, "projects/foo/tenants/bar/jobs/baz".
             */
            jobs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The type of the event (see JobEventType).
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents an amount of money with its currency type.
         */
        interface Money {
            /**
             * The three-letter currency code defined in ISO 4217.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
             */
            nanos?: pulumi.Input<number>;
            /**
             * The whole units of the amount. For example if `currencyCode` is `"USD"`, then 1 unit is one US dollar.
             */
            units?: pulumi.Input<string>;
        }
        /**
         * Options for job processing.
         */
        interface ProcessingOptions {
            /**
             * If set to `true`, the service does not attempt to resolve a more precise address for the job.
             */
            disableStreetAddressResolution?: pulumi.Input<boolean>;
            /**
             * Option for job HTML content sanitization. Applied fields are: * description * applicationInfo.instruction * incentives * qualifications * responsibilities HTML tags in these fields may be stripped if sanitiazation isn't disabled. Defaults to HtmlSanitization.SIMPLE_FORMATTING_ONLY.
             */
            htmlSanitization?: pulumi.Input<string>;
        }
    }
}
export declare namespace logging {
    namespace v2 {
        /**
         * Options that change functionality of a sink exporting data to BigQuery.
         */
        interface BigQueryOptions {
            /**
             * Optional. Whether to use BigQuery's partition tables (https://cloud.google.com/bigquery/docs/partitioned-tables). By default, Logging creates dated tables based on the log entries' timestamps, e.g. syslog_20170523. With partitioned tables the date suffix is no longer present and special query syntax (https://cloud.google.com/bigquery/docs/querying-partitioned-tables) has to be used instead. In both cases, tables are sharded based on UTC timezone.
             */
            usePartitionedTables?: pulumi.Input<boolean>;
        }
        /**
         * BucketOptions describes the bucket boundaries used to create a histogram for the distribution. The buckets can be in a linear sequence, an exponential sequence, or each bucket can be specified explicitly. BucketOptions does not include the number of values in each bucket.A bucket has an inclusive lower bound and exclusive upper bound for the values that are counted for that bucket. The upper bound of a bucket must be strictly greater than the lower bound. The sequence of N buckets for a distribution consists of an underflow bucket (number 0), zero or more finite buckets (number 1 through N - 2) and an overflow bucket (number N - 1). The buckets are contiguous: the lower bound of bucket i (i > 0) is the same as the upper bound of bucket i - 1. The buckets span the whole range of finite values: lower bound of the underflow bucket is -infinity and the upper bound of the overflow bucket is +infinity. The finite buckets are so-called because both bounds are finite.
         */
        interface BucketOptions {
            /**
             * The explicit buckets.
             */
            explicitBuckets?: pulumi.Input<inputs.logging.v2.Explicit>;
            /**
             * The exponential buckets.
             */
            exponentialBuckets?: pulumi.Input<inputs.logging.v2.Exponential>;
            /**
             * The linear bucket.
             */
            linearBuckets?: pulumi.Input<inputs.logging.v2.Linear>;
        }
        /**
         * Specifies a set of buckets with arbitrary widths.There are size(bounds) + 1 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): boundsi Lower bound (1 <= i < N); boundsi - 1The bounds field must contain at least one element. If bounds has only one element, then there are no finite buckets, and that single element is the common boundary of the overflow and underflow buckets.
         */
        interface Explicit {
            /**
             * The values must be monotonically increasing.
             */
            bounds?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * Specifies an exponential sequence of buckets that have a width that is proportional to the value of the lower bound. Each bucket represents a constant relative uncertainty on a specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): scale * (growth_factor ^ i). Lower bound (1 <= i < N): scale * (growth_factor ^ (i - 1)).
         */
        interface Exponential {
            /**
             * Must be greater than 1.
             */
            growthFactor?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            numFiniteBuckets?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            scale?: pulumi.Input<number>;
        }
        /**
         * A description of a label.
         */
        interface LabelDescriptor {
            /**
             * A human-readable description for the label.
             */
            description?: pulumi.Input<string>;
            /**
             * The label key.
             */
            key?: pulumi.Input<string>;
            /**
             * The type of data that can be assigned to the label.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * Specifies a linear sequence of buckets that all have the same width (except overflow and underflow). Each bucket represents a constant absolute uncertainty on the specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): offset + (width * i). Lower bound (1 <= i < N): offset + (width * (i - 1)).
         */
        interface Linear {
            /**
             * Must be greater than 0.
             */
            numFiniteBuckets?: pulumi.Input<number>;
            /**
             * Lower bound of the first bucket.
             */
            offset?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * Specifies a set of log entries that are not to be stored in Logging. If your GCP resource receives a large volume of logs, you can use exclusions to reduce your chargeable logs. Exclusions are processed after log sinks, so you can export log entries before they are excluded. Note that organization-level and folder-level exclusions don't apply to child resources, and that you can't exclude audit log entries.
         */
        interface LogExclusion {
            /**
             * Optional. A description of this exclusion.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. If set to True, then this exclusion is disabled and it does not exclude any log entries. You can update an exclusion to change the value of this field.
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * Required. An advanced logs filter (https://cloud.google.com/logging/docs/view/advanced-queries) that matches the log entries to be excluded. By using the sample function (https://cloud.google.com/logging/docs/view/advanced-queries#sample), you can exclude less than 100% of the matching log entries. For example, the following query matches 99% of low-severity log entries from Google Cloud Storage buckets:"resource.type=gcs_bucket severity<ERROR sample(insertId, 0.99)"
             */
            filter?: pulumi.Input<string>;
            /**
             * Required. A client-assigned identifier, such as "load-balancer-exclusion". Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Defines a metric type and its schema. Once a metric descriptor is created, deleting or altering it stops data collection and makes the metric type's existing data unusable.
         */
        interface MetricDescriptor {
            /**
             * A detailed description of the metric, which can be used in documentation.
             */
            description?: pulumi.Input<string>;
            /**
             * A concise name for the metric, which can be displayed in user interfaces. Use sentence case without an ending period, for example "Request count". This field is optional but it is recommended to be set for any metrics associated with user-visible concepts, such as Quota.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The set of labels that can be used to describe a specific instance of this metric type. For example, the appengine.googleapis.com/http/server/response_latencies metric type has a label for the HTTP response code, response_code, so you can look at latencies for successful responses or just for responses that failed.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.logging.v2.LabelDescriptor>[]>;
            /**
             * Optional. The launch stage of the metric definition.
             */
            launchStage?: pulumi.Input<string>;
            /**
             * Optional. Metadata which can be used to guide usage of the metric.
             */
            metadata?: pulumi.Input<inputs.logging.v2.MetricDescriptorMetadata>;
            /**
             * Whether the metric records instantaneous values, changes to a value, etc. Some combinations of metric_kind and value_type might not be supported.
             */
            metricKind?: pulumi.Input<string>;
            /**
             * Read-only. If present, then a time series, which is identified partially by a metric type and a MonitoredResourceDescriptor, that is associated with this metric type can only be associated with one of the monitored resource types listed here.
             */
            monitoredResourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The resource name of the metric descriptor.
             */
            name?: pulumi.Input<string>;
            /**
             * The metric type, including its DNS name prefix. The type is not URL-encoded. All user-defined metric types have the DNS name custom.googleapis.com or external.googleapis.com. Metric types should use a natural hierarchical grouping. For example: "custom.googleapis.com/invoice/paid/amount" "external.googleapis.com/prometheus/up" "appengine.googleapis.com/http/server/response_latencies"
             */
            type?: pulumi.Input<string>;
            /**
             * The units in which the metric value is reported. It is only applicable if the value_type is INT64, DOUBLE, or DISTRIBUTION. The unit defines the representation of the stored metric values.Different systems might scale the values to be more easily displayed (so a value of 0.02kBy might be displayed as 20By, and a value of 3523kBy might be displayed as 3.5MBy). However, if the unit is kBy, then the value of the metric is always in thousands of bytes, no matter how it might be displayed.If you want a custom metric to record the exact number of CPU-seconds used by a job, you can create an INT64 CUMULATIVE metric whose unit is s{CPU} (or equivalently 1s{CPU} or just s). If the job uses 12,005 CPU-seconds, then the value is written as 12005.Alternatively, if you want a custom metric to record data in a more granular way, you can create a DOUBLE CUMULATIVE metric whose unit is ks{CPU}, and then write the value 12.005 (which is 12005/1000), or use Kis{CPU} and write 11.723 (which is 12005/1024).The supported units are a subset of The Unified Code for Units of Measure (https://unitsofmeasure.org/ucum.html) standard:Basic units (UNIT) bit bit By byte s second min minute h hour d day 1 dimensionlessPrefixes (PREFIX) k kilo (10^3) M mega (10^6) G giga (10^9) T tera (10^12) P peta (10^15) E exa (10^18) Z zetta (10^21) Y yotta (10^24) m milli (10^-3) u micro (10^-6) n nano (10^-9) p pico (10^-12) f femto (10^-15) a atto (10^-18) z zepto (10^-21) y yocto (10^-24) Ki kibi (2^10) Mi mebi (2^20) Gi gibi (2^30) Ti tebi (2^40) Pi pebi (2^50)GrammarThe grammar also includes these connectors: / division or ratio (as an infix operator). For examples, kBy/{email} or MiBy/10ms (although you should almost never have /s in a metric unit; rates should always be computed at query time from the underlying cumulative or delta value). . multiplication or composition (as an infix operator). For examples, GBy.d or k{watt}.h.The grammar for a unit is as follows: Expression = Component { "." Component } { "/" Component } ; Component = ( [ PREFIX ] UNIT | "%" ) [ Annotation ] | Annotation | "1" ; Annotation = "{" NAME "}" ; Notes: Annotation is just a comment if it follows a UNIT. If the annotation is used alone, then the unit is equivalent to 1. For examples, {request}/s == 1/s, By{transmitted}/s == By/s. NAME is a sequence of non-blank printable ASCII characters not containing { or }. 1 represents a unitary dimensionless unit (https://en.wikipedia.org/wiki/Dimensionless_quantity) of 1, such as in 1/s. It is typically used when none of the basic units are appropriate. For example, "new users per day" can be represented as 1/d or {new-users}/d (and a metric value 5 would mean "5 new users). Alternatively, "thousands of page views per day" would be represented as 1000/d or k1/d or k{page_views}/d (and a metric value of 5.3 would mean "5300 page views per day"). % represents dimensionless value of 1/100, and annotates values giving a percentage (so the metric values are typically in the range of 0..100, and a metric value 3 means "3 percent"). 10^2.% indicates a metric contains a ratio, typically in the range 0..1, that will be multiplied by 100 and displayed as a percentage (so a metric value 0.03 means "3 percent").
             */
            unit?: pulumi.Input<string>;
            /**
             * Whether the measurement is an integer, a floating-point number, etc. Some combinations of metric_kind and value_type might not be supported.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * Additional annotations that can be used to guide the usage of a metric.
         */
        interface MetricDescriptorMetadata {
            /**
             * The delay of data points caused by ingestion. Data points older than this age are guaranteed to be ingested and available to be read, excluding data loss due to errors.
             */
            ingestDelay?: pulumi.Input<string>;
            /**
             * The sampling period of metric data points. For metrics which are written periodically, consecutive data points are stored at this time interval, excluding data loss due to errors. Metrics with a higher granularity have a smaller sampling period.
             */
            samplePeriod?: pulumi.Input<string>;
        }
    }
}
export declare namespace managedidentities {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.managedidentities.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1alpha1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.managedidentities.v1alpha1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Represents a relationship between two domains which makes it possible for users in one domain to be authenticated by a dc in another domain. Refer https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731335(v%3dws.10) If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state.
         */
        interface Trust {
            /**
             * The time the instance was created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * The last heartbeat time when the trust was known to be connected.
             */
            lastKnownTrustConnectedHeartbeatTime?: pulumi.Input<string>;
            /**
             * The trust authentication type which decides whether the trusted side has forest/domain wide access or selective access to approved set of resources.
             */
            selectiveAuthentication?: pulumi.Input<boolean>;
            /**
             * The current state of this trust.
             */
            state?: pulumi.Input<string>;
            /**
             * Additional information about the current state of this trust, if available.
             */
            stateDescription?: pulumi.Input<string>;
            /**
             * The target dns server ip addresses which can resolve the remote domain involved in trust.
             */
            targetDnsIpAddresses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The fully qualified target domain name which will be in trust with current domain.
             */
            targetDomainName?: pulumi.Input<string>;
            /**
             * The trust direction decides the current domain is trusted, trusting or both.
             */
            trustDirection?: pulumi.Input<string>;
            /**
             * Input only, and will not be stored. The trust secret used for handshake with target domain.
             */
            trustHandshakeSecret?: pulumi.Input<string>;
            /**
             * The type of trust represented by the trust resource.
             */
            trustType?: pulumi.Input<string>;
            /**
             * Last update time.
             */
            updateTime?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.managedidentities.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace memcache {
    namespace v1 {
        interface InstanceMessage {
            /**
             * A code that correspond to one type of user-facing message.
             */
            code?: pulumi.Input<string>;
            /**
             * Message on memcached instance which will be exposed to users.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * The unique ID associated with this set of parameters. Users can use this id to determine if the parameters associated with the instance differ from the parameters associated with the nodes. A discrepancy between parameter ids can inform users that they may need to take action to apply parameters on nodes.
         */
        interface MemcacheParameters {
            /**
             * User defined set of parameters to use in the memcached process.
             */
            params?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Configuration for a Memcached Node.
         */
        interface NodeConfig {
            /**
             * Required. Number of cpus per Memcached node.
             */
            cpuCount?: pulumi.Input<number>;
            /**
             * Required. Memory size in MiB for each Memcached node.
             */
            memorySizeMb?: pulumi.Input<number>;
        }
    }
    namespace v1beta2 {
        interface InstanceMessage {
            /**
             * A code that correspond to one type of user-facing message.
             */
            code?: pulumi.Input<string>;
            /**
             * Message on memcached instance which will be exposed to users.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * The unique ID associated with this set of parameters. Users can use this id to determine if the parameters associated with the instance differ from the parameters associated with the nodes. A discrepancy between parameter ids can inform users that they may need to take action to apply parameters on nodes.
         */
        interface MemcacheParameters {
            /**
             * User defined set of parameters to use in the memcached process.
             */
            params?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Configuration for a Memcached Node.
         */
        interface NodeConfig {
            /**
             * Required. Number of cpus per Memcached node.
             */
            cpuCount?: pulumi.Input<number>;
            /**
             * Required. Memory size in MiB for each Memcached node.
             */
            memorySizeMb?: pulumi.Input<number>;
        }
    }
}
export declare namespace metastore {
    namespace v1alpha {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.metastore.v1alpha.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates members with a role.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding.If the condition evaluates to true, then this binding applies to the current request.If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.metastore.v1alpha.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. group:{emailid}: An email address that represents a Google group. For example, admins@example.com. deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Specifies how metastore metadata should be integrated with the Data Catalog service.
         */
        interface DataCatalogConfig {
            /**
             * Defines whether the metastore metadata should be synced to Data Catalog. The default value is to disable syncing metastore metadata to Data Catalog.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * A specification of the location of and metadata about a database dump from a relational database management system.
         */
        interface DatabaseDump {
            /**
             * The type of the database.
             */
            databaseType?: pulumi.Input<string>;
            /**
             * A Cloud Storage object or folder URI that specifies the source from which to import metadata. It must begin with gs://.
             */
            gcsUri?: pulumi.Input<string>;
            /**
             * The name of the source database.
             */
            sourceDatabase?: pulumi.Input<string>;
            /**
             * Optional. The type of the database dump. If unspecified, defaults to MYSQL.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Specifies configuration information specific to running Hive metastore software as the metastore service.
         */
        interface HiveMetastoreConfig {
            /**
             * A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml). The mappings override system defaults (some keys cannot be overridden).
             */
            configOverrides?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Information used to configure the Hive metastore service as a service principal in a Kerberos realm. To disable Kerberos, use the UpdateService method and specify this field's path (hive_metastore_config.kerberos_config) in the request's update_mask while omitting this field from the request's service.
             */
            kerberosConfig?: pulumi.Input<inputs.metastore.v1alpha.KerberosConfig>;
            /**
             * Immutable. The Hive metastore schema version.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Configuration information for a Kerberos principal.
         */
        interface KerberosConfig {
            /**
             * A Kerberos keytab file that can be used to authenticate a service principal with a Kerberos Key Distribution Center (KDC).
             */
            keytab?: pulumi.Input<inputs.metastore.v1alpha.Secret>;
            /**
             * A Cloud Storage URI that specifies the path to a krb5.conf file. It is of the form gs://{bucket_name}/path/to/krb5.conf, although the file does not need to be named krb5.conf explicitly.
             */
            krb5ConfigGcsUri?: pulumi.Input<string>;
            /**
             * A Kerberos principal that exists in the both the keytab the KDC to authenticate as. A typical principal is of the form primary/instance@REALM, but there is no exact format.
             */
            principal?: pulumi.Input<string>;
        }
        /**
         * Maintenance window. This specifies when Dataproc Metastore may perform system maintenance operation to the service.
         */
        interface MaintenanceWindow {
            /**
             * The day of week, when the window starts.
             */
            dayOfWeek?: pulumi.Input<string>;
            /**
             * The hour of day (0-23) when the window starts.
             */
            hourOfDay?: pulumi.Input<number>;
        }
        /**
         * Specifies how metastore metadata should be integrated with external services.
         */
        interface MetadataIntegration {
            /**
             * The integration config for the Data Catalog service.
             */
            dataCatalogConfig?: pulumi.Input<inputs.metastore.v1alpha.DataCatalogConfig>;
        }
        /**
         * A securely stored value.
         */
        interface Secret {
            /**
             * The relative resource name of a Secret Manager secret version, in the following form:projects/{project_number}/secrets/{secret_id}/versions/{version_id}.
             */
            cloudSecret?: pulumi.Input<string>;
        }
    }
    namespace v1beta {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted.Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.metastore.v1beta.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates members with a role.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding.If the condition evaluates to true, then this binding applies to the current request.If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding.To learn which resources support conditions in their IAM policies, see the IAM documentation (https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.metastore.v1beta.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. group:{emailid}: An email address that represents a Google group. For example, admins@example.com. deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Specifies how metastore metadata should be integrated with the Data Catalog service.
         */
        interface DataCatalogConfig {
            /**
             * Defines whether the metastore metadata should be synced to Data Catalog. The default value is to disable syncing metastore metadata to Data Catalog.
             */
            enabled?: pulumi.Input<boolean>;
        }
        /**
         * A specification of the location of and metadata about a database dump from a relational database management system.
         */
        interface DatabaseDump {
            /**
             * The type of the database.
             */
            databaseType?: pulumi.Input<string>;
            /**
             * A Cloud Storage object or folder URI that specifies the source from which to import metadata. It must begin with gs://.
             */
            gcsUri?: pulumi.Input<string>;
            /**
             * The name of the source database.
             */
            sourceDatabase?: pulumi.Input<string>;
            /**
             * Optional. The type of the database dump. If unspecified, defaults to MYSQL.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec.Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Specifies configuration information specific to running Hive metastore software as the metastore service.
         */
        interface HiveMetastoreConfig {
            /**
             * A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml). The mappings override system defaults (some keys cannot be overridden).
             */
            configOverrides?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Information used to configure the Hive metastore service as a service principal in a Kerberos realm. To disable Kerberos, use the UpdateService method and specify this field's path (hive_metastore_config.kerberos_config) in the request's update_mask while omitting this field from the request's service.
             */
            kerberosConfig?: pulumi.Input<inputs.metastore.v1beta.KerberosConfig>;
            /**
             * Immutable. The Hive metastore schema version.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Configuration information for a Kerberos principal.
         */
        interface KerberosConfig {
            /**
             * A Kerberos keytab file that can be used to authenticate a service principal with a Kerberos Key Distribution Center (KDC).
             */
            keytab?: pulumi.Input<inputs.metastore.v1beta.Secret>;
            /**
             * A Cloud Storage URI that specifies the path to a krb5.conf file. It is of the form gs://{bucket_name}/path/to/krb5.conf, although the file does not need to be named krb5.conf explicitly.
             */
            krb5ConfigGcsUri?: pulumi.Input<string>;
            /**
             * A Kerberos principal that exists in the both the keytab the KDC to authenticate as. A typical principal is of the form primary/instance@REALM, but there is no exact format.
             */
            principal?: pulumi.Input<string>;
        }
        /**
         * Maintenance window. This specifies when Dataproc Metastore may perform system maintenance operation to the service.
         */
        interface MaintenanceWindow {
            /**
             * The day of week, when the window starts.
             */
            dayOfWeek?: pulumi.Input<string>;
            /**
             * The hour of day (0-23) when the window starts.
             */
            hourOfDay?: pulumi.Input<number>;
        }
        /**
         * Specifies how metastore metadata should be integrated with external services.
         */
        interface MetadataIntegration {
            /**
             * The integration config for the Data Catalog service.
             */
            dataCatalogConfig?: pulumi.Input<inputs.metastore.v1beta.DataCatalogConfig>;
        }
        /**
         * A securely stored value.
         */
        interface Secret {
            /**
             * The relative resource name of a Secret Manager secret version, in the following form:projects/{project_number}/secrets/{secret_id}/versions/{version_id}.
             */
            cloudSecret?: pulumi.Input<string>;
        }
    }
}
export declare namespace ml {
    namespace v1 {
        interface GoogleCloudMlV1_AutomatedStoppingConfig_DecayCurveAutomatedStoppingConfig {
            /**
             * If true, measurement.elapsed_time is used as the x-axis of each Trials Decay Curve. Otherwise, Measurement.steps will be used as the x-axis.
             */
            useElapsedTime?: pulumi.Input<boolean>;
        }
        /**
         * The median automated stopping rule stops a pending trial if the trial's best objective_value is strictly below the median 'performance' of all completed trials reported up to the trial's last measurement. Currently, 'performance' refers to the running average of the objective values reported by the trial in each measurement.
         */
        interface GoogleCloudMlV1_AutomatedStoppingConfig_MedianAutomatedStoppingConfig {
            /**
             * If true, the median automated stopping rule applies to measurement.use_elapsed_time, which means the elapsed_time field of the current trial's latest measurement is used to compute the median objective value for each completed trial.
             */
            useElapsedTime?: pulumi.Input<boolean>;
        }
        /**
         * An observed value of a metric.
         */
        interface GoogleCloudMlV1_HyperparameterOutput_HyperparameterMetric {
            /**
             * The objective value at this training step.
             */
            objectiveValue?: pulumi.Input<number>;
            /**
             * The global training step for this metric.
             */
            trainingStep?: pulumi.Input<string>;
        }
        /**
         * A message representing a metric in the measurement.
         */
        interface GoogleCloudMlV1_Measurement_Metric {
            /**
             * Required. Metric name.
             */
            metric?: pulumi.Input<string>;
            /**
             * Required. The value for this metric.
             */
            value?: pulumi.Input<number>;
        }
        interface GoogleCloudMlV1_StudyConfigParameterSpec_CategoricalValueSpec {
            /**
             * Must be specified if type is `CATEGORICAL`. The list of possible categories.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        interface GoogleCloudMlV1_StudyConfigParameterSpec_DiscreteValueSpec {
            /**
             * Must be specified if type is `DISCRETE`. A list of feasible points. The list should be in strictly increasing order. For instance, this parameter might have possible settings of 1.5, 2.5, and 4.0. This list should not contain more than 1,000 values.
             */
            values?: pulumi.Input<pulumi.Input<number>[]>;
        }
        interface GoogleCloudMlV1_StudyConfigParameterSpec_DoubleValueSpec {
            /**
             * Must be specified if type is `DOUBLE`. Maximum value of the parameter.
             */
            maxValue?: pulumi.Input<number>;
            /**
             * Must be specified if type is `DOUBLE`. Minimum value of the parameter.
             */
            minValue?: pulumi.Input<number>;
        }
        interface GoogleCloudMlV1_StudyConfigParameterSpec_IntegerValueSpec {
            /**
             * Must be specified if type is `INTEGER`. Maximum value of the parameter.
             */
            maxValue?: pulumi.Input<string>;
            /**
             * Must be specified if type is `INTEGER`. Minimum value of the parameter.
             */
            minValue?: pulumi.Input<string>;
        }
        /**
         * Represents the spec to match categorical values from parent parameter.
         */
        interface GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentCategoricalValueSpec {
            /**
             * Matches values of the parent parameter with type 'CATEGORICAL'. All values must exist in `categorical_value_spec` of parent parameter.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents the spec to match discrete values from parent parameter.
         */
        interface GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentDiscreteValueSpec {
            /**
             * Matches values of the parent parameter with type 'DISCRETE'. All values must exist in `discrete_value_spec` of parent parameter.
             */
            values?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * Represents the spec to match integer values from parent parameter.
         */
        interface GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentIntValueSpec {
            /**
             * Matches values of the parent parameter with type 'INTEGER'. All values must lie in `integer_value_spec` of parent parameter.
             */
            values?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a metric to optimize.
         */
        interface GoogleCloudMlV1_StudyConfig_MetricSpec {
            /**
             * Required. The optimization goal of the metric.
             */
            goal?: pulumi.Input<string>;
            /**
             * Required. The name of the metric.
             */
            metric?: pulumi.Input<string>;
        }
        /**
         * Represents a single parameter to optimize.
         */
        interface GoogleCloudMlV1_StudyConfig_ParameterSpec {
            /**
             * The value spec for a 'CATEGORICAL' parameter.
             */
            categoricalValueSpec?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_CategoricalValueSpec>;
            /**
             * A child node is active if the parameter's value matches the child node's matching_parent_values. If two items in child_parameter_specs have the same name, they must have disjoint matching_parent_values.
             */
            childParameterSpecs?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfig_ParameterSpec>[]>;
            /**
             * The value spec for a 'DISCRETE' parameter.
             */
            discreteValueSpec?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_DiscreteValueSpec>;
            /**
             * The value spec for a 'DOUBLE' parameter.
             */
            doubleValueSpec?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_DoubleValueSpec>;
            /**
             * The value spec for an 'INTEGER' parameter.
             */
            integerValueSpec?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_IntegerValueSpec>;
            /**
             * Required. The parameter name must be unique amongst all ParameterSpecs.
             */
            parameter?: pulumi.Input<string>;
            parentCategoricalValues?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentCategoricalValueSpec>;
            parentDiscreteValues?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentDiscreteValueSpec>;
            parentIntValues?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfigParameterSpec_MatchingParentIntValueSpec>;
            /**
             * How the parameter should be scaled. Leave unset for categorical parameters.
             */
            scaleType?: pulumi.Input<string>;
            /**
             * Required. The type of the parameter.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A message representing a parameter to be tuned. Contains the name of the parameter and the suggested value to use for this trial.
         */
        interface GoogleCloudMlV1_Trial_Parameter {
            /**
             * Must be set if ParameterType is DOUBLE or DISCRETE.
             */
            floatValue?: pulumi.Input<number>;
            /**
             * Must be set if ParameterType is INTEGER
             */
            intValue?: pulumi.Input<string>;
            /**
             * The name of the parameter.
             */
            parameter?: pulumi.Input<string>;
            /**
             * Must be set if ParameterTypeis CATEGORICAL
             */
            stringValue?: pulumi.Input<string>;
        }
        /**
         * Represents a hardware accelerator request config. Note that the AcceleratorConfig can be used in both Jobs and Versions. Learn more about [accelerators for training](/ml-engine/docs/using-gpus) and [accelerators for online prediction](/ml-engine/docs/machine-types-online-prediction#gpus).
         */
        interface GoogleCloudMlV1__AcceleratorConfig {
            /**
             * The number of accelerators to attach to each machine running the job.
             */
            count?: pulumi.Input<string>;
            /**
             * The type of accelerator to use.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Options for automatically scaling a model.
         */
        interface GoogleCloudMlV1__AutoScaling {
            /**
             * The maximum number of nodes to scale this model under load. The actual value will depend on resource quota and availability.
             */
            maxNodes?: pulumi.Input<number>;
            /**
             * MetricSpec contains the specifications to use to calculate the desired nodes count.
             */
            metrics?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__MetricSpec>[]>;
            /**
             * Optional. The minimum number of nodes to allocate for this model. These nodes are always up, starting from the time the model is deployed. Therefore, the cost of operating this model will be at least `rate` * `min_nodes` * number of hours since last billing cycle, where `rate` is the cost per node-hour as documented in the [pricing guide](/ml-engine/docs/pricing), even if no predictions are performed. There is additional cost for each prediction performed. Unlike manual scaling, if the load gets too heavy for the nodes that are up, the service will automatically add nodes to handle the increased load as well as scale back as traffic drops, always maintaining at least `min_nodes`. You will be charged for the time in which additional nodes are used. If `min_nodes` is not specified and AutoScaling is used with a [legacy (MLS1) machine type](/ml-engine/docs/machine-types-online-prediction), `min_nodes` defaults to 0, in which case, when traffic to a model stops (and after a cool-down period), nodes will be shut down and no charges will be incurred until traffic to the model resumes. If `min_nodes` is not specified and AutoScaling is used with a [Compute Engine (N1) machine type](/ml-engine/docs/machine-types-online-prediction), `min_nodes` defaults to 1. `min_nodes` must be at least 1 for use with a Compute Engine machine type. You can set `min_nodes` when creating the model version, and you can also update `min_nodes` for an existing version: update_body.json: { 'autoScaling': { 'minNodes': 5 } } HTTP request: PATCH https://ml.googleapis.com/v1/{name=projects/*&#47;models/*&#47;versions/*}?update_mask=autoScaling.minNodes -d @./update_body.json
             */
            minNodes?: pulumi.Input<number>;
        }
        /**
         * Configuration for Automated Early Stopping of Trials. If no implementation_config is set, automated early stopping will not be run.
         */
        interface GoogleCloudMlV1__AutomatedStoppingConfig {
            decayCurveStoppingConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_AutomatedStoppingConfig_DecayCurveAutomatedStoppingConfig>;
            medianAutomatedStoppingConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_AutomatedStoppingConfig_MedianAutomatedStoppingConfig>;
        }
        /**
         * Represents output related to a built-in algorithm Job.
         */
        interface GoogleCloudMlV1__BuiltInAlgorithmOutput {
            /**
             * Framework on which the built-in algorithm was trained.
             */
            framework?: pulumi.Input<string>;
            /**
             * The Cloud Storage path to the `model/` directory where the training job saves the trained model. Only set for successful jobs that don't use hyperparameter tuning.
             */
            modelPath?: pulumi.Input<string>;
            /**
             * Python version on which the built-in algorithm was trained.
             */
            pythonVersion?: pulumi.Input<string>;
            /**
             * AI Platform runtime version on which the built-in algorithm was trained.
             */
            runtimeVersion?: pulumi.Input<string>;
        }
        /**
         * Represents a network port in a single container. This message is a subset of the [Kubernetes ContainerPort v1 core specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#containerport-v1-core).
         */
        interface GoogleCloudMlV1__ContainerPort {
            /**
             * Number of the port to expose on the container. This must be a valid port number: 0 < PORT_NUMBER < 65536.
             */
            containerPort?: pulumi.Input<number>;
        }
        /**
         * Specification of a custom container for serving predictions. This message is a subset of the [Kubernetes Container v1 core specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core).
         */
        interface GoogleCloudMlV1__ContainerSpec {
            /**
             * Immutable. Specifies arguments for the command that runs when the container starts. This overrides the container's [`CMD`](https://docs.docker.com/engine/reference/builder/#cmd). Specify this field as an array of executable and arguments, similar to a Docker `CMD`'s "default parameters" form. If you don't specify this field but do specify the command field, then the command from the `command` field runs without any additional arguments. See the [Kubernetes documentation about how the `command` and `args` fields interact with a container's `ENTRYPOINT` and `CMD`](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#notes). If you don't specify this field and don't specify the `commmand` field, then the container's [`ENTRYPOINT`](https://docs.docker.com/engine/reference/builder/#cmd) and `CMD` determine what runs based on their default behavior. See the [Docker documentation about how `CMD` and `ENTRYPOINT` interact](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact). In this field, you can reference [environment variables set by AI Platform Prediction](/ai-platform/prediction/docs/custom-container-requirements#aip-variables) and environment variables set in the env field. You cannot reference environment variables set in the Docker image. In order for environment variables to be expanded, reference them by using the following syntax: $( VARIABLE_NAME) Note that this differs from Bash variable expansion, which does not use parentheses. If a variable cannot be resolved, the reference in the input string is used unchanged. To avoid variable expansion, you can escape this syntax with `$$`; for example: $$(VARIABLE_NAME) This field corresponds to the `args` field of the [Kubernetes Containers v1 core API](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core).
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Immutable. Specifies the command that runs when the container starts. This overrides the container's [`ENTRYPOINT`](https://docs.docker.com/engine/reference/builder/#entrypoint). Specify this field as an array of executable and arguments, similar to a Docker `ENTRYPOINT`'s "exec" form, not its "shell" form. If you do not specify this field, then the container's `ENTRYPOINT` runs, in conjunction with the args field or the container's [`CMD`](https://docs.docker.com/engine/reference/builder/#cmd), if either exists. If this field is not specified and the container does not have an `ENTRYPOINT`, then refer to the [Docker documentation about how `CMD` and `ENTRYPOINT` interact](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact). If you specify this field, then you can also specify the `args` field to provide additional arguments for this command. However, if you specify this field, then the container's `CMD` is ignored. See the [Kubernetes documentation about how the `command` and `args` fields interact with a container's `ENTRYPOINT` and `CMD`](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#notes). In this field, you can reference [environment variables set by AI Platform Prediction](/ai-platform/prediction/docs/custom-container-requirements#aip-variables) and environment variables set in the env field. You cannot reference environment variables set in the Docker image. In order for environment variables to be expanded, reference them by using the following syntax: $( VARIABLE_NAME) Note that this differs from Bash variable expansion, which does not use parentheses. If a variable cannot be resolved, the reference in the input string is used unchanged. To avoid variable expansion, you can escape this syntax with `$$`; for example: $$(VARIABLE_NAME) This field corresponds to the `command` field of the [Kubernetes Containers v1 core API](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core).
             */
            command?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Immutable. List of environment variables to set in the container. After the container starts running, code running in the container can read these environment variables. Additionally, the command and args fields can reference these variables. Later entries in this list can also reference earlier entries. For example, the following example sets the variable `VAR_2` to have the value `foo bar`: ```json [ { "name": "VAR_1", "value": "foo" }, { "name": "VAR_2", "value": "$(VAR_1) bar" } ] ``` If you switch the order of the variables in the example, then the expansion does not occur. This field corresponds to the `env` field of the [Kubernetes Containers v1 core API](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core).
             */
            env?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__EnvVar>[]>;
            /**
             * URI of the Docker image to be used as the custom container for serving predictions. This URI must identify [an image in Artifact Registry](/artifact-registry/docs/overview) and begin with the hostname `{REGION}-docker.pkg.dev`, where `{REGION}` is replaced by the region that matches AI Platform Prediction [regional endpoint](/ai-platform/prediction/docs/regional-endpoints) that you are using. For example, if you are using the `us-central1-ml.googleapis.com` endpoint, then this URI must begin with `us-central1-docker.pkg.dev`. To use a custom container, the [AI Platform Google-managed service account](/ai-platform/prediction/docs/custom-service-account#default) must have permission to pull (read) the Docker image at this URI. The AI Platform Google-managed service account has the following format: `service-{PROJECT_NUMBER}@cloud-ml.google.com.iam.gserviceaccount.com` {PROJECT_NUMBER} is replaced by your Google Cloud project number. By default, this service account has necessary permissions to pull an Artifact Registry image in the same Google Cloud project where you are using AI Platform Prediction. In this case, no configuration is necessary. If you want to use an image from a different Google Cloud project, learn how to [grant the Artifact Registry Reader (roles/artifactregistry.reader) role for a repository](/artifact-registry/docs/access-control#grant-repo) to your projet's AI Platform Google-managed service account. To learn about the requirements for the Docker image itself, read [Custom container requirements](/ai-platform/prediction/docs/custom-container-requirements).
             */
            image?: pulumi.Input<string>;
            /**
             * Immutable. List of ports to expose from the container. AI Platform Prediction sends any prediction requests that it receives to the first port on this list. AI Platform Prediction also sends [liveness and health checks](/ai-platform/prediction/docs/custom-container-requirements#health) to this port. If you do not specify this field, it defaults to following value: ```json [ { "containerPort": 8080 } ] ``` AI Platform Prediction does not use ports other than the first one listed. This field corresponds to the `ports` field of the [Kubernetes Containers v1 core API](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core).
             */
            ports?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ContainerPort>[]>;
        }
        /**
         * Represents the config of disk options.
         */
        interface GoogleCloudMlV1__DiskConfig {
            /**
             * Size in GB of the boot disk (default is 100GB).
             */
            bootDiskSizeGb?: pulumi.Input<number>;
            /**
             * Type of the boot disk (default is "pd-ssd"). Valid values: "pd-ssd" (Persistent Disk Solid State Drive) or "pd-standard" (Persistent Disk Hard Disk Drive).
             */
            bootDiskType?: pulumi.Input<string>;
        }
        /**
         * Represents a custom encryption key configuration that can be applied to a resource.
         */
        interface GoogleCloudMlV1__EncryptionConfig {
            /**
             * The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a training job. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Represents an environment variable to be made available in a container. This message is a subset of the [Kubernetes EnvVar v1 core specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#envvar-v1-core).
         */
        interface GoogleCloudMlV1__EnvVar {
            /**
             * Name of the environment variable. Must be a [valid C identifier](https://github.com/kubernetes/kubernetes/blob/v1.18.8/staging/src/k8s.io/apimachinery/pkg/util/validation/validation.go#L258) and must not begin with the prefix `AIP_`.
             */
            name?: pulumi.Input<string>;
            /**
             * Value of the environment variable. Defaults to an empty string. In this field, you can reference [environment variables set by AI Platform Prediction](/ai-platform/prediction/docs/custom-container-requirements#aip-variables) and environment variables set earlier in the same env field as where this message occurs. You cannot reference environment variables set in the Docker image. In order for environment variables to be expanded, reference them by using the following syntax: $(VARIABLE_NAME) Note that this differs from Bash variable expansion, which does not use parentheses. If a variable cannot be resolved, the reference in the input string is used unchanged. To avoid variable expansion, you can escape this syntax with `$$`; for example: $$(VARIABLE_NAME)
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Message holding configuration options for explaining model predictions. There are three feature attribution methods supported for TensorFlow models: integrated gradients, sampled Shapley, and XRAI. [Learn more about feature attributions.](/ai-platform/prediction/docs/ai-explanations/overview)
         */
        interface GoogleCloudMlV1__ExplanationConfig {
            /**
             * Attributes credit by computing the Aumann-Shapley value taking advantage of the model's fully differentiable structure. Refer to this paper for more details: https://arxiv.org/abs/1703.01365
             */
            integratedGradientsAttribution?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__IntegratedGradientsAttribution>;
            /**
             * An attribution method that approximates Shapley values for features that contribute to the label being predicted. A sampling strategy is used to approximate the value rather than considering all subsets of features.
             */
            sampledShapleyAttribution?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__SampledShapleyAttribution>;
            /**
             * Attributes credit by computing the XRAI taking advantage of the model's fully differentiable structure. Refer to this paper for more details: https://arxiv.org/abs/1906.02825 Currently only implemented for models with natural image inputs.
             */
            xraiAttribution?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__XraiAttribution>;
        }
        /**
         * Represents the result of a single hyperparameter tuning trial from a training job. The TrainingOutput object that is returned on successful completion of a training job with hyperparameter tuning includes a list of HyperparameterOutput objects, one for each successful trial.
         */
        interface GoogleCloudMlV1__HyperparameterOutput {
            /**
             * All recorded object metrics for this trial. This field is not currently populated.
             */
            allMetrics?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_HyperparameterOutput_HyperparameterMetric>[]>;
            /**
             * Details related to built-in algorithms jobs. Only set for trials of built-in algorithms jobs that have succeeded.
             */
            builtInAlgorithmOutput?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__BuiltInAlgorithmOutput>;
            /**
             * End time for the trial.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The final objective metric seen for this trial.
             */
            finalMetric?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_HyperparameterOutput_HyperparameterMetric>;
            /**
             * The hyperparameters given to this trial.
             */
            hyperparameters?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * True if the trial is stopped early.
             */
            isTrialStoppedEarly?: pulumi.Input<boolean>;
            /**
             * Start time for the trial.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The detailed state of the trial.
             */
            state?: pulumi.Input<string>;
            /**
             * The trial id for these results.
             */
            trialId?: pulumi.Input<string>;
        }
        /**
         * Represents a set of hyperparameters to optimize.
         */
        interface GoogleCloudMlV1__HyperparameterSpec {
            /**
             * Optional. The search algorithm specified for the hyperparameter tuning job. Uses the default AI Platform hyperparameter tuning algorithm if unspecified.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * Optional. Indicates if the hyperparameter tuning job enables auto trial early stopping.
             */
            enableTrialEarlyStopping?: pulumi.Input<boolean>;
            /**
             * Required. The type of goal to use for tuning. Available types are `MAXIMIZE` and `MINIMIZE`. Defaults to `MAXIMIZE`.
             */
            goal?: pulumi.Input<string>;
            /**
             * Optional. The TensorFlow summary tag name to use for optimizing trials. For current versions of TensorFlow, this tag name should exactly match what is shown in TensorBoard, including all scopes. For versions of TensorFlow prior to 0.12, this should be only the tag passed to tf.Summary. By default, "training/hptuning/metric" will be used.
             */
            hyperparameterMetricTag?: pulumi.Input<string>;
            /**
             * Optional. The number of failed trials that need to be seen before failing the hyperparameter tuning job. You can specify this field to override the default failing criteria for AI Platform hyperparameter tuning jobs. Defaults to zero, which means the service decides when a hyperparameter job should fail.
             */
            maxFailedTrials?: pulumi.Input<number>;
            /**
             * Optional. The number of training trials to run concurrently. You can reduce the time it takes to perform hyperparameter tuning by adding trials in parallel. However, each trail only benefits from the information gained in completed trials. That means that a trial does not get access to the results of trials running at the same time, which could reduce the quality of the overall optimization. Each trial will use the same scale tier and machine types. Defaults to one.
             */
            maxParallelTrials?: pulumi.Input<number>;
            /**
             * Optional. How many training trials should be attempted to optimize the specified hyperparameters. Defaults to one.
             */
            maxTrials?: pulumi.Input<number>;
            /**
             * Required. The set of parameters to tune.
             */
            params?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ParameterSpec>[]>;
            /**
             * Optional. The prior hyperparameter tuning job id that users hope to continue with. The job id will be used to find the corresponding vizier study guid and resume the study.
             */
            resumePreviousJobId?: pulumi.Input<string>;
        }
        /**
         * Attributes credit by computing the Aumann-Shapley value taking advantage of the model's fully differentiable structure. Refer to this paper for more details: https://arxiv.org/abs/1703.01365
         */
        interface GoogleCloudMlV1__IntegratedGradientsAttribution {
            /**
             * Number of steps for approximating the path integral. A good value to start is 50 and gradually increase until the sum to diff property is met within the desired error range.
             */
            numIntegralSteps?: pulumi.Input<number>;
        }
        /**
         * Options for manually scaling a model.
         */
        interface GoogleCloudMlV1__ManualScaling {
            /**
             * The number of nodes to allocate for this model. These nodes are always up, starting from the time the model is deployed, so the cost of operating this model will be proportional to `nodes` * number of hours since last billing cycle plus the cost for each prediction performed.
             */
            nodes?: pulumi.Input<number>;
        }
        /**
         * A message representing a measurement.
         */
        interface GoogleCloudMlV1__Measurement {
            /**
             * Time that the trial has been running at the point of this measurement.
             */
            elapsedTime?: pulumi.Input<string>;
            /**
             * Provides a list of metrics that act as inputs into the objective function.
             */
            metrics?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_Measurement_Metric>[]>;
            /**
             * The number of steps a machine learning model has been trained for. Must be non-negative.
             */
            stepCount?: pulumi.Input<string>;
        }
        /**
         * MetricSpec contains the specifications to use to calculate the desired nodes count when autoscaling is enabled.
         */
        interface GoogleCloudMlV1__MetricSpec {
            /**
             * metric name.
             */
            name?: pulumi.Input<string>;
            /**
             * Target specifies the target value for the given metric; once real metric deviates from the threshold by a certain percentage, the node count changes.
             */
            target?: pulumi.Input<number>;
        }
        /**
         * Represents a single hyperparameter to optimize.
         */
        interface GoogleCloudMlV1__ParameterSpec {
            /**
             * Required if type is `CATEGORICAL`. The list of possible categories.
             */
            categoricalValues?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required if type is `DISCRETE`. A list of feasible points. The list should be in strictly increasing order. For instance, this parameter might have possible settings of 1.5, 2.5, and 4.0. This list should not contain more than 1,000 values.
             */
            discreteValues?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * Required if type is `DOUBLE` or `INTEGER`. This field should be unset if type is `CATEGORICAL`. This value should be integers if type is `INTEGER`.
             */
            maxValue?: pulumi.Input<number>;
            /**
             * Required if type is `DOUBLE` or `INTEGER`. This field should be unset if type is `CATEGORICAL`. This value should be integers if type is INTEGER.
             */
            minValue?: pulumi.Input<number>;
            /**
             * Required. The parameter name must be unique amongst all ParameterConfigs in a HyperparameterSpec message. E.g., "learning_rate".
             */
            parameterName?: pulumi.Input<string>;
            /**
             * Optional. How the parameter should be scaled to the hypercube. Leave unset for categorical parameters. Some kind of scaling is strongly recommended for real or integral parameters (e.g., `UNIT_LINEAR_SCALE`).
             */
            scaleType?: pulumi.Input<string>;
            /**
             * Required. The type of the parameter.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Represents input parameters for a prediction job.
         */
        interface GoogleCloudMlV1__PredictionInput {
            /**
             * Optional. Number of records per batch, defaults to 64. The service will buffer batch_size number of records in memory before invoking one Tensorflow prediction call internally. So take the record size and memory available into consideration when setting this parameter.
             */
            batchSize?: pulumi.Input<string>;
            /**
             * Required. The format of the input data files.
             */
            dataFormat?: pulumi.Input<string>;
            /**
             * Required. The Cloud Storage location of the input data files. May contain wildcards.
             */
            inputPaths?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The maximum number of workers to be used for parallel processing. Defaults to 10 if not specified.
             */
            maxWorkerCount?: pulumi.Input<string>;
            /**
             * Use this field if you want to use the default version for the specified model. The string must use the following format: `"projects/YOUR_PROJECT/models/YOUR_MODEL"`
             */
            modelName?: pulumi.Input<string>;
            /**
             * Optional. Format of the output data files, defaults to JSON.
             */
            outputDataFormat?: pulumi.Input<string>;
            /**
             * Required. The output Google Cloud Storage location.
             */
            outputPath?: pulumi.Input<string>;
            /**
             * Required. The Google Compute Engine region to run the prediction job in. See the available regions for AI Platform services.
             */
            region?: pulumi.Input<string>;
            /**
             * Optional. The AI Platform runtime version to use for this batch prediction. If not set, AI Platform will pick the runtime version used during the CreateVersion request for this model version, or choose the latest stable version when model version information is not available such as when the model is specified by uri.
             */
            runtimeVersion?: pulumi.Input<string>;
            /**
             * Optional. The name of the signature defined in the SavedModel to use for this job. Please refer to [SavedModel](https://tensorflow.github.io/serving/serving_basic.html) for information about how to use signatures. Defaults to [DEFAULT_SERVING_SIGNATURE_DEF_KEY](https://www.tensorflow.org/api_docs/python/tf/saved_model/signature_constants) , which is "serving_default".
             */
            signatureName?: pulumi.Input<string>;
            /**
             * Use this field if you want to specify a Google Cloud Storage path for the model to use.
             */
            uri?: pulumi.Input<string>;
            /**
             * Use this field if you want to specify a version of the model to use. The string is formatted the same way as `model_version`, with the addition of the version information: `"projects/YOUR_PROJECT/models/YOUR_MODEL/versions/YOUR_VERSION"`
             */
            versionName?: pulumi.Input<string>;
        }
        /**
         * Represents results of a prediction job.
         */
        interface GoogleCloudMlV1__PredictionOutput {
            /**
             * The number of data instances which resulted in errors.
             */
            errorCount?: pulumi.Input<string>;
            /**
             * Node hours used by the batch prediction job.
             */
            nodeHours?: pulumi.Input<number>;
            /**
             * The output Google Cloud Storage location provided at the job creation time.
             */
            outputPath?: pulumi.Input<string>;
            /**
             * The number of generated predictions.
             */
            predictionCount?: pulumi.Input<string>;
        }
        /**
         * Represents the configuration for a replica in a cluster.
         */
        interface GoogleCloudMlV1__ReplicaConfig {
            /**
             * Represents the type and number of accelerators used by the replica. [Learn about restrictions on accelerator configurations for training.](/ai-platform/training/docs/using-gpus#compute-engine-machine-types-with-gpu)
             */
            acceleratorConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__AcceleratorConfig>;
            /**
             * Arguments to the entrypoint command. The following rules apply for container_command and container_args: - If you do not supply command or args: The defaults defined in the Docker image are used. - If you supply a command but no args: The default EntryPoint and the default Cmd defined in the Docker image are ignored. Your command is run without any arguments. - If you supply only args: The default Entrypoint defined in the Docker image is run with the args that you supplied. - If you supply a command and args: The default Entrypoint and the default Cmd defined in the Docker image are ignored. Your command is run with your args. It cannot be set if custom container image is not provided. Note that this field and [TrainingInput.args] are mutually exclusive, i.e., both cannot be set at the same time.
             */
            containerArgs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The command with which the replica's custom container is run. If provided, it will override default ENTRYPOINT of the docker image. If not provided, the docker image's ENTRYPOINT is used. It cannot be set if custom container image is not provided. Note that this field and [TrainingInput.args] are mutually exclusive, i.e., both cannot be set at the same time.
             */
            containerCommand?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Represents the configuration of disk options.
             */
            diskConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__DiskConfig>;
            /**
             * The Docker image to run on the replica. This image must be in Container Registry. Learn more about [configuring custom containers](/ai-platform/training/docs/distributed-training-containers).
             */
            imageUri?: pulumi.Input<string>;
            /**
             * The AI Platform runtime version that includes a TensorFlow version matching the one used in the custom container. This field is required if the replica is a TPU worker that uses a custom container. Otherwise, do not specify this field. This must be a [runtime version that currently supports training with TPUs](/ml-engine/docs/tensorflow/runtime-version-list#tpu-support). Note that the version of TensorFlow included in a runtime version may differ from the numbering of the runtime version itself, because it may have a different [patch version](https://www.tensorflow.org/guide/version_compat#semantic_versioning_20). In this field, you must specify the runtime version (TensorFlow minor version). For example, if your custom container runs TensorFlow `1.x.y`, specify `1.x`.
             */
            tpuTfVersion?: pulumi.Input<string>;
        }
        /**
         * Configuration for logging request-response pairs to a BigQuery table. Online prediction requests to a model version and the responses to these requests are converted to raw strings and saved to the specified BigQuery table. Logging is constrained by [BigQuery quotas and limits](/bigquery/quotas). If your project exceeds BigQuery quotas or limits, AI Platform Prediction does not log request-response pairs, but it continues to serve predictions. If you are using [continuous evaluation](/ml-engine/docs/continuous-evaluation/), you do not need to specify this configuration manually. Setting up continuous evaluation automatically enables logging of request-response pairs.
         */
        interface GoogleCloudMlV1__RequestLoggingConfig {
            /**
             * Required. Fully qualified BigQuery table name in the following format: " project_id.dataset_name.table_name" The specified table must already exist, and the "Cloud ML Service Agent" for your project must have permission to write to it. The table must have the following [schema](/bigquery/docs/schemas): Field nameType Mode model STRING REQUIRED model_version STRING REQUIRED time TIMESTAMP REQUIRED raw_data STRING REQUIRED raw_prediction STRING NULLABLE groundtruth STRING NULLABLE
             */
            bigqueryTableName?: pulumi.Input<string>;
            /**
             * Percentage of requests to be logged, expressed as a fraction from 0 to 1. For example, if you want to log 10% of requests, enter `0.1`. The sampling window is the lifetime of the model version. Defaults to 0.
             */
            samplingPercentage?: pulumi.Input<number>;
        }
        /**
         * Specifies HTTP paths served by a custom container. AI Platform Prediction sends requests to these paths on the container; the custom container must run an HTTP server that responds to these requests with appropriate responses. Read [Custom container requirements](/ai-platform/prediction/docs/custom-container-requirements) for details on how to create your container image to meet these requirements.
         */
        interface GoogleCloudMlV1__RouteMap {
            /**
             * HTTP path on the container to send health checkss to. AI Platform Prediction intermittently sends GET requests to this path on the container's IP address and port to check that the container is healthy. Read more about [health checks](/ai-platform/prediction/docs/custom-container-requirements#checks). For example, if you set this field to `/bar`, then AI Platform Prediction intermittently sends a GET request to the `/bar` path on the port of your container specified by the first value of Version.container.ports. If you don't specify this field, it defaults to the following value: /v1/models/ MODEL/versions/VERSION The placeholders in this value are replaced as follows: * MODEL: The name of the parent Model. This does not include the "projects/PROJECT_ID/models/" prefix that the API returns in output; it is the bare model name, as provided to projects.models.create. * VERSION: The name of the model version. This does not include the "projects/PROJECT_ID /models/MODEL/versions/" prefix that the API returns in output; it is the bare version name, as provided to projects.models.versions.create.
             */
            health?: pulumi.Input<string>;
            /**
             * HTTP path on the container to send prediction requests to. AI Platform Prediction forwards requests sent using projects.predict to this path on the container's IP address and port. AI Platform Prediction then returns the container's response in the API response. For example, if you set this field to `/foo`, then when AI Platform Prediction receives a prediction request, it forwards the request body in a POST request to the `/foo` path on the port of your container specified by the first value of Version.container.ports. If you don't specify this field, it defaults to the following value: /v1/models/MODEL/versions/VERSION:predict The placeholders in this value are replaced as follows: * MODEL: The name of the parent Model. This does not include the "projects/PROJECT_ID/models/" prefix that the API returns in output; it is the bare model name, as provided to projects.models.create. * VERSION: The name of the model version. This does not include the "projects/PROJECT_ID/models/MODEL/versions/" prefix that the API returns in output; it is the bare version name, as provided to projects.models.versions.create.
             */
            predict?: pulumi.Input<string>;
        }
        /**
         * An attribution method that approximates Shapley values for features that contribute to the label being predicted. A sampling strategy is used to approximate the value rather than considering all subsets of features.
         */
        interface GoogleCloudMlV1__SampledShapleyAttribution {
            /**
             * The number of feature permutations to consider when approximating the Shapley values.
             */
            numPaths?: pulumi.Input<number>;
        }
        /**
         * All parameters related to scheduling of training jobs.
         */
        interface GoogleCloudMlV1__Scheduling {
            /**
             * Optional. The maximum job running time, expressed in seconds. The field can contain up to nine fractional digits, terminated by `s`. If not specified, this field defaults to `604800s` (seven days). If the training job is still running after this duration, AI Platform Training cancels it. The duration is measured from when the job enters the `RUNNING` state; therefore it does not overlap with the duration limited by Scheduling.max_wait_time. For example, if you want to ensure your job runs for no more than 2 hours, set this field to `7200s` (2 hours * 60 minutes / hour * 60 seconds / minute). If you submit your training job using the `gcloud` tool, you can [specify this field in a `config.yaml` file](/ai-platform/training/docs/training-jobs#formatting_your_configuration_parameters). For example: ```yaml trainingInput: scheduling: maxRunningTime: 7200s ```
             */
            maxRunningTime?: pulumi.Input<string>;
            /**
             * Optional. The maximum job wait time, expressed in seconds. The field can contain up to nine fractional digits, terminated by `s`. If not specified, there is no limit to the wait time. The minimum for this field is `1800s` (30 minutes). If the training job has not entered the `RUNNING` state after this duration, AI Platform Training cancels it. After the job begins running, it can no longer be cancelled due to the maximum wait time. Therefore the duration limited by this field does not overlap with the duration limited by Scheduling.max_running_time. For example, if the job temporarily stops running and retries due to a [VM restart](/ai-platform/training/docs/overview#restarts), this cannot lead to a maximum wait time cancellation. However, independently of this constraint, AI Platform Training might stop a job if there are too many retries due to exhausted resources in a region. The following example describes how you might use this field: To cancel your job if it doesn't start running within 1 hour, set this field to `3600s` (1 hour * 60 minutes / hour * 60 seconds / minute). If the job is still in the `QUEUED` or `PREPARING` state after an hour of waiting, AI Platform Training cancels the job. If you submit your training job using the `gcloud` tool, you can [specify this field in a `config.yaml` file](/ai-platform/training/docs/training-jobs#formatting_your_configuration_parameters). For example: ```yaml trainingInput: scheduling: maxWaitTime: 3600s ```
             */
            maxWaitTime?: pulumi.Input<string>;
        }
        /**
         * Represents configuration of a study.
         */
        interface GoogleCloudMlV1__StudyConfig {
            /**
             * The search algorithm specified for the study.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * Configuration for automated stopping of unpromising Trials.
             */
            automatedStoppingConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__AutomatedStoppingConfig>;
            /**
             * Metric specs for the study.
             */
            metrics?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfig_MetricSpec>[]>;
            /**
             * Required. The set of parameters to tune.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1_StudyConfig_ParameterSpec>[]>;
        }
        /**
         * Represents input parameters for a training job. When using the gcloud command to submit your training job, you can specify the input parameters as command-line arguments and/or in a YAML configuration file referenced from the --config command-line argument. For details, see the guide to [submitting a training job](/ai-platform/training/docs/training-jobs).
         */
        interface GoogleCloudMlV1__TrainingInput {
            /**
             * Optional. Command-line arguments passed to the training application when it starts. If your job uses a custom container, then the arguments are passed to the container's `ENTRYPOINT` command.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Options for using customer-managed encryption keys (CMEK) to protect resources created by a training job, instead of using Google's default encryption. If this is set, then all resources created by the training job will be encrypted with the customer-managed encryption key that you specify. [Learn how and when to use CMEK with AI Platform Training](/ai-platform/training/docs/cmek).
             */
            encryptionConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__EncryptionConfig>;
            /**
             * Optional. The configuration for evaluators. You should only set `evaluatorConfig.acceleratorConfig` if `evaluatorType` is set to a Compute Engine machine type. [Learn about restrictions on accelerator configurations for training.](/ai-platform/training/docs/using-gpus#compute-engine-machine-types-with-gpu) Set `evaluatorConfig.imageUri` only if you build a custom image for your evaluator. If `evaluatorConfig.imageUri` has not been set, AI Platform uses the value of `masterConfig.imageUri`. Learn more about [configuring custom containers](/ai-platform/training/docs/distributed-training-containers).
             */
            evaluatorConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ReplicaConfig>;
            /**
             * Optional. The number of evaluator replicas to use for the training job. Each replica in the cluster will be of the type specified in `evaluator_type`. This value can only be used when `scale_tier` is set to `CUSTOM`. If you set this value, you must also set `evaluator_type`. The default value is zero.
             */
            evaluatorCount?: pulumi.Input<string>;
            /**
             * Optional. Specifies the type of virtual machine to use for your training job's evaluator nodes. The supported values are the same as those described in the entry for `masterType`. This value must be consistent with the category of machine type that `masterType` uses. In other words, both must be Compute Engine machine types or both must be legacy machine types. This value must be present when `scaleTier` is set to `CUSTOM` and `evaluatorCount` is greater than zero.
             */
            evaluatorType?: pulumi.Input<string>;
            /**
             * Optional. The set of Hyperparameters to tune.
             */
            hyperparameters?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__HyperparameterSpec>;
            /**
             * Optional. A Google Cloud Storage path in which to store training outputs and other data needed for training. This path is passed to your TensorFlow program as the '--job-dir' command-line argument. The benefit of specifying this field is that Cloud ML validates the path for use in training.
             */
            jobDir?: pulumi.Input<string>;
            /**
             * Optional. The configuration for your master worker. You should only set `masterConfig.acceleratorConfig` if `masterType` is set to a Compute Engine machine type. Learn about [restrictions on accelerator configurations for training.](/ai-platform/training/docs/using-gpus#compute-engine-machine-types-with-gpu) Set `masterConfig.imageUri` only if you build a custom image. Only one of `masterConfig.imageUri` and `runtimeVersion` should be set. Learn more about [configuring custom containers](/ai-platform/training/docs/distributed-training-containers).
             */
            masterConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ReplicaConfig>;
            /**
             * Optional. Specifies the type of virtual machine to use for your training job's master worker. You must specify this field when `scaleTier` is set to `CUSTOM`. You can use certain Compute Engine machine types directly in this field. See the [list of compatible Compute Engine machine types](/ai-platform/training/docs/machine-types#compute-engine-machine-types). Alternatively, you can use the certain legacy machine types in this field. See the [list of legacy machine types](/ai-platform/training/docs/machine-types#legacy-machine-types). Finally, if you want to use a TPU for training, specify `cloud_tpu` in this field. Learn more about the [special configuration options for training with TPUs](/ai-platform/training/docs/using-tpus#configuring_a_custom_tpu_machine).
             */
            masterType?: pulumi.Input<string>;
            /**
             * Optional. The full name of the [Compute Engine network](/vpc/docs/vpc) to which the Job is peered. For example, `projects/12345/global/networks/myVPC`. The format of this field is `projects/{project}/global/networks/{network}`, where {project} is a project number (like `12345`) and {network} is network name. Private services access must already be configured for the network. If left unspecified, the Job is not peered with any network. [Learn about using VPC Network Peering.](/ai-platform/training/docs/vpc-peering).
             */
            network?: pulumi.Input<string>;
            /**
             * Required. The Google Cloud Storage location of the packages with the training program and any additional dependencies. The maximum number of package URIs is 100.
             */
            packageUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The configuration for parameter servers. You should only set `parameterServerConfig.acceleratorConfig` if `parameterServerType` is set to a Compute Engine machine type. [Learn about restrictions on accelerator configurations for training.](/ai-platform/training/docs/using-gpus#compute-engine-machine-types-with-gpu) Set `parameterServerConfig.imageUri` only if you build a custom image for your parameter server. If `parameterServerConfig.imageUri` has not been set, AI Platform uses the value of `masterConfig.imageUri`. Learn more about [configuring custom containers](/ai-platform/training/docs/distributed-training-containers).
             */
            parameterServerConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ReplicaConfig>;
            /**
             * Optional. The number of parameter server replicas to use for the training job. Each replica in the cluster will be of the type specified in `parameter_server_type`. This value can only be used when `scale_tier` is set to `CUSTOM`. If you set this value, you must also set `parameter_server_type`. The default value is zero.
             */
            parameterServerCount?: pulumi.Input<string>;
            /**
             * Optional. Specifies the type of virtual machine to use for your training job's parameter server. The supported values are the same as those described in the entry for `master_type`. This value must be consistent with the category of machine type that `masterType` uses. In other words, both must be Compute Engine machine types or both must be legacy machine types. This value must be present when `scaleTier` is set to `CUSTOM` and `parameter_server_count` is greater than zero.
             */
            parameterServerType?: pulumi.Input<string>;
            /**
             * Required. The Python module name to run after installing the packages.
             */
            pythonModule?: pulumi.Input<string>;
            /**
             * Optional. The version of Python used in training. You must either specify this field or specify `masterConfig.imageUri`. The following Python versions are available: * Python '3.7' is available when `runtime_version` is set to '1.15' or later. * Python '3.5' is available when `runtime_version` is set to a version from '1.4' to '1.14'. * Python '2.7' is available when `runtime_version` is set to '1.15' or earlier. Read more about the Python versions available for [each runtime version](/ml-engine/docs/runtime-version-list).
             */
            pythonVersion?: pulumi.Input<string>;
            /**
             * Required. The region to run the training job in. See the [available regions](/ai-platform/training/docs/regions) for AI Platform Training.
             */
            region?: pulumi.Input<string>;
            /**
             * Optional. The AI Platform runtime version to use for training. You must either specify this field or specify `masterConfig.imageUri`. For more information, see the [runtime version list](/ai-platform/training/docs/runtime-version-list) and learn [how to manage runtime versions](/ai-platform/training/docs/versioning).
             */
            runtimeVersion?: pulumi.Input<string>;
            /**
             * Required. Specifies the machine types, the number of replicas for workers and parameter servers.
             */
            scaleTier?: pulumi.Input<string>;
            /**
             * Optional. Scheduling options for a training job.
             */
            scheduling?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__Scheduling>;
            /**
             * Optional. The email address of a service account to use when running the training appplication. You must have the `iam.serviceAccounts.actAs` permission for the specified service account. In addition, the AI Platform Training Google-managed service account must have the `roles/iam.serviceAccountAdmin` role for the specified service account. [Learn more about configuring a service account.](/ai-platform/training/docs/custom-service-account) If not specified, the AI Platform Training Google-managed service account is used by default.
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * Optional. Use `chief` instead of `master` in the `TF_CONFIG` environment variable when training with a custom container. Defaults to `false`. [Learn more about this field.](/ai-platform/training/docs/distributed-training-details#chief-versus-master) This field has no effect for training jobs that don't use a custom container.
             */
            useChiefInTfConfig?: pulumi.Input<boolean>;
            /**
             * Optional. The configuration for workers. You should only set `workerConfig.acceleratorConfig` if `workerType` is set to a Compute Engine machine type. [Learn about restrictions on accelerator configurations for training.](/ai-platform/training/docs/using-gpus#compute-engine-machine-types-with-gpu) Set `workerConfig.imageUri` only if you build a custom image for your worker. If `workerConfig.imageUri` has not been set, AI Platform uses the value of `masterConfig.imageUri`. Learn more about [configuring custom containers](/ai-platform/training/docs/distributed-training-containers).
             */
            workerConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ReplicaConfig>;
            /**
             * Optional. The number of worker replicas to use for the training job. Each replica in the cluster will be of the type specified in `worker_type`. This value can only be used when `scale_tier` is set to `CUSTOM`. If you set this value, you must also set `worker_type`. The default value is zero.
             */
            workerCount?: pulumi.Input<string>;
            /**
             * Optional. Specifies the type of virtual machine to use for your training job's worker nodes. The supported values are the same as those described in the entry for `masterType`. This value must be consistent with the category of machine type that `masterType` uses. In other words, both must be Compute Engine machine types or both must be legacy machine types. If you use `cloud_tpu` for this value, see special instructions for [configuring a custom TPU machine](/ml-engine/docs/tensorflow/using-tpus#configuring_a_custom_tpu_machine). This value must be present when `scaleTier` is set to `CUSTOM` and `workerCount` is greater than zero.
             */
            workerType?: pulumi.Input<string>;
        }
        /**
         * Represents results of a training job. Output only.
         */
        interface GoogleCloudMlV1__TrainingOutput {
            /**
             * Details related to built-in algorithms jobs. Only set for built-in algorithms jobs.
             */
            builtInAlgorithmOutput?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__BuiltInAlgorithmOutput>;
            /**
             * The number of hyperparameter tuning trials that completed successfully. Only set for hyperparameter tuning jobs.
             */
            completedTrialCount?: pulumi.Input<string>;
            /**
             * The amount of ML units consumed by the job.
             */
            consumedMLUnits?: pulumi.Input<number>;
            /**
             * The TensorFlow summary tag name used for optimizing hyperparameter tuning trials. See [`HyperparameterSpec.hyperparameterMetricTag`](#HyperparameterSpec.FIELDS.hyperparameter_metric_tag) for more information. Only set for hyperparameter tuning jobs.
             */
            hyperparameterMetricTag?: pulumi.Input<string>;
            /**
             * Whether this job is a built-in Algorithm job.
             */
            isBuiltInAlgorithmJob?: pulumi.Input<boolean>;
            /**
             * Whether this job is a hyperparameter tuning job.
             */
            isHyperparameterTuningJob?: pulumi.Input<boolean>;
            /**
             * Results for individual Hyperparameter trials. Only set for hyperparameter tuning jobs.
             */
            trials?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__HyperparameterOutput>[]>;
        }
        /**
         * Represents a version of the model. Each version is a trained model deployed in the cloud, ready to handle prediction requests. A model can have multiple versions. You can get information about all of the versions of a given model by calling projects.models.versions.list.
         */
        interface GoogleCloudMlV1__Version {
            /**
             * Optional. Accelerator config for using GPUs for online prediction (beta). Only specify this field if you have specified a Compute Engine (N1) machine type in the `machineType` field. Learn more about [using GPUs for online prediction](/ml-engine/docs/machine-types-online-prediction#gpus).
             */
            acceleratorConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__AcceleratorConfig>;
            /**
             * Automatically scale the number of nodes used to serve the model in response to increases and decreases in traffic. Care should be taken to ramp up traffic according to the model's ability to scale or you will start seeing increases in latency and 429 response codes.
             */
            autoScaling?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__AutoScaling>;
            /**
             * Optional. Specifies a custom container to use for serving predictions. If you specify this field, then `machineType` is required. If you specify this field, then `deploymentUri` is optional. If you specify this field, then you must not specify `runtimeVersion`, `packageUris`, `framework`, `pythonVersion`, or `predictionClass`.
             */
            container?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ContainerSpec>;
            /**
             * The time the version was created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * The Cloud Storage URI of a directory containing trained model artifacts to be used to create the model version. See the [guide to deploying models](/ai-platform/prediction/docs/deploying-models) for more information. The total number of files under this directory must not exceed 1000. During projects.models.versions.create, AI Platform Prediction copies all files from the specified directory to a location managed by the service. From then on, AI Platform Prediction uses these copies of the model artifacts to serve predictions, not the original files in Cloud Storage, so this location is useful only as a historical record. If you specify container, then this field is optional. Otherwise, it is required. Learn [how to use this field with a custom container](/ai-platform/prediction/docs/custom-container-requirements#artifacts).
             */
            deploymentUri?: pulumi.Input<string>;
            /**
             * Optional. The description specified for the version when it was created.
             */
            description?: pulumi.Input<string>;
            /**
             * The details of a failure or a cancellation.
             */
            errorMessage?: pulumi.Input<string>;
            /**
             * `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a model from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform model updates in order to avoid race conditions: An `etag` is returned in the response to `GetVersion`, and systems are expected to put that etag in the request to `UpdateVersion` to ensure that their change will be applied to the model as intended.
             */
            etag?: pulumi.Input<string>;
            /**
             * Optional. Configures explainability features on the model's version. Some explanation features require additional metadata to be loaded as part of the model payload.
             */
            explanationConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ExplanationConfig>;
            /**
             * Optional. The machine learning framework AI Platform uses to train this version of the model. Valid values are `TENSORFLOW`, `SCIKIT_LEARN`, `XGBOOST`. If you do not specify a framework, AI Platform will analyze files in the deployment_uri to determine a framework. If you choose `SCIKIT_LEARN` or `XGBOOST`, you must also set the runtime version of the model to 1.4 or greater. Do **not** specify a framework if you're deploying a [custom prediction routine](/ai-platform/prediction/docs/custom-prediction-routines) or if you're using a [custom container](/ai-platform/prediction/docs/use-custom-container).
             */
            framework?: pulumi.Input<string>;
            /**
             * If true, this version will be used to handle prediction requests that do not specify a version. You can change the default version by calling projects.methods.versions.setDefault.
             */
            isDefault?: pulumi.Input<boolean>;
            /**
             * Optional. One or more labels that you can add, to organize your model versions. Each label is a key-value pair, where both the key and the value are arbitrary strings that you supply. For more information, see the documentation on using labels.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The time the version was last used for prediction.
             */
            lastUseTime?: pulumi.Input<string>;
            /**
             * Optional. The type of machine on which to serve the model. Currently only applies to online prediction service. To learn about valid values for this field, read [Choosing a machine type for online prediction](/ai-platform/prediction/docs/machine-types-online-prediction). If this field is not specified and you are using a [regional endpoint](/ai-platform/prediction/docs/regional-endpoints), then the machine type defaults to `n1-standard-2`. If this field is not specified and you are using the global endpoint (`ml.googleapis.com`), then the machine type defaults to `mls1-c1-m2`.
             */
            machineType?: pulumi.Input<string>;
            /**
             * Manually select the number of nodes to use for serving the model. You should generally use `auto_scaling` with an appropriate `min_nodes` instead, but this option is available if you want more predictable billing. Beware that latency and error rates will increase if the traffic exceeds that capability of the system to serve it based on the selected number of nodes.
             */
            manualScaling?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__ManualScaling>;
            /**
             * Required. The name specified for the version when it was created. The version name must be unique within the model it is created in.
             */
            name?: pulumi.Input<string>;
            /**
             * Optional. Cloud Storage paths (`gs://…`) of packages for [custom prediction routines](/ml-engine/docs/tensorflow/custom-prediction-routines) or [scikit-learn pipelines with custom code](/ml-engine/docs/scikit/exporting-for-prediction#custom-pipeline-code). For a custom prediction routine, one of these packages must contain your Predictor class (see [`predictionClass`](#Version.FIELDS.prediction_class)). Additionally, include any dependencies used by your Predictor or scikit-learn pipeline uses that are not already included in your selected [runtime version](/ml-engine/docs/tensorflow/runtime-version-list). If you specify this field, you must also set [`runtimeVersion`](#Version.FIELDS.runtime_version) to 1.4 or greater.
             */
            packageUris?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. The fully qualified name (module_name.class_name) of a class that implements the Predictor interface described in this reference field. The module containing this class should be included in a package provided to the [`packageUris` field](#Version.FIELDS.package_uris). Specify this field if and only if you are deploying a [custom prediction routine (beta)](/ml-engine/docs/tensorflow/custom-prediction-routines). If you specify this field, you must set [`runtimeVersion`](#Version.FIELDS.runtime_version) to 1.4 or greater and you must set `machineType` to a [legacy (MLS1) machine type](/ml-engine/docs/machine-types-online-prediction). The following code sample provides the Predictor interface: class Predictor(object): """Interface for constructing custom predictors.""" def predict(self, instances, **kwargs): """Performs custom prediction. Instances are the decoded values from the request. They have already been deserialized from JSON. Args: instances: A list of prediction input instances. **kwargs: A dictionary of keyword args provided as additional fields on the predict request body. Returns: A list of outputs containing the prediction results. This list must be JSON serializable. """ raise NotImplementedError() @classmethod def from_path(cls, model_dir): """Creates an instance of Predictor using the given path. Loading of the predictor should be done in this method. Args: model_dir: The local directory that contains the exported model file along with any additional files uploaded when creating the version resource. Returns: An instance implementing this Predictor class. """ raise NotImplementedError() Learn more about [the Predictor interface and custom prediction routines](/ml-engine/docs/tensorflow/custom-prediction-routines).
             */
            predictionClass?: pulumi.Input<string>;
            /**
             * Required. The version of Python used in prediction. The following Python versions are available: * Python '3.7' is available when `runtime_version` is set to '1.15' or later. * Python '3.5' is available when `runtime_version` is set to a version from '1.4' to '1.14'. * Python '2.7' is available when `runtime_version` is set to '1.15' or earlier. Read more about the Python versions available for [each runtime version](/ml-engine/docs/runtime-version-list).
             */
            pythonVersion?: pulumi.Input<string>;
            /**
             * Optional. *Only* specify this field in a projects.models.versions.patch request. Specifying it in a projects.models.versions.create request has no effect. Configures the request-response pair logging on predictions from this Version.
             */
            requestLoggingConfig?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__RequestLoggingConfig>;
            /**
             * Optional. Specifies paths on a custom container's HTTP server where AI Platform Prediction sends certain requests. If you specify this field, then you must also specify the `container` field. If you specify the `container` field and do not specify this field, it defaults to the following: ```json { "predict": "/v1/models/MODEL/versions/VERSION:predict", "health": "/v1/models/MODEL/versions/VERSION" } ``` See RouteMap for more details about these default values.
             */
            routes?: pulumi.Input<inputs.ml.v1.GoogleCloudMlV1__RouteMap>;
            /**
             * Required. The AI Platform runtime version to use for this deployment. For more information, see the [runtime version list](/ml-engine/docs/runtime-version-list) and [how to manage runtime versions](/ml-engine/docs/versioning).
             */
            runtimeVersion?: pulumi.Input<string>;
            /**
             * Optional. Specifies the service account for resource access control. If you specify this field, then you must also specify either the `containerSpec` or the `predictionClass` field. Learn more about [using a custom service account](/ai-platform/prediction/docs/custom-service-account).
             */
            serviceAccount?: pulumi.Input<string>;
            /**
             * The state of a version.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Attributes credit by computing the XRAI taking advantage of the model's fully differentiable structure. Refer to this paper for more details: https://arxiv.org/abs/1906.02825 Currently only implemented for models with natural image inputs.
         */
        interface GoogleCloudMlV1__XraiAttribution {
            /**
             * Number of steps for approximating the path integral. A good value to start is 50 and gradually increase until the sum to diff property is met within the desired error range.
             */
            numIntegralSteps?: pulumi.Input<number>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface GoogleIamV1__AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.ml.v1.GoogleIamV1__AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface GoogleIamV1__AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface GoogleIamV1__Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.ml.v1.GoogleType__Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface GoogleType__Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace monitoring {
    namespace v1 {
        /**
         * Describes how to combine multiple time series to provide a different view of the data. Aggregation of time series is done in two steps. First, each time series in the set is aligned to the same time interval boundaries, then the set of time series is optionally reduced in number.Alignment consists of applying the per_series_aligner operation to each time series after its data has been divided into regular alignment_period time intervals. This process takes all of the data points in an alignment period, applies a mathematical transformation such as averaging, minimum, maximum, delta, etc., and converts them into a single data point per period.Reduction is when the aligned and transformed time series can optionally be combined, reducing the number of time series through similar mathematical transformations. Reduction involves applying a cross_series_reducer to all the time series, optionally sorting the time series into subsets with group_by_fields, and applying the reducer to each subset.The raw time series data can contain a huge amount of information from multiple sources. Alignment and reduction transforms this mass of data into a more manageable and representative collection of data, for example "the 95% latency across the average of all tasks in a cluster". This representative data can be more easily graphed and comprehended, and the individual time series data is still available for later drilldown. For more details, see Filtering and aggregation (https://cloud.google.com/monitoring/api/v3/aggregation).
         */
        interface Aggregation {
            /**
             * The alignment_period specifies a time interval, in seconds, that is used to divide the data in all the time series into consistent blocks of time. This will be done before the per-series aligner can be applied to the data.The value must be at least 60 seconds. If a per-series aligner other than ALIGN_NONE is specified, this field is required or an error is returned. If no per-series aligner is specified, or the aligner ALIGN_NONE is specified, then this field is ignored.The maximum value of the alignment_period is 2 years, or 104 weeks.
             */
            alignmentPeriod?: pulumi.Input<string>;
            /**
             * The reduction operation to be used to combine time series into a single time series, where the value of each data point in the resulting series is a function of all the already aligned values in the input time series.Not all reducer operations can be applied to all time series. The valid choices depend on the metric_kind and the value_type of the original time series. Reduction can yield a time series with a different metric_kind or value_type than the input time series.Time series data must first be aligned (see per_series_aligner) in order to perform cross-time series reduction. If cross_series_reducer is specified, then per_series_aligner must be specified, and must not be ALIGN_NONE. An alignment_period must also be specified; otherwise, an error is returned.
             */
            crossSeriesReducer?: pulumi.Input<string>;
            /**
             * The set of fields to preserve when cross_series_reducer is specified. The group_by_fields determine how the time series are partitioned into subsets prior to applying the aggregation operation. Each subset contains time series that have the same value for each of the grouping fields. Each individual time series is a member of exactly one subset. The cross_series_reducer is applied to each subset of time series. It is not possible to reduce across different resource types, so this field implicitly contains resource.type. Fields not specified in group_by_fields are aggregated away. If group_by_fields is not specified and all the time series have the same resource type, then the time series are aggregated into a single output time series. If cross_series_reducer is not defined, this field is ignored.
             */
            groupByFields?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An Aligner describes how to bring the data points in a single time series into temporal alignment. Except for ALIGN_NONE, all alignments cause all the data points in an alignment_period to be mathematically grouped together, resulting in a single data point for each alignment_period with end timestamp at the end of the period.Not all alignment operations may be applied to all time series. The valid choices depend on the metric_kind and value_type of the original time series. Alignment can change the metric_kind or the value_type of the time series.Time series data must be aligned in order to perform cross-time series reduction. If cross_series_reducer is specified, then per_series_aligner must be specified and not equal to ALIGN_NONE and alignment_period must be specified; otherwise, an error is returned.
             */
            perSeriesAligner?: pulumi.Input<string>;
        }
        /**
         * A chart axis.
         */
        interface Axis {
            /**
             * The label of the axis.
             */
            label?: pulumi.Input<string>;
            /**
             * The axis scale. By default, a linear scale is used.
             */
            scale?: pulumi.Input<string>;
        }
        /**
         * Options to control visual rendering of a chart.
         */
        interface ChartOptions {
            /**
             * The chart mode.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Defines the layout properties and content for a column.
         */
        interface Column {
            /**
             * The relative weight of this column. The column weight is used to adjust the width of columns on the screen (relative to peers). Greater the weight, greater the width of the column on the screen. If omitted, a value of 1 is used while rendering.
             */
            weight?: pulumi.Input<string>;
            /**
             * The display widgets arranged vertically in this column.
             */
            widgets?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Widget>[]>;
        }
        /**
         * A simplified layout that divides the available space into vertical columns and arranges a set of widgets vertically in each column.
         */
        interface ColumnLayout {
            /**
             * The columns of content to display.
             */
            columns?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Column>[]>;
        }
        /**
         * Groups a time series query definition with charting options.
         */
        interface DataSet {
            /**
             * A template string for naming TimeSeries in the resulting data set. This should be a string with interpolations of the form ${label_name}, which will resolve to the label's value.
             */
            legendTemplate?: pulumi.Input<string>;
            /**
             * Optional. The lower bound on data point frequency for this data set, implemented by specifying the minimum alignment period to use in a time series query For example, if the data is published once every 10 minutes, the min_alignment_period should be at least 10 minutes. It would not make sense to fetch and align data at one minute intervals.
             */
            minAlignmentPeriod?: pulumi.Input<string>;
            /**
             * How this data should be plotted on the chart.
             */
            plotType?: pulumi.Input<string>;
            /**
             * Required. Fields for querying time series data from the Stackdriver metrics API.
             */
            timeSeriesQuery?: pulumi.Input<inputs.monitoring.v1.TimeSeriesQuery>;
        }
        /**
         * A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for Empty is empty JSON object {}.
         */
        interface Empty {
        }
        /**
         * A gauge chart shows where the current value sits within a pre-defined range. The upper and lower bounds should define the possible range of values for the scorecard's query (inclusive).
         */
        interface GaugeView {
            /**
             * The lower bound for this gauge chart. The value of the chart should always be greater than or equal to this.
             */
            lowerBound?: pulumi.Input<number>;
            /**
             * The upper bound for this gauge chart. The value of the chart should always be less than or equal to this.
             */
            upperBound?: pulumi.Input<number>;
        }
        /**
         * A basic layout divides the available space into vertical columns of equal width and arranges a list of widgets using a row-first strategy.
         */
        interface GridLayout {
            /**
             * The number of columns into which the view's width is divided. If omitted or set to zero, a system default will be used while rendering.
             */
            columns?: pulumi.Input<string>;
            /**
             * The informational elements that are arranged into the columns row-first.
             */
            widgets?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Widget>[]>;
        }
        /**
         * A mosaic layout divides the available space into a grid of blocks, and overlays the grid with tiles. Unlike GridLayout, tiles may span multiple grid blocks and can be placed at arbitrary locations in the grid.
         */
        interface MosaicLayout {
            /**
             * The number of columns in the mosaic grid. The number of columns must be between 1 and 12, inclusive.
             */
            columns?: pulumi.Input<number>;
            /**
             * The tiles to display.
             */
            tiles?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Tile>[]>;
        }
        /**
         * Describes a ranking-based time series filter. Each input time series is ranked with an aligner. The filter will allow up to num_time_series time series to pass through it, selecting them based on the relative ranking.For example, if ranking_method is METHOD_MEAN,direction is BOTTOM, and num_time_series is 3, then the 3 times series with the lowest mean values will pass through the filter.
         */
        interface PickTimeSeriesFilter {
            /**
             * How to use the ranking to select time series that pass through the filter.
             */
            direction?: pulumi.Input<string>;
            /**
             * How many time series to allow to pass through the filter.
             */
            numTimeSeries?: pulumi.Input<number>;
            /**
             * ranking_method is applied to each time series independently to produce the value which will be used to compare the time series to other time series.
             */
            rankingMethod?: pulumi.Input<string>;
        }
        /**
         * Describes a query to build the numerator or denominator of a TimeSeriesFilterRatio.
         */
        interface RatioPart {
            /**
             * By default, the raw time series data is returned. Use this field to combine multiple time series for different views of the data.
             */
            aggregation?: pulumi.Input<inputs.monitoring.v1.Aggregation>;
            /**
             * Required. The monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) that identifies the metric types, resources, and projects to query.
             */
            filter?: pulumi.Input<string>;
        }
        /**
         * Defines the layout properties and content for a row.
         */
        interface Row {
            /**
             * The relative weight of this row. The row weight is used to adjust the height of rows on the screen (relative to peers). Greater the weight, greater the height of the row on the screen. If omitted, a value of 1 is used while rendering.
             */
            weight?: pulumi.Input<string>;
            /**
             * The display widgets arranged horizontally in this row.
             */
            widgets?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Widget>[]>;
        }
        /**
         * A simplified layout that divides the available space into rows and arranges a set of widgets horizontally in each row.
         */
        interface RowLayout {
            /**
             * The rows of content to display.
             */
            rows?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Row>[]>;
        }
        /**
         * A widget showing the latest value of a metric, and how this value relates to one or more thresholds.
         */
        interface Scorecard {
            /**
             * Will cause the scorecard to show a gauge chart.
             */
            gaugeView?: pulumi.Input<inputs.monitoring.v1.GaugeView>;
            /**
             * Will cause the scorecard to show a spark chart.
             */
            sparkChartView?: pulumi.Input<inputs.monitoring.v1.SparkChartView>;
            /**
             * The thresholds used to determine the state of the scorecard given the time series' current value. For an actual value x, the scorecard is in a danger state if x is less than or equal to a danger threshold that triggers below, or greater than or equal to a danger threshold that triggers above. Similarly, if x is above/below a warning threshold that triggers above/below, then the scorecard is in a warning state - unless x also puts it in a danger state. (Danger trumps warning.)As an example, consider a scorecard with the following four thresholds: { value: 90, category: 'DANGER', trigger: 'ABOVE', }, { value: 70, category: 'WARNING', trigger: 'ABOVE', }, { value: 10, category: 'DANGER', trigger: 'BELOW', }, { value: 20, category: 'WARNING', trigger: 'BELOW', }Then: values less than or equal to 10 would put the scorecard in a DANGER state, values greater than 10 but less than or equal to 20 a WARNING state, values strictly between 20 and 70 an OK state, values greater than or equal to 70 but less than 90 a WARNING state, and values greater than or equal to 90 a DANGER state.
             */
            thresholds?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Threshold>[]>;
            /**
             * Required. Fields for querying time series data from the Stackdriver metrics API.
             */
            timeSeriesQuery?: pulumi.Input<inputs.monitoring.v1.TimeSeriesQuery>;
        }
        /**
         * A sparkChart is a small chart suitable for inclusion in a table-cell or inline in text. This message contains the configuration for a sparkChart to show up on a Scorecard, showing recent trends of the scorecard's timeseries.
         */
        interface SparkChartView {
            /**
             * The lower bound on data point frequency in the chart implemented by specifying the minimum alignment period to use in a time series query. For example, if the data is published once every 10 minutes it would not make sense to fetch and align data at one minute intervals. This field is optional and exists only as a hint.
             */
            minAlignmentPeriod?: pulumi.Input<string>;
            /**
             * Required. The type of sparkchart to show in this chartView.
             */
            sparkChartType?: pulumi.Input<string>;
        }
        /**
         * A filter that ranks streams based on their statistical relation to other streams in a request. Note: This field is deprecated and completely ignored by the API.
         */
        interface StatisticalTimeSeriesFilter {
            /**
             * How many time series to output.
             */
            numTimeSeries?: pulumi.Input<number>;
            /**
             * rankingMethod is applied to a set of time series, and then the produced value for each individual time series is used to compare a given time series to others. These are methods that cannot be applied stream-by-stream, but rather require the full context of a request to evaluate time series.
             */
            rankingMethod?: pulumi.Input<string>;
        }
        /**
         * A widget that displays textual content.
         */
        interface Text {
            /**
             * The text content to be displayed.
             */
            content?: pulumi.Input<string>;
            /**
             * How the text content is formatted.
             */
            format?: pulumi.Input<string>;
        }
        /**
         * Defines a threshold for categorizing time series values.
         */
        interface Threshold {
            /**
             * The state color for this threshold. Color is not allowed in a XyChart.
             */
            color?: pulumi.Input<string>;
            /**
             * The direction for the current threshold. Direction is not allowed in a XyChart.
             */
            direction?: pulumi.Input<string>;
            /**
             * A label for the threshold.
             */
            label?: pulumi.Input<string>;
            /**
             * The value of the threshold. The value should be defined in the native scale of the metric.
             */
            value?: pulumi.Input<number>;
        }
        /**
         * A single tile in the mosaic. The placement and size of the tile are configurable.
         */
        interface Tile {
            /**
             * The height of the tile, measured in grid blocks. Tiles must have a minimum height of 1.
             */
            height?: pulumi.Input<number>;
            /**
             * The informational widget contained in the tile. For example an XyChart.
             */
            widget?: pulumi.Input<inputs.monitoring.v1.Widget>;
            /**
             * The width of the tile, measured in grid blocks. Tiles must have a minimum width of 1.
             */
            width?: pulumi.Input<number>;
            /**
             * The zero-indexed position of the tile in grid blocks relative to the left edge of the grid. Tiles must be contained within the specified number of columns. x_pos cannot be negative.
             */
            xPos?: pulumi.Input<number>;
            /**
             * The zero-indexed position of the tile in grid blocks relative to the top edge of the grid. y_pos cannot be negative.
             */
            yPos?: pulumi.Input<number>;
        }
        /**
         * A filter that defines a subset of time series data that is displayed in a widget. Time series data is fetched using the ListTimeSeries (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list) method.
         */
        interface TimeSeriesFilter {
            /**
             * By default, the raw time series data is returned. Use this field to combine multiple time series for different views of the data.
             */
            aggregation?: pulumi.Input<inputs.monitoring.v1.Aggregation>;
            /**
             * Required. The monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) that identifies the metric types, resources, and projects to query.
             */
            filter?: pulumi.Input<string>;
            /**
             * Ranking based time series filter.
             */
            pickTimeSeriesFilter?: pulumi.Input<inputs.monitoring.v1.PickTimeSeriesFilter>;
            /**
             * Apply a second aggregation after aggregation is applied.
             */
            secondaryAggregation?: pulumi.Input<inputs.monitoring.v1.Aggregation>;
            /**
             * Statistics based time series filter. Note: This field is deprecated and completely ignored by the API.
             */
            statisticalTimeSeriesFilter?: pulumi.Input<inputs.monitoring.v1.StatisticalTimeSeriesFilter>;
        }
        /**
         * A pair of time series filters that define a ratio computation. The output time series is the pair-wise division of each aligned element from the numerator and denominator time series.
         */
        interface TimeSeriesFilterRatio {
            /**
             * The denominator of the ratio.
             */
            denominator?: pulumi.Input<inputs.monitoring.v1.RatioPart>;
            /**
             * The numerator of the ratio.
             */
            numerator?: pulumi.Input<inputs.monitoring.v1.RatioPart>;
            /**
             * Ranking based time series filter.
             */
            pickTimeSeriesFilter?: pulumi.Input<inputs.monitoring.v1.PickTimeSeriesFilter>;
            /**
             * Apply a second aggregation after the ratio is computed.
             */
            secondaryAggregation?: pulumi.Input<inputs.monitoring.v1.Aggregation>;
            /**
             * Statistics based time series filter. Note: This field is deprecated and completely ignored by the API.
             */
            statisticalTimeSeriesFilter?: pulumi.Input<inputs.monitoring.v1.StatisticalTimeSeriesFilter>;
        }
        /**
         * TimeSeriesQuery collects the set of supported methods for querying time series data from the Stackdriver metrics API.
         */
        interface TimeSeriesQuery {
            /**
             * Filter parameters to fetch time series.
             */
            timeSeriesFilter?: pulumi.Input<inputs.monitoring.v1.TimeSeriesFilter>;
            /**
             * Parameters to fetch a ratio between two time series filters.
             */
            timeSeriesFilterRatio?: pulumi.Input<inputs.monitoring.v1.TimeSeriesFilterRatio>;
            /**
             * A query used to fetch time series.
             */
            timeSeriesQueryLanguage?: pulumi.Input<string>;
            /**
             * The unit of data contained in fetched time series. If non-empty, this unit will override any unit that accompanies fetched data. The format is the same as the unit (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.metricDescriptors) field in MetricDescriptor.
             */
            unitOverride?: pulumi.Input<string>;
        }
        /**
         * Widget contains a single dashboard component and configuration of how to present the component in the dashboard.
         */
        interface Widget {
            /**
             * A blank space.
             */
            blank?: pulumi.Input<inputs.monitoring.v1.Empty>;
            /**
             * A scorecard summarizing time series data.
             */
            scorecard?: pulumi.Input<inputs.monitoring.v1.Scorecard>;
            /**
             * A raw string or markdown displaying textual content.
             */
            text?: pulumi.Input<inputs.monitoring.v1.Text>;
            /**
             * Optional. The title of the widget.
             */
            title?: pulumi.Input<string>;
            /**
             * A chart of time series data.
             */
            xyChart?: pulumi.Input<inputs.monitoring.v1.XyChart>;
        }
        /**
         * A chart that displays data on a 2D (X and Y axes) plane.
         */
        interface XyChart {
            /**
             * Display options for the chart.
             */
            chartOptions?: pulumi.Input<inputs.monitoring.v1.ChartOptions>;
            /**
             * Required. The data displayed in this chart.
             */
            dataSets?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.DataSet>[]>;
            /**
             * Threshold lines drawn horizontally across the chart.
             */
            thresholds?: pulumi.Input<pulumi.Input<inputs.monitoring.v1.Threshold>[]>;
            /**
             * The duration used to display a comparison chart. A comparison chart simultaneously shows values from two similar-length time periods (e.g., week-over-week metrics). The duration must be positive, and it can only be applied to charts with data sets of LINE plot type.
             */
            timeshiftDuration?: pulumi.Input<string>;
            /**
             * The properties applied to the X axis.
             */
            xAxis?: pulumi.Input<inputs.monitoring.v1.Axis>;
            /**
             * The properties applied to the Y axis.
             */
            yAxis?: pulumi.Input<inputs.monitoring.v1.Axis>;
        }
    }
    namespace v3 {
        /**
         * Describes how to combine multiple time series to provide a different view of the data. Aggregation of time series is done in two steps. First, each time series in the set is aligned to the same time interval boundaries, then the set of time series is optionally reduced in number.Alignment consists of applying the per_series_aligner operation to each time series after its data has been divided into regular alignment_period time intervals. This process takes all of the data points in an alignment period, applies a mathematical transformation such as averaging, minimum, maximum, delta, etc., and converts them into a single data point per period.Reduction is when the aligned and transformed time series can optionally be combined, reducing the number of time series through similar mathematical transformations. Reduction involves applying a cross_series_reducer to all the time series, optionally sorting the time series into subsets with group_by_fields, and applying the reducer to each subset.The raw time series data can contain a huge amount of information from multiple sources. Alignment and reduction transforms this mass of data into a more manageable and representative collection of data, for example "the 95% latency across the average of all tasks in a cluster". This representative data can be more easily graphed and comprehended, and the individual time series data is still available for later drilldown. For more details, see Filtering and aggregation (https://cloud.google.com/monitoring/api/v3/aggregation).
         */
        interface Aggregation {
            /**
             * The alignment_period specifies a time interval, in seconds, that is used to divide the data in all the time series into consistent blocks of time. This will be done before the per-series aligner can be applied to the data.The value must be at least 60 seconds. If a per-series aligner other than ALIGN_NONE is specified, this field is required or an error is returned. If no per-series aligner is specified, or the aligner ALIGN_NONE is specified, then this field is ignored.The maximum value of the alignment_period is 104 weeks (2 years) for charts, and 90,000 seconds (25 hours) for alerting policies.
             */
            alignmentPeriod?: pulumi.Input<string>;
            /**
             * The reduction operation to be used to combine time series into a single time series, where the value of each data point in the resulting series is a function of all the already aligned values in the input time series.Not all reducer operations can be applied to all time series. The valid choices depend on the metric_kind and the value_type of the original time series. Reduction can yield a time series with a different metric_kind or value_type than the input time series.Time series data must first be aligned (see per_series_aligner) in order to perform cross-time series reduction. If cross_series_reducer is specified, then per_series_aligner must be specified, and must not be ALIGN_NONE. An alignment_period must also be specified; otherwise, an error is returned.
             */
            crossSeriesReducer?: pulumi.Input<string>;
            /**
             * The set of fields to preserve when cross_series_reducer is specified. The group_by_fields determine how the time series are partitioned into subsets prior to applying the aggregation operation. Each subset contains time series that have the same value for each of the grouping fields. Each individual time series is a member of exactly one subset. The cross_series_reducer is applied to each subset of time series. It is not possible to reduce across different resource types, so this field implicitly contains resource.type. Fields not specified in group_by_fields are aggregated away. If group_by_fields is not specified and all the time series have the same resource type, then the time series are aggregated into a single output time series. If cross_series_reducer is not defined, this field is ignored.
             */
            groupByFields?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An Aligner describes how to bring the data points in a single time series into temporal alignment. Except for ALIGN_NONE, all alignments cause all the data points in an alignment_period to be mathematically grouped together, resulting in a single data point for each alignment_period with end timestamp at the end of the period.Not all alignment operations may be applied to all time series. The valid choices depend on the metric_kind and value_type of the original time series. Alignment can change the metric_kind or the value_type of the time series.Time series data must be aligned in order to perform cross-time series reduction. If cross_series_reducer is specified, then per_series_aligner must be specified and not equal to ALIGN_NONE and alignment_period must be specified; otherwise, an error is returned.
             */
            perSeriesAligner?: pulumi.Input<string>;
        }
        /**
         * App Engine service. Learn more at https://cloud.google.com/appengine.
         */
        interface AppEngine {
            /**
             * The ID of the App Engine module underlying this service. Corresponds to the module_id resource label in the gae_app monitored resource: https://cloud.google.com/monitoring/api/resources#tag_gae_app
             */
            moduleId?: pulumi.Input<string>;
        }
        /**
         * Future parameters for the availability SLI.
         */
        interface AvailabilityCriteria {
        }
        /**
         * The authentication parameters to provide to the specified resource or URL that requires a username and password. Currently, only Basic HTTP authentication (https://tools.ietf.org/html/rfc7617) is supported in Uptime checks.
         */
        interface BasicAuthentication {
            /**
             * The password to use when authenticating with the HTTP server.
             */
            password?: pulumi.Input<string>;
            /**
             * The username to use when authenticating with the HTTP server.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * An SLI measuring performance on a well-known service type. Performance will be computed on the basis of pre-defined metrics. The type of the service_resource determines the metrics to use and the service_resource.labels and metric_labels are used to construct a monitoring filter to filter that metric down to just the data relevant to this service.
         */
        interface BasicSli {
            /**
             * Good service is defined to be the count of requests made to this service that return successfully.
             */
            availability?: pulumi.Input<inputs.monitoring.v3.AvailabilityCriteria>;
            /**
             * Good service is defined to be the count of requests made to this service that are fast enough with respect to latency.threshold.
             */
            latency?: pulumi.Input<inputs.monitoring.v3.LatencyCriteria>;
            /**
             * OPTIONAL: The set of locations to which this SLI is relevant. Telemetry from other locations will not be used to calculate performance for this SLI. If omitted, this SLI applies to all locations in which the Service has activity. For service types that don't support breaking down by location, setting this field will result in an error.
             */
            location?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * OPTIONAL: The set of RPCs to which this SLI is relevant. Telemetry from other methods will not be used to calculate performance for this SLI. If omitted, this SLI applies to all the Service's methods. For service types that don't support breaking down by method, setting this field will result in an error.
             */
            method?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * OPTIONAL: The set of API versions to which this SLI is relevant. Telemetry from other API versions will not be used to calculate performance for this SLI. If omitted, this SLI applies to all API versions. For service types that don't support breaking down by version, setting this field will result in an error.
             */
            version?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * BucketOptions describes the bucket boundaries used to create a histogram for the distribution. The buckets can be in a linear sequence, an exponential sequence, or each bucket can be specified explicitly. BucketOptions does not include the number of values in each bucket.A bucket has an inclusive lower bound and exclusive upper bound for the values that are counted for that bucket. The upper bound of a bucket must be strictly greater than the lower bound. The sequence of N buckets for a distribution consists of an underflow bucket (number 0), zero or more finite buckets (number 1 through N - 2) and an overflow bucket (number N - 1). The buckets are contiguous: the lower bound of bucket i (i > 0) is the same as the upper bound of bucket i - 1. The buckets span the whole range of finite values: lower bound of the underflow bucket is -infinity and the upper bound of the overflow bucket is +infinity. The finite buckets are so-called because both bounds are finite.
         */
        interface BucketOptions {
            /**
             * The explicit buckets.
             */
            explicitBuckets?: pulumi.Input<inputs.monitoring.v3.Explicit>;
            /**
             * The exponential buckets.
             */
            exponentialBuckets?: pulumi.Input<inputs.monitoring.v3.Exponential>;
            /**
             * The linear bucket.
             */
            linearBuckets?: pulumi.Input<inputs.monitoring.v3.Linear>;
        }
        /**
         * Cloud Endpoints service. Learn more at https://cloud.google.com/endpoints.
         */
        interface CloudEndpoints {
            /**
             * The name of the Cloud Endpoints service underlying this service. Corresponds to the service resource label in the api monitored resource: https://cloud.google.com/monitoring/api/resources#tag_api
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Istio service scoped to a single Kubernetes cluster. Learn more at https://istio.io. Clusters running OSS Istio will have their services ingested as this type.
         */
        interface ClusterIstio {
            /**
             * The name of the Kubernetes cluster in which this Istio service is defined. Corresponds to the cluster_name resource label in k8s_cluster resources.
             */
            clusterName?: pulumi.Input<string>;
            /**
             * The location of the Kubernetes cluster in which this Istio service is defined. Corresponds to the location resource label in k8s_cluster resources.
             */
            location?: pulumi.Input<string>;
            /**
             * The name of the Istio service underlying this service. Corresponds to the destination_service_name metric label in Istio metrics.
             */
            serviceName?: pulumi.Input<string>;
            /**
             * The namespace of the Istio service underlying this service. Corresponds to the destination_service_namespace metric label in Istio metrics.
             */
            serviceNamespace?: pulumi.Input<string>;
        }
        /**
         * A collection of data points sent from a collectd-based plugin. See the collectd documentation for more information.
         */
        interface CollectdPayload {
            /**
             * The end time of the interval.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The measurement metadata. Example: "process_id" -> 12345
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The name of the plugin. Example: "disk".
             */
            plugin?: pulumi.Input<string>;
            /**
             * The instance name of the plugin Example: "hdcl".
             */
            pluginInstance?: pulumi.Input<string>;
            /**
             * The start time of the interval.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The measurement type. Example: "memory".
             */
            type?: pulumi.Input<string>;
            /**
             * The measurement type instance. Example: "used".
             */
            typeInstance?: pulumi.Input<string>;
            /**
             * The measured values during this time interval. Each value must have a different data_source_name.
             */
            values?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.CollectdValue>[]>;
        }
        /**
         * A single data point from a collectd-based plugin.
         */
        interface CollectdValue {
            /**
             * The data source for the collectd value. For example, there are two data sources for network measurements: "rx" and "tx".
             */
            dataSourceName?: pulumi.Input<string>;
            /**
             * The type of measurement.
             */
            dataSourceType?: pulumi.Input<string>;
            /**
             * The measurement value.
             */
            value?: pulumi.Input<inputs.monitoring.v3.TypedValue>;
        }
        /**
         * A condition is a true/false test that determines when an alerting policy should open an incident. If a condition evaluates to true, it signifies that something is wrong.
         */
        interface Condition {
            /**
             * A condition that checks that a time series continues to receive new data points.
             */
            conditionAbsent?: pulumi.Input<inputs.monitoring.v3.MetricAbsence>;
            /**
             * A condition that uses the Monitoring Query Language to define alerts.
             */
            conditionMonitoringQueryLanguage?: pulumi.Input<inputs.monitoring.v3.MonitoringQueryLanguageCondition>;
            /**
             * A condition that compares a time series against a threshold.
             */
            conditionThreshold?: pulumi.Input<inputs.monitoring.v3.MetricThreshold>;
            /**
             * A short name or phrase used to identify the condition in dashboards, notifications, and incidents. To avoid confusion, don't use the same display name for multiple conditions in the same policy.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Required if the condition exists. The unique resource name for this condition. Its format is: projects/[PROJECT_ID_OR_NUMBER]/alertPolicies/[POLICY_ID]/conditions/[CONDITION_ID] [CONDITION_ID] is assigned by Stackdriver Monitoring when the condition is created as part of a new or updated alerting policy.When calling the alertPolicies.create method, do not include the name field in the conditions of the requested alerting policy. Stackdriver Monitoring creates the condition identifiers and includes them in the new policy.When calling the alertPolicies.update method to update a policy, including a condition name causes the existing condition to be updated. Conditions without names are added to the updated policy. Existing conditions are deleted if they are not updated.Best practice is to preserve [CONDITION_ID] if you make only small changes, such as those to condition thresholds, durations, or trigger values. Otherwise, treat the change as a new condition and let the existing condition be deleted.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Optional. Used to perform content matching. This allows matching based on substrings and regular expressions, together with their negations. Only the first 4 MB of an HTTP or HTTPS check's response (and the first 1 MB of a TCP check's response) are examined for purposes of content matching.
         */
        interface ContentMatcher {
            /**
             * String or regex content to match. Maximum 1024 bytes. An empty content string indicates no content matching is to be performed.
             */
            content?: pulumi.Input<string>;
            /**
             * The type of content matcher that will be applied to the server output, compared to the content string when the check is run.
             */
            matcher?: pulumi.Input<string>;
        }
        /**
         * Custom view of service telemetry. Currently a place-holder pending final design.
         */
        interface Custom {
        }
        /**
         * Distribution contains summary statistics for a population of values. It optionally contains a histogram representing the distribution of those values across a set of buckets.The summary statistics are the count, mean, sum of the squared deviation from the mean, the minimum, and the maximum of the set of population of values. The histogram is based on a sequence of buckets and gives a count of values that fall into each bucket. The boundaries of the buckets are given either explicitly or by formulas for buckets of fixed or exponentially increasing widths.Although it is not forbidden, it is generally a bad idea to include non-finite values (infinities or NaNs) in the population of values, as this will render the mean and sum_of_squared_deviation fields meaningless.
         */
        interface Distribution {
            /**
             * Required in the Cloud Monitoring API v3. The values for each bucket specified in bucket_options. The sum of the values in bucketCounts must equal the value in the count field of the Distribution object. The order of the bucket counts follows the numbering schemes described for the three bucket types. The underflow bucket has number 0; the finite buckets, if any, have numbers 1 through N-2; and the overflow bucket has number N-1. The size of bucket_counts must not be greater than N. If the size is less than N, then the remaining buckets are assigned values of zero.
             */
            bucketCounts?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required in the Cloud Monitoring API v3. Defines the histogram bucket boundaries.
             */
            bucketOptions?: pulumi.Input<inputs.monitoring.v3.BucketOptions>;
            /**
             * The number of values in the population. Must be non-negative. This value must equal the sum of the values in bucket_counts if a histogram is provided.
             */
            count?: pulumi.Input<string>;
            /**
             * Must be in increasing order of value field.
             */
            exemplars?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.Exemplar>[]>;
            /**
             * The arithmetic mean of the values in the population. If count is zero then this field must be zero.
             */
            mean?: pulumi.Input<number>;
            /**
             * If specified, contains the range of the population values. The field must not be present if the count is zero. This field is presently ignored by the Cloud Monitoring API v3.
             */
            range?: pulumi.Input<inputs.monitoring.v3.Range>;
            /**
             * The sum of squared deviations from the mean of the values in the population. For values x_i this is: Sum[i=1..n]((x_i - mean)^2) Knuth, "The Art of Computer Programming", Vol. 2, page 232, 3rd edition describes Welford's method for accumulating this sum in one pass.If count is zero then this field must be zero.
             */
            sumOfSquaredDeviation?: pulumi.Input<number>;
        }
        /**
         * A DistributionCut defines a TimeSeries and thresholds used for measuring good service and total service. The TimeSeries must have ValueType = DISTRIBUTION and MetricKind = DELTA or MetricKind = CUMULATIVE. The computed good_service will be the count of values x in the Distribution such that range.min <= x < range.max.
         */
        interface DistributionCut {
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying a TimeSeries aggregating values. Must have ValueType = DISTRIBUTION and MetricKind = DELTA or MetricKind = CUMULATIVE.
             */
            distributionFilter?: pulumi.Input<string>;
            /**
             * Range of values considered "good." For a one-sided range, set one bound to an infinite value.
             */
            range?: pulumi.Input<inputs.monitoring.v3.GoogleMonitoringV3Range>;
        }
        /**
         * A content string and a MIME type that describes the content string's format.
         */
        interface Documentation {
            /**
             * The text of the documentation, interpreted according to mime_type. The content may not exceed 8,192 Unicode characters and may not exceed more than 10,240 bytes when encoded in UTF-8 format, whichever is smaller.
             */
            content?: pulumi.Input<string>;
            /**
             * The format of the content field. Presently, only the value "text/markdown" is supported. See Markdown (https://en.wikipedia.org/wiki/Markdown) for more information.
             */
            mimeType?: pulumi.Input<string>;
        }
        /**
         * Exemplars are example points that may be used to annotate aggregated distribution values. They are metadata that gives information about a particular value added to a Distribution bucket, such as a trace ID that was active when a value was added. They may contain further information, such as a example values and timestamps, origin, etc.
         */
        interface Exemplar {
            /**
             * Contextual information about the example value. Examples are:Trace: type.googleapis.com/google.monitoring.v3.SpanContextLiteral string: type.googleapis.com/google.protobuf.StringValueLabels dropped during aggregation: type.googleapis.com/google.monitoring.v3.DroppedLabelsThere may be only a single attachment of any given message type in a single exemplar, and this is enforced by the system.
             */
            attachments?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * The observation (sampling) time of the above value.
             */
            timestamp?: pulumi.Input<string>;
            /**
             * Value of the exemplar point. This value determines to which bucket the exemplar belongs.
             */
            value?: pulumi.Input<number>;
        }
        /**
         * Specifies a set of buckets with arbitrary widths.There are size(bounds) + 1 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): boundsi Lower bound (1 <= i < N); boundsi - 1The bounds field must contain at least one element. If bounds has only one element, then there are no finite buckets, and that single element is the common boundary of the overflow and underflow buckets.
         */
        interface Explicit {
            /**
             * The values must be monotonically increasing.
             */
            bounds?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * Specifies an exponential sequence of buckets that have a width that is proportional to the value of the lower bound. Each bucket represents a constant relative uncertainty on a specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): scale * (growth_factor ^ i). Lower bound (1 <= i < N): scale * (growth_factor ^ (i - 1)).
         */
        interface Exponential {
            /**
             * Must be greater than 1.
             */
            growthFactor?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            numFiniteBuckets?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            scale?: pulumi.Input<number>;
        }
        /**
         * Range of numerical values, inclusive of min and exclusive of max. If the open range "< range.max" is desired, set range.min = -infinity. If the open range ">= range.min" is desired, set range.max = infinity.
         */
        interface GoogleMonitoringV3Range {
            /**
             * Range maximum.
             */
            max?: pulumi.Input<number>;
            /**
             * Range minimum.
             */
            min?: pulumi.Input<number>;
        }
        /**
         * Information involved in an HTTP/HTTPS Uptime check request.
         */
        interface HttpCheck {
            /**
             * The authentication information. Optional when creating an HTTP check; defaults to empty.
             */
            authInfo?: pulumi.Input<inputs.monitoring.v3.BasicAuthentication>;
            /**
             * The request body associated with the HTTP POST request. If content_type is URL_ENCODED, the body passed in must be URL-encoded. Users can provide a Content-Length header via the headers field or the API will do so. If the request_method is GET and body is not empty, the API will return an error. The maximum byte size is 1 megabyte. Note: As with all bytes fields, JSON representations are base64 encoded. e.g.: "foo=bar" in URL-encoded form is "foo%3Dbar" and in base64 encoding is "Zm9vJTI1M0RiYXI=".
             */
            body?: pulumi.Input<string>;
            /**
             * The content type header to use for the check. The following configurations result in errors: 1. Content type is specified in both the headers field and the content_type field. 2. Request method is GET and content_type is not TYPE_UNSPECIFIED 3. Request method is POST and content_type is TYPE_UNSPECIFIED. 4. Request method is POST and a "Content-Type" header is provided via headers field. The content_type field should be used instead.
             */
            contentType?: pulumi.Input<string>;
            /**
             * The list of headers to send as part of the Uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100.
             */
            headers?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to true then the headers will be obscured with ******.
             */
            maskHeaders?: pulumi.Input<boolean>;
            /**
             * Optional (defaults to "/"). The path to the page against which to run the check. Will be combined with the host (specified within the monitored_resource) and port to construct the full URL. If the provided path does not begin with "/", a "/" will be prepended automatically.
             */
            path?: pulumi.Input<string>;
            /**
             * Optional (defaults to 80 when use_ssl is false, and 443 when use_ssl is true). The TCP port on the HTTP server against which to run the check. Will be combined with host (specified within the monitored_resource) and path to construct the full URL.
             */
            port?: pulumi.Input<number>;
            /**
             * The HTTP request method to use for the check. If set to METHOD_UNSPECIFIED then request_method defaults to GET.
             */
            requestMethod?: pulumi.Input<string>;
            /**
             * If true, use HTTPS instead of HTTP to run the check.
             */
            useSsl?: pulumi.Input<boolean>;
            /**
             * Boolean specifying whether to include SSL certificate validation as a part of the Uptime check. Only applies to checks where monitored_resource is set to uptime_url. If use_ssl is false, setting validate_ssl to true has no effect.
             */
            validateSsl?: pulumi.Input<boolean>;
        }
        /**
         * An internal checker allows Uptime checks to run on private/internal GCP resources.
         */
        interface InternalChecker {
            /**
             * The checker's human-readable name. The display name should be unique within a Stackdriver Workspace in order to make it easier to identify; however, uniqueness is not enforced.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The GCP zone the Uptime check should egress from. Only respected for internal Uptime checks, where internal_network is specified.
             */
            gcpZone?: pulumi.Input<string>;
            /**
             * A unique resource name for this InternalChecker. The format is: projects/[PROJECT_ID_OR_NUMBER]/internalCheckers/[INTERNAL_CHECKER_ID] [PROJECT_ID_OR_NUMBER] is the Stackdriver Workspace project for the Uptime check config associated with the internal checker.
             */
            name?: pulumi.Input<string>;
            /**
             * The GCP VPC network (https://cloud.google.com/vpc/docs/vpc) where the internal resource lives (ex: "default").
             */
            network?: pulumi.Input<string>;
            /**
             * The GCP project ID where the internal checker lives. Not necessary the same as the Workspace project.
             */
            peerProjectId?: pulumi.Input<string>;
            /**
             * The current operational state of the internal checker.
             */
            state?: pulumi.Input<string>;
        }
        /**
         * Canonical service scoped to an Istio mesh. Anthos clusters running ASM >= 1.6.8 will have their services ingested as this type.
         */
        interface IstioCanonicalService {
            /**
             * The name of the canonical service underlying this service. Corresponds to the destination_canonical_service_name metric label in label in Istio metrics (https://cloud.google.com/monitoring/api/metrics_istio).
             */
            canonicalService?: pulumi.Input<string>;
            /**
             * The namespace of the canonical service underlying this service. Corresponds to the destination_canonical_service_namespace metric label in Istio metrics (https://cloud.google.com/monitoring/api/metrics_istio).
             */
            canonicalServiceNamespace?: pulumi.Input<string>;
            /**
             * Identifier for the Istio mesh in which this canonical service is defined. Corresponds to the mesh_uid metric label in Istio metrics (https://cloud.google.com/monitoring/api/metrics_istio).
             */
            meshUid?: pulumi.Input<string>;
        }
        /**
         * A description of a label.
         */
        interface LabelDescriptor {
            /**
             * A human-readable description for the label.
             */
            description?: pulumi.Input<string>;
            /**
             * The key for this label. The key must meet the following criteria: Does not exceed 100 characters. Matches the following regular expression: [a-zA-Z][a-zA-Z0-9_]* The first character must be an upper- or lower-case letter. The remaining characters must be letters, digits, or underscores.
             */
            key?: pulumi.Input<string>;
            /**
             * The type of data that can be assigned to the label.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * Parameters for a latency threshold SLI.
         */
        interface LatencyCriteria {
            /**
             * Good service is defined to be the count of requests made to this service that return in no more than threshold.
             */
            threshold?: pulumi.Input<string>;
        }
        /**
         * Specifies a linear sequence of buckets that all have the same width (except overflow and underflow). Each bucket represents a constant absolute uncertainty on the specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 <= i < N-1): offset + (width * i). Lower bound (1 <= i < N): offset + (width * (i - 1)).
         */
        interface Linear {
            /**
             * Must be greater than 0.
             */
            numFiniteBuckets?: pulumi.Input<number>;
            /**
             * Lower bound of the first bucket.
             */
            offset?: pulumi.Input<number>;
            /**
             * Must be greater than 0.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * Istio service scoped to an Istio mesh. Anthos clusters running ASM < 1.6.8 will have their services ingested as this type.
         */
        interface MeshIstio {
            /**
             * Identifier for the mesh in which this Istio service is defined. Corresponds to the mesh_uid metric label in Istio metrics.
             */
            meshUid?: pulumi.Input<string>;
            /**
             * The name of the Istio service underlying this service. Corresponds to the destination_service_name metric label in Istio metrics.
             */
            serviceName?: pulumi.Input<string>;
            /**
             * The namespace of the Istio service underlying this service. Corresponds to the destination_service_namespace metric label in Istio metrics.
             */
            serviceNamespace?: pulumi.Input<string>;
        }
        /**
         * A specific metric, identified by specifying values for all of the labels of a MetricDescriptor.
         */
        interface Metric {
            /**
             * The set of label values that uniquely identify this metric. All labels listed in the MetricDescriptor must be assigned values.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * An existing metric type, see google.api.MetricDescriptor. For example, custom.googleapis.com/invoice/paid/amount.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A condition type that checks that monitored resources are reporting data. The configuration defines a metric and a set of monitored resources. The predicate is considered in violation when a time series for the specified metric of a monitored resource does not include any data in the specified duration.
         */
        interface MetricAbsence {
            /**
             * Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resrouces). Multiple aggregations are applied in the order specified.This field is similar to the one in the ListTimeSeries request (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list). It is advisable to use the ListTimeSeries method when debugging this field.
             */
            aggregations?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.Aggregation>[]>;
            /**
             * The amount of time that a time series must fail to report new data to be considered failing. The minimum value of this field is 120 seconds. Larger values that are a multiple of a minute--for example, 240 or 300 seconds--are supported. If an invalid value is given, an error will be returned. The Duration.nanos field is ignored.
             */
            duration?: pulumi.Input<string>;
            /**
             * Required. A filter (https://cloud.google.com/monitoring/api/v3/filters) that identifies which time series should be compared with the threshold.The filter is similar to the one that is specified in the ListTimeSeries request (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list) (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.
             */
            filter?: pulumi.Input<string>;
            /**
             * The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations.
             */
            trigger?: pulumi.Input<inputs.monitoring.v3.Trigger>;
        }
        /**
         * Additional annotations that can be used to guide the usage of a metric.
         */
        interface MetricDescriptorMetadata {
            /**
             * The delay of data points caused by ingestion. Data points older than this age are guaranteed to be ingested and available to be read, excluding data loss due to errors.
             */
            ingestDelay?: pulumi.Input<string>;
            /**
             * The sampling period of metric data points. For metrics which are written periodically, consecutive data points are stored at this time interval, excluding data loss due to errors. Metrics with a higher granularity have a smaller sampling period.
             */
            samplePeriod?: pulumi.Input<string>;
        }
        /**
         * A MetricRange is used when each window is good when the value x of a single TimeSeries satisfies range.min <= x < range.max. The provided TimeSeries must have ValueType = INT64 or ValueType = DOUBLE and MetricKind = GAUGE.
         */
        interface MetricRange {
            /**
             * Range of values considered "good." For a one-sided range, set one bound to an infinite value.
             */
            range?: pulumi.Input<inputs.monitoring.v3.GoogleMonitoringV3Range>;
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying the TimeSeries to use for evaluating window quality.
             */
            timeSeries?: pulumi.Input<string>;
        }
        /**
         * A condition type that compares a collection of time series against a threshold.
         */
        interface MetricThreshold {
            /**
             * Specifies the alignment of data points in individual time series as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resrouces). Multiple aggregations are applied in the order specified.This field is similar to the one in the ListTimeSeries request (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list). It is advisable to use the ListTimeSeries method when debugging this field.
             */
            aggregations?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.Aggregation>[]>;
            /**
             * The comparison to apply between the time series (indicated by filter and aggregation) and the threshold (indicated by threshold_value). The comparison is applied on each time series, with the time series on the left-hand side and the threshold on the right-hand side.Only COMPARISON_LT and COMPARISON_GT are supported currently.
             */
            comparison?: pulumi.Input<string>;
            /**
             * Specifies the alignment of data points in individual time series selected by denominatorFilter as well as how to combine the retrieved time series together (such as when aggregating multiple streams on each resource to a single stream for each resource or when aggregating streams across all members of a group of resources).When computing ratios, the aggregations and denominator_aggregations fields must use the same alignment period and produce time series that have the same periodicity and labels.
             */
            denominatorAggregations?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.Aggregation>[]>;
            /**
             * A filter (https://cloud.google.com/monitoring/api/v3/filters) that identifies a time series that should be used as the denominator of a ratio that will be compared with the threshold. If a denominator_filter is specified, the time series specified by the filter field will be used as the numerator.The filter must specify the metric type and optionally may contain restrictions on resource type, resource labels, and metric labels. This field may not exceed 2048 Unicode characters in length.
             */
            denominatorFilter?: pulumi.Input<string>;
            /**
             * The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in the aggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly.
             */
            duration?: pulumi.Input<string>;
            /**
             * Required. A filter (https://cloud.google.com/monitoring/api/v3/filters) that identifies which time series should be compared with the threshold.The filter is similar to the one that is specified in the ListTimeSeries request (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list) (that call is useful to verify the time series that will be retrieved / processed). The filter must specify the metric type and the resource type. Optionally, it can specify resource labels and metric labels. This field must not exceed 2048 Unicode characters in length.
             */
            filter?: pulumi.Input<string>;
            /**
             * A value against which to compare the time series.
             */
            thresholdValue?: pulumi.Input<number>;
            /**
             * The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations, or by the ratio, if denominator_filter and denominator_aggregations are specified.
             */
            trigger?: pulumi.Input<inputs.monitoring.v3.Trigger>;
        }
        /**
         * An object representing a resource that can be used for monitoring, logging, billing, or other purposes. Examples include virtual machine instances, databases, and storage devices such as disks. The type field identifies a MonitoredResourceDescriptor object that describes the resource's schema. Information in the labels field identifies the actual resource and its attributes according to the schema. For example, a particular Compute Engine VM instance could be represented by the following object, because the MonitoredResourceDescriptor for "gce_instance" has labels "instance_id" and "zone": { "type": "gce_instance", "labels": { "instance_id": "12345678901234", "zone": "us-central1-a" }}
         */
        interface MonitoredResource {
            /**
             * Required. Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Required. The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types and Logging resource types.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Auxiliary metadata for a MonitoredResource object. MonitoredResource objects contain the minimum set of information to uniquely identify a monitored resource instance. There is some other useful auxiliary metadata. Monitoring and Logging use an ingestion pipeline to extract metadata for cloud resources of all types, and store the metadata in this message.
         */
        interface MonitoredResourceMetadata {
            /**
             * Values for predefined system metadata labels. System labels are a kind of metadata extracted by Google, including "machine_image", "vpc", "subnet_id", "security_group", "name", etc. System label values can be only strings, Boolean values, or a list of strings. For example: { "name": "my-test-instance", "security_group": ["a", "b", "c"], "spot_instance": false }
             */
            systemLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * A map of user-defined metadata labels.
             */
            userLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A condition type that allows alert policies to be defined using Monitoring Query Language (https://cloud.google.com/monitoring/mql).
         */
        interface MonitoringQueryLanguageCondition {
            /**
             * The amount of time that a time series must violate the threshold to be considered failing. Currently, only values that are a multiple of a minute--e.g., 0, 60, 120, or 300 seconds--are supported. If an invalid value is given, an error will be returned. When choosing a duration, it is useful to keep in mind the frequency of the underlying time series data (which may also be affected by any alignments specified in the aggregations field); a good duration is long enough so that a single outlier does not generate spurious alerts, but short enough that unhealthy states are detected and alerted on quickly.
             */
            duration?: pulumi.Input<string>;
            /**
             * Monitoring Query Language (https://cloud.google.com/monitoring/mql) query that outputs a boolean stream.
             */
            query?: pulumi.Input<string>;
            /**
             * The number/percent of time series for which the comparison must hold in order for the condition to trigger. If unspecified, then the condition will trigger if the comparison is true for any of the time series that have been identified by filter and aggregations, or by the ratio, if denominator_filter and denominator_aggregations are specified.
             */
            trigger?: pulumi.Input<inputs.monitoring.v3.Trigger>;
        }
        /**
         * Describes a change made to a configuration.
         */
        interface MutationRecord {
            /**
             * When the change occurred.
             */
            mutateTime?: pulumi.Input<string>;
            /**
             * The email address of the user making the change.
             */
            mutatedBy?: pulumi.Input<string>;
        }
        /**
         * A PerformanceThreshold is used when each window is good when that window has a sufficiently high performance.
         */
        interface PerformanceThreshold {
            /**
             * BasicSli to evaluate to judge window quality.
             */
            basicSliPerformance?: pulumi.Input<inputs.monitoring.v3.BasicSli>;
            /**
             * RequestBasedSli to evaluate to judge window quality.
             */
            performance?: pulumi.Input<inputs.monitoring.v3.RequestBasedSli>;
            /**
             * If window performance >= threshold, the window is counted as good.
             */
            threshold?: pulumi.Input<number>;
        }
        /**
         * A single data point in a time series.
         */
        interface Point {
            /**
             * The time interval to which the data point applies. For GAUGE metrics, the start time is optional, but if it is supplied, it must equal the end time. For DELTA metrics, the start and end time should specify a non-zero interval, with subsequent points specifying contiguous and non-overlapping intervals. For CUMULATIVE metrics, the start and end time should specify a non-zero interval, with subsequent points specifying the same start time and increasing end times, until an event resets the cumulative value to zero and sets a new start time for the following points.
             */
            interval?: pulumi.Input<inputs.monitoring.v3.TimeInterval>;
            /**
             * The value of the data point.
             */
            value?: pulumi.Input<inputs.monitoring.v3.TypedValue>;
        }
        /**
         * The range of the population values.
         */
        interface Range {
            /**
             * The maximum of the population values.
             */
            max?: pulumi.Input<number>;
            /**
             * The minimum of the population values.
             */
            min?: pulumi.Input<number>;
        }
        /**
         * Service Level Indicators for which atomic units of service are counted directly.
         */
        interface RequestBasedSli {
            /**
             * distribution_cut is used when good_service is a count of values aggregated in a Distribution that fall into a good range. The total_service is the total count of all values aggregated in the Distribution.
             */
            distributionCut?: pulumi.Input<inputs.monitoring.v3.DistributionCut>;
            /**
             * good_total_ratio is used when the ratio of good_service to total_service is computed from two TimeSeries.
             */
            goodTotalRatio?: pulumi.Input<inputs.monitoring.v3.TimeSeriesRatio>;
        }
        /**
         * The resource submessage for group checks. It can be used instead of a monitored resource, when multiple resources are being monitored.
         */
        interface ResourceGroup {
            /**
             * The group of resources being monitored. Should be only the [GROUP_ID], and not the full-path projects/[PROJECT_ID_OR_NUMBER]/groups/[GROUP_ID].
             */
            groupId?: pulumi.Input<string>;
            /**
             * The resource type of the group members.
             */
            resourceType?: pulumi.Input<string>;
        }
        /**
         * A Service-Level Indicator (SLI) describes the "performance" of a service. For some services, the SLI is well-defined. In such cases, the SLI can be described easily by referencing the well-known SLI and providing the needed parameters. Alternatively, a "custom" SLI can be defined with a query to the underlying metric store. An SLI is defined to be good_service / total_service over any queried time interval. The value of performance always falls into the range 0 <= performance <= 1. A custom SLI describes how to compute this ratio, whether this is by dividing values from a pair of time series, cutting a Distribution into good and bad counts, or counting time windows in which the service complies with a criterion. For separation of concerns, a single Service-Level Indicator measures performance for only one aspect of service quality, such as fraction of successful queries or fast-enough queries.
         */
        interface ServiceLevelIndicator {
            /**
             * Basic SLI on a well-known service type.
             */
            basicSli?: pulumi.Input<inputs.monitoring.v3.BasicSli>;
            /**
             * Request-based SLIs
             */
            requestBased?: pulumi.Input<inputs.monitoring.v3.RequestBasedSli>;
            /**
             * Windows-based SLIs
             */
            windowsBased?: pulumi.Input<inputs.monitoring.v3.WindowsBasedSli>;
        }
        /**
         * The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC (https://github.com/grpc). Each Status message contains three pieces of data: error code, error message, and error details.You can find out more about this error model and how to work with it in the API Design Guide (https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Information required for a TCP Uptime check request.
         */
        interface TcpCheck {
            /**
             * The TCP port on the server against which to run the check. Will be combined with host (specified within the monitored_resource) to construct the full URL. Required.
             */
            port?: pulumi.Input<number>;
        }
        /**
         * Configuration for how to query telemetry on a Service.
         */
        interface Telemetry {
            /**
             * The full name of the resource that defines this service. Formatted as described in https://cloud.google.com/apis/design/resource_names.
             */
            resourceName?: pulumi.Input<string>;
        }
        /**
         * A closed time interval. It extends from the start time to the end time, and includes both: [startTime, endTime]. Valid time intervals depend on the MetricKind of the metric value. The end time must not be earlier than the start time. When writing data points, the start time must not be more than 25 hours in the past and the end time must not be more than five minutes in the future. For GAUGE metrics, the startTime value is technically optional; if no value is specified, the start time defaults to the value of the end time, and the interval represents a single point in time. If both start and end times are specified, they must be identical. Such an interval is valid only for GAUGE metrics, which are point-in-time measurements. The end time of a new interval must be at least a millisecond after the end time of the previous interval. For DELTA metrics, the start time and end time must specify a non-zero interval, with subsequent points specifying contiguous and non-overlapping intervals. For DELTA metrics, the start time of the next interval must be at least a millisecond after the end time of the previous interval. For CUMULATIVE metrics, the start time and end time must specify a a non-zero interval, with subsequent points specifying the same start time and increasing end times, until an event resets the cumulative value to zero and sets a new start time for the following points. The new start time must be at least a millisecond after the end time of the previous interval. The start time of a new interval must be at least a millisecond after the end time of the previous interval because intervals are closed. If the start time of a new interval is the same as the end time of the previous interval, then data written at the new start time could overwrite data written at the previous end time.
         */
        interface TimeInterval {
            /**
             * Required. The end of the time interval.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Optional. The beginning of the time interval. The default value for the start time is the end time. The start time must not be later than the end time.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * A collection of data points that describes the time-varying values of a metric. A time series is identified by a combination of a fully-specified monitored resource and a fully-specified metric. This type is used for both listing and creating time series.
         */
        interface TimeSeries {
            /**
             * The associated monitored resource metadata. When reading a time series, this field will include metadata labels that are explicitly named in the reduction. When creating a time series, this field is ignored.
             */
            metadata?: pulumi.Input<inputs.monitoring.v3.MonitoredResourceMetadata>;
            /**
             * The associated metric. A fully-specified metric used to identify the time series.
             */
            metric?: pulumi.Input<inputs.monitoring.v3.Metric>;
            /**
             * The metric kind of the time series. When listing time series, this metric kind might be different from the metric kind of the associated metric if this time series is an alignment or reduction of other time series.When creating a time series, this field is optional. If present, it must be the same as the metric kind of the associated metric. If the associated metric's descriptor must be auto-created, then this field specifies the metric kind of the new descriptor and must be either GAUGE (the default) or CUMULATIVE.
             */
            metricKind?: pulumi.Input<string>;
            /**
             * The data points of this time series. When listing time series, points are returned in reverse time order.When creating a time series, this field must contain exactly one point and the point's type must be the same as the value type of the associated metric. If the associated metric's descriptor must be auto-created, then the value type of the descriptor is determined by the point's type, which must be BOOL, INT64, DOUBLE, or DISTRIBUTION.
             */
            points?: pulumi.Input<pulumi.Input<inputs.monitoring.v3.Point>[]>;
            /**
             * The associated monitored resource. Custom metrics can use only certain monitored resource types in their time series data. For more information, see Monitored resources for custom metrics (https://cloud.google.com/monitoring/custom-metrics/creating-metrics#custom-metric-resources).
             */
            resource?: pulumi.Input<inputs.monitoring.v3.MonitoredResource>;
            /**
             * The units in which the metric value is reported. It is only applicable if the value_type is INT64, DOUBLE, or DISTRIBUTION. The unit defines the representation of the stored metric values.
             */
            unit?: pulumi.Input<string>;
            /**
             * The value type of the time series. When listing time series, this value type might be different from the value type of the associated metric if this time series is an alignment or reduction of other time series.When creating a time series, this field is optional. If present, it must be the same as the type of the data in the points field.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * A TimeSeriesRatio specifies two TimeSeries to use for computing the good_service / total_service ratio. The specified TimeSeries must have ValueType = DOUBLE or ValueType = INT64 and must have MetricKind = DELTA or MetricKind = CUMULATIVE. The TimeSeriesRatio must specify exactly two of good, bad, and total, and the relationship good_service + bad_service = total_service will be assumed.
         */
        interface TimeSeriesRatio {
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying a TimeSeries quantifying bad service, either demanded service that was not provided or demanded service that was of inadequate quality. Must have ValueType = DOUBLE or ValueType = INT64 and must have MetricKind = DELTA or MetricKind = CUMULATIVE.
             */
            badServiceFilter?: pulumi.Input<string>;
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying a TimeSeries quantifying good service provided. Must have ValueType = DOUBLE or ValueType = INT64 and must have MetricKind = DELTA or MetricKind = CUMULATIVE.
             */
            goodServiceFilter?: pulumi.Input<string>;
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying a TimeSeries quantifying total demanded service. Must have ValueType = DOUBLE or ValueType = INT64 and must have MetricKind = DELTA or MetricKind = CUMULATIVE.
             */
            totalServiceFilter?: pulumi.Input<string>;
        }
        /**
         * Specifies how many time series must fail a predicate to trigger a condition. If not specified, then a {count: 1} trigger is used.
         */
        interface Trigger {
            /**
             * The absolute number of time series that must fail the predicate for the condition to be triggered.
             */
            count?: pulumi.Input<number>;
            /**
             * The percentage of time series that must fail the predicate for the condition to be triggered.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * A single strongly-typed value.
         */
        interface TypedValue {
            /**
             * A Boolean value: true or false.
             */
            boolValue?: pulumi.Input<boolean>;
            /**
             * A distribution value.
             */
            distributionValue?: pulumi.Input<inputs.monitoring.v3.Distribution>;
            /**
             * A 64-bit double-precision floating-point number. Its magnitude is approximately ±10±300 and it has 16 significant digits of precision.
             */
            doubleValue?: pulumi.Input<number>;
            /**
             * A 64-bit integer. Its range is approximately ±9.2x1018.
             */
            int64Value?: pulumi.Input<string>;
            /**
             * A variable-length string value.
             */
            stringValue?: pulumi.Input<string>;
        }
        /**
         * A WindowsBasedSli defines good_service as the count of time windows for which the provided service was of good quality. Criteria for determining if service was good are embedded in the window_criterion.
         */
        interface WindowsBasedSli {
            /**
             * A monitoring filter (https://cloud.google.com/monitoring/api/v3/filters) specifying a TimeSeries with ValueType = BOOL. The window is good if any true values appear in the window.
             */
            goodBadMetricFilter?: pulumi.Input<string>;
            /**
             * A window is good if its performance is high enough.
             */
            goodTotalRatioThreshold?: pulumi.Input<inputs.monitoring.v3.PerformanceThreshold>;
            /**
             * A window is good if the metric's value is in a good range, averaged across returned streams.
             */
            metricMeanInRange?: pulumi.Input<inputs.monitoring.v3.MetricRange>;
            /**
             * A window is good if the metric's value is in a good range, summed across returned streams.
             */
            metricSumInRange?: pulumi.Input<inputs.monitoring.v3.MetricRange>;
            /**
             * Duration over which window quality is evaluated. Must be an integer fraction of a day and at least 60s.
             */
            windowPeriod?: pulumi.Input<string>;
        }
    }
}
export declare namespace networkconnectivity {
    namespace v1alpha1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.networkconnectivity.v1alpha1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.networkconnectivity.v1alpha1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * RouterAppliance represents a Router appliance which is specified by a VM URI and a NIC address.
         */
        interface RouterApplianceInstance {
            /**
             * The IP address of the network interface to use for peering.
             */
            ipAddress?: pulumi.Input<string>;
            networkInterface?: pulumi.Input<string>;
            /**
             * The URI of the virtual machine resource
             */
            virtualMachine?: pulumi.Input<string>;
        }
    }
}
export declare namespace networkmanagement {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.networkmanagement.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.networkmanagement.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Source or destination of the Connectivity Test.
         */
        interface Endpoint {
            /**
             * A Compute Engine instance URI.
             */
            instance?: pulumi.Input<string>;
            /**
             * The IP address of the endpoint, which can be an external or internal IP. An IPv6 address is only allowed when the test's destination is a [global load balancer VIP](/load-balancing/docs/load-balancing-overview).
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * A Compute Engine network URI.
             */
            network?: pulumi.Input<string>;
            /**
             * Type of the network where the endpoint is located. Applicable only to source endpoint, as destination network type can be inferred from the source.
             */
            networkType?: pulumi.Input<string>;
            /**
             * The IP protocol port of the endpoint. Only applicable when protocol is TCP or UDP.
             */
            port?: pulumi.Input<number>;
            /**
             * Project ID where the endpoint is located. The Project ID can be derived from the URI if you provide a VM instance or network URI. The following are two cases where you must provide the project ID: 1. Only the IP address is specified, and the IP address is within a GCP project. 2. When you are using Shared VPC and the IP address that you provide is from the service project. In this case, the network that the IP address resides in is defined in the host project.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.networkmanagement.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.networkmanagement.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Source or destination of the Connectivity Test.
         */
        interface Endpoint {
            /**
             * A [Cloud SQL](https://cloud.google.com/sql) instance URI.
             */
            cloudSqlInstance?: pulumi.Input<string>;
            /**
             * A cluster URI for [Google Kubernetes Engine master](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture).
             */
            gkeMasterCluster?: pulumi.Input<string>;
            /**
             * A Compute Engine instance URI.
             */
            instance?: pulumi.Input<string>;
            /**
             * The IP address of the endpoint, which can be an external or internal IP. An IPv6 address is only allowed when the test's destination is a [global load balancer VIP](https://cloud.google.com/load-balancing/docs/load-balancing-overview).
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * A Compute Engine network URI.
             */
            network?: pulumi.Input<string>;
            /**
             * Type of the network where the endpoint is located. Applicable only to source endpoint, as destination network type can be inferred from the source.
             */
            networkType?: pulumi.Input<string>;
            /**
             * The IP protocol port of the endpoint. Only applicable when protocol is TCP or UDP.
             */
            port?: pulumi.Input<number>;
            /**
             * Project ID where the endpoint is located. The Project ID can be derived from the URI if you provide a VM instance or network URI. The following are two cases where you must provide the project ID: 1. Only the IP address is specified, and the IP address is within a GCP project. 2. When you are using Shared VPC and the IP address that you provide is from the service project. In this case, the network that the IP address resides in is defined in the host project.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace notebooks {
    namespace v1 {
        /**
         * Definition of a hardware accelerator. Note that not all combinations of `type` and `core_count` are valid. Check [GPUs on Compute Engine](/compute/docs/gpus/#gpus-list) to find a valid combination. TPUs are not supported.
         */
        interface AcceleratorConfig {
            /**
             * Count of cores of this accelerator.
             */
            coreCount?: pulumi.Input<string>;
            /**
             * Type of this accelerator.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.notebooks.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Definition of a container image for starting a notebook instance with the environment installed in a container.
         */
        interface ContainerImage {
            /**
             * Required. The path to the container image repository. For example: `gcr.io/{project_id}/{image_name}`
             */
            repository?: pulumi.Input<string>;
            /**
             * The tag of the container image. If not specified, this defaults to the latest tag.
             */
            tag?: pulumi.Input<string>;
        }
        /**
         * Represents a custom encryption key configuration that can be applied to a resource. This will encrypt all disks in Virtual Machine.
         */
        interface EncryptionConfig {
            /**
             * The Cloud KMS resource identifier of the customer-managed encryption key used to protect a resource, such as a disks. It has the following format: `projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RING_NAME}/cryptoKeys/{KEY_NAME}`
             */
            kmsKey?: pulumi.Input<string>;
        }
        /**
         * The description a notebook execution workload.
         */
        interface ExecutionTemplate {
            /**
             * Configuration (count and accelerator type) for hardware running notebook execution.
             */
            acceleratorConfig?: pulumi.Input<inputs.notebooks.v1.SchedulerAcceleratorConfig>;
            /**
             * Container Image URI to a DLVM Example: 'gcr.io/deeplearning-platform-release/base-cu100' More examples can be found at: https://cloud.google.com/ai-platform/deep-learning-containers/docs/choosing-container
             */
            containerImageUri?: pulumi.Input<string>;
            /**
             * Path to the notebook file to execute. Must be in a Google Cloud Storage bucket. Format: gs://{project_id}/{folder}/{notebook_file_name} Ex: gs://notebook_user/scheduled_notebooks/sentiment_notebook.ipynb
             */
            inputNotebookFile?: pulumi.Input<string>;
            /**
             * Labels for execution. If execution is scheduled, a field included will be 'nbs-scheduled'. Otherwise, it is an immediate execution, and an included field will be 'nbs-immediate'. Use fields to efficiently index between various types of executions.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Specifies the type of virtual machine to use for your training job's master worker. You must specify this field when `scaleTier` is set to `CUSTOM`. You can use certain Compute Engine machine types directly in this field. The following types are supported: - `n1-standard-4` - `n1-standard-8` - `n1-standard-16` - `n1-standard-32` - `n1-standard-64` - `n1-standard-96` - `n1-highmem-2` - `n1-highmem-4` - `n1-highmem-8` - `n1-highmem-16` - `n1-highmem-32` - `n1-highmem-64` - `n1-highmem-96` - `n1-highcpu-16` - `n1-highcpu-32` - `n1-highcpu-64` - `n1-highcpu-96` Alternatively, you can use the following legacy machine types: - `standard` - `large_model` - `complex_model_s` - `complex_model_m` - `complex_model_l` - `standard_gpu` - `complex_model_m_gpu` - `complex_model_l_gpu` - `standard_p100` - `complex_model_m_p100` - `standard_v100` - `large_model_v100` - `complex_model_m_v100` - `complex_model_l_v100` Finally, if you want to use a TPU for training, specify `cloud_tpu` in this field. Learn more about the [special configuration options for training with TPU.
             */
            masterType?: pulumi.Input<string>;
            /**
             * Path to the notebook folder to write to. Must be in a Google Cloud Storage bucket path. Format: gs://{project_id}/{folder} Ex: gs://notebook_user/scheduled_notebooks
             */
            outputNotebookFolder?: pulumi.Input<string>;
            /**
             * Parameters used within the 'input_notebook_file' notebook.
             */
            parameters?: pulumi.Input<string>;
            /**
             * Parameters to be overridden in the notebook during execution. Ref https://papermill.readthedocs.io/en/latest/usage-parameterize.html on how to specifying parameters in the input notebook and pass them here in an YAML file. Ex: gs://notebook_user/scheduled_notebooks/sentiment_notebook_params.yaml
             */
            paramsYamlFile?: pulumi.Input<string>;
            /**
             * Required. Scale tier of the hardware used for notebook execution.
             */
            scaleTier?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * An Local attached disk resource.
         */
        interface LocalDisk {
            /**
             * Input only. [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance. This property is mutually exclusive with the source property; you can only define one or the other, but not both.
             */
            initializeParams?: pulumi.Input<inputs.notebooks.v1.LocalDiskInitializeParams>;
            /**
             * Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI. Persistent disks must always use SCSI and the request will fail if you attempt to attach a persistent disk in any other format than SCSI. Local SSDs can use either NVME or SCSI. For performance characteristics of SCSI over NVMe, see Local SSD performance. Valid values: NVME SCSI
             */
            interface?: pulumi.Input<string>;
            /**
             * The mode in which to attach this disk, either READ_WRITE or READ_ONLY. If not specified, the default is to attach the disk in READ_WRITE mode. Valid values: READ_ONLY READ_WRITE
             */
            mode?: pulumi.Input<string>;
            /**
             * Specifies a valid partial or full URL to an existing Persistent Disk resource.
             */
            source?: pulumi.Input<string>;
            /**
             * Specifies the type of the disk, either SCRATCH or PERSISTENT. If not specified, the default is PERSISTENT. Valid values: PERSISTENT SCRATCH
             */
            type?: pulumi.Input<string>;
        }
        /**
         * [Input Only] Specifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new runtime. This property is mutually exclusive with the source property; you can only define one or the other, but not both.
         */
        interface LocalDiskInitializeParams {
            /**
             * Optional. Provide this property when creating the disk.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. Specifies the disk name. If not specified, the default is to use the name of the instance. If the disk with the instance name exists already in the given zone/region, a new name will be automatically generated.
             */
            diskName?: pulumi.Input<string>;
            /**
             * Optional. Specifies the size of the disk in base-2 GB. If not specified, the disk will be the same size as the image (usually 10GB). If specified, the size must be equal to or larger than 10GB. Default 100 GB.
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Input only. The type of the boot disk attached to this instance, defaults to standard persistent disk (`PD_STANDARD`).
             */
            diskType?: pulumi.Input<string>;
            /**
             * Optional. Labels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Definition of the types of hardware accelerators that can be used. Definition of the types of hardware accelerators that can be used. See [Compute Engine AcceleratorTypes](https://cloud.google.com/compute/docs/reference/beta/acceleratorTypes). Examples: * `nvidia-tesla-k80` * `nvidia-tesla-p100` * `nvidia-tesla-v100` * `nvidia-tesla-p4` * `nvidia-tesla-t4` * `nvidia-tesla-a100`
         */
        interface RuntimeAcceleratorConfig {
            /**
             * Count of cores of this accelerator.
             */
            coreCount?: pulumi.Input<string>;
            /**
             * Accelerator model.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Specifies the login configuration for Runtime
         */
        interface RuntimeAccessConfig {
            /**
             * The type of access mode this instance.
             */
            accessType?: pulumi.Input<string>;
            /**
             * The owner of this runtime after creation. Format: `alias@example.com` Currently supports one owner only.
             */
            runtimeOwner?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options. Check [Images using supported Shielded VM features] Not all combinations are valid.
         */
        interface RuntimeShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. Enabled by default.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. Disabled by default.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled. Enabled by default.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * Specifies the selection and config of software inside the runtime. / The properties to set on runtime. Properties keys are specified in `key:value` format, for example: * idle_shutdown: idle_shutdown=true * idle_shutdown_timeout: idle_shutdown_timeout=180 * report-system-health: report-system-health=true
         */
        interface RuntimeSoftwareConfig {
            /**
             * Specify a custom Cloud Storage path where the GPU driver is stored. If not specified, we'll automatically choose from official GPU drivers.
             */
            customGpuDriverPath?: pulumi.Input<string>;
            /**
             * Verifies core internal services are running. Default: True
             */
            enableHealthMonitoring?: pulumi.Input<boolean>;
            /**
             * Runtime will automatically shutdown after idle_shutdown_time. Default: False
             */
            idleShutdown?: pulumi.Input<boolean>;
            /**
             * Time in minutes to wait before shuting down runtime. Default: 90 minutes
             */
            idleShutdownTimeout?: pulumi.Input<number>;
            /**
             * Install Nvidia Driver automatically.
             */
            installGpuDriver?: pulumi.Input<boolean>;
            /**
             * Cron expression in UTC timezone, used to schedule instance auto upgrade. Please follow the [cron format](https://en.wikipedia.org/wiki/Cron).
             */
            notebookUpgradeSchedule?: pulumi.Input<string>;
            /**
             * Path to a Bash script that automatically runs after a notebook instance fully boots up. The path must be a URL or Cloud Storage path (gs://path-to-file/file-name).
             */
            postStartupScript?: pulumi.Input<string>;
        }
        /**
         * Definition of a hardware accelerator. Note that not all combinations of `type` and `core_count` are valid. Check GPUs on Compute Engine to find a valid combination. TPUs are not supported.
         */
        interface SchedulerAcceleratorConfig {
            /**
             * Count of cores of this accelerator.
             */
            coreCount?: pulumi.Input<string>;
            /**
             * Type of this accelerator.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A set of Shielded Instance options. Check [Images using supported Shielded VM features] Not all combinations are valid.
         */
        interface ShieldedInstanceConfig {
            /**
             * Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. Enabled by default.
             */
            enableIntegrityMonitoring?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. Disabled by default.
             */
            enableSecureBoot?: pulumi.Input<boolean>;
            /**
             * Defines whether the instance has the vTPM enabled. Enabled by default.
             */
            enableVtpm?: pulumi.Input<boolean>;
        }
        /**
         * The entry of VM image upgrade history.
         */
        interface UpgradeHistoryEntry {
            /**
             * Action. Rolloback or Upgrade.
             */
            action?: pulumi.Input<string>;
            /**
             * The container image before this instance upgrade.
             */
            containerImage?: pulumi.Input<string>;
            /**
             * The time that this instance upgrade history entry is created.
             */
            createTime?: pulumi.Input<string>;
            /**
             * The framework of this notebook instance.
             */
            framework?: pulumi.Input<string>;
            /**
             * The snapshot of the boot disk of this notebook instance before upgrade.
             */
            snapshot?: pulumi.Input<string>;
            /**
             * The state of this instance upgrade history entry.
             */
            state?: pulumi.Input<string>;
            /**
             * Target VM Image. Format: ainotebooks-vm/project/image-name/name.
             */
            targetImage?: pulumi.Input<string>;
            /**
             * Target VM Version, like m63.
             */
            targetVersion?: pulumi.Input<string>;
            /**
             * The version of the notebook instance before this upgrade.
             */
            version?: pulumi.Input<string>;
            /**
             * The VM image before this instance upgrade.
             */
            vmImage?: pulumi.Input<string>;
        }
        /**
         * Runtime using Virtual Machine for computing.
         */
        interface VirtualMachine {
            /**
             * Virtual Machine configuration settings.
             */
            virtualMachineConfig?: pulumi.Input<inputs.notebooks.v1.VirtualMachineConfig>;
        }
        /**
         * The config settings for virtual machine.
         */
        interface VirtualMachineConfig {
            /**
             * Optional. The Compute Engine accelerator configuration for this runtime.
             */
            acceleratorConfig?: pulumi.Input<inputs.notebooks.v1.RuntimeAcceleratorConfig>;
            /**
             * Optional. Use a list of container images to start the notebook instance.
             */
            containerImages?: pulumi.Input<pulumi.Input<inputs.notebooks.v1.ContainerImage>[]>;
            /**
             * Required. Data disk option configuration settings.
             */
            dataDisk?: pulumi.Input<inputs.notebooks.v1.LocalDisk>;
            /**
             * Optional. Encryption settings for virtual machine data disk.
             */
            encryptionConfig?: pulumi.Input<inputs.notebooks.v1.EncryptionConfig>;
            /**
             * Optional. If true, runtime will only have internal IP addresses. By default, runtimes are not restricted to internal IP addresses, and will have ephemeral external IP addresses assigned to each vm. This `internal_ip_only` restriction can only be enabled for subnetwork enabled networks, and all dependencies must be configured to be accessible without external IP addresses.
             */
            internalIpOnly?: pulumi.Input<boolean>;
            /**
             * Optional. The labels to associate with this runtime. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a cluster.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Required. The Compute Engine machine type used for runtimes. Short name is valid. Examples: * `n1-standard-2` * `e2-standard-8`
             */
            machineType?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine metadata entries to add to virtual machine. (see [Project and instance metadata](https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
             */
            metadata?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork. If neither `network` nor `subnet` is specified, the "default" network of the project is used, if it exists. A full URL or partial URI. Examples: * `https://www.googleapis.com/compute/v1/projects/[project_id]/regions/global/default` * `projects/[project_id]/regions/global/default` Runtimes are managed resources inside Google Infrastructure. Runtimes support the following network configurations: * Google Managed Network (Network & subnet are empty) * Consumer Project VPC (network & subnet are required). Requires configuring Private Service Access. * Shared VPC (network & subnet are required). Requires configuring Private Service Access.
             */
            network?: pulumi.Input<string>;
            /**
             * Optional. Shielded VM Instance configuration settings.
             */
            shieldedInstanceConfig?: pulumi.Input<inputs.notebooks.v1.RuntimeShieldedInstanceConfig>;
            /**
             * Optional. The Compute Engine subnetwork to be used for machine communications. Cannot be specified with network. A full URL or partial URI are valid. Examples: * `https://www.googleapis.com/compute/v1/projects/[project_id]/regions/us-east1/subnetworks/sub0` * `projects/[project_id]/regions/us-east1/subnetworks/sub0`
             */
            subnet?: pulumi.Input<string>;
            /**
             * Optional. The Compute Engine tags to add to runtime (see [Tagging instances](https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
             */
            tags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Definition of a custom Compute Engine virtual machine image for starting a notebook instance with the environment installed directly on the VM.
         */
        interface VmImage {
            /**
             * Use this VM image family to find the image; the newest image in this family will be used.
             */
            imageFamily?: pulumi.Input<string>;
            /**
             * Use VM image name to find the image.
             */
            imageName?: pulumi.Input<string>;
            /**
             * Required. The name of the Google Cloud project that this VM image belongs to. Format: `projects/{project_id}`
             */
            project?: pulumi.Input<string>;
        }
    }
}
export declare namespace orgpolicy {
    namespace v2 {
        /**
         * Defines a Cloud Organization `PolicySpec` which is used to specify `Constraints` for configurations of Cloud Platform resources.
         */
        interface GoogleCloudOrgpolicyV2PolicySpec {
            /**
             * An opaque tag indicating the current version of the `Policy`, used for concurrency control. This field is ignored if used in a `CreatePolicy` request. When the `Policy` is returned from either a `GetPolicy` or a `ListPolicies` request, this `etag` indicates the version of the current `Policy` to use when executing a read-modify-write loop. When the `Policy` is returned from a `GetEffectivePolicy` request, the `etag` will be unset.
             */
            etag?: pulumi.Input<string>;
            /**
             * Determines the inheritance behavior for this `Policy`. If `inherit_from_parent` is true, PolicyRules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this Policy becomes the new root for evaluation. This field can be set only for Policies which configure list constraints.
             */
            inheritFromParent?: pulumi.Input<boolean>;
            /**
             * Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific `Constraint` at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
             */
            reset?: pulumi.Input<boolean>;
            /**
             * Up to 10 PolicyRules are allowed. In Policies for boolean constraints, the following requirements apply: - There must be one and only one PolicyRule where condition is unset. - BooleanPolicyRules with conditions must set `enforced` to the opposite of the PolicyRule without a condition. - During policy evaluation, PolicyRules with conditions that are true for a target resource take precedence.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.orgpolicy.v2.GoogleCloudOrgpolicyV2PolicySpecPolicyRule>[]>;
        }
        /**
         * A rule used to express this policy.
         */
        interface GoogleCloudOrgpolicyV2PolicySpecPolicyRule {
            /**
             * Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
             */
            allowAll?: pulumi.Input<boolean>;
            /**
             * A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
             */
            condition?: pulumi.Input<inputs.orgpolicy.v2.GoogleTypeExpr>;
            /**
             * Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
             */
            denyAll?: pulumi.Input<boolean>;
            /**
             * If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
             */
            enforce?: pulumi.Input<boolean>;
            /**
             * List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
             */
            values?: pulumi.Input<inputs.orgpolicy.v2.GoogleCloudOrgpolicyV2PolicySpecPolicyRuleStringValues>;
        }
        /**
         * A message that holds specific allowed and denied values. This message can define specific values and subtrees of Cloud Resource Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that are allowed or denied. This is achieved by using the `under:` and optional `is:` prefixes. The `under:` prefix is used to denote resource subtree values. The `is:` prefix is used to denote specific values, and is required only if the value contains a ":". Values prefixed with "is:" are treated the same as values with no prefix. Ancestry subtrees must be in one of the following formats: - "projects/", e.g. "projects/tokyo-rain-123" - "folders/", e.g. "folders/1234" - "organizations/", e.g. "organizations/1234" The `supports_under` field of the associated `Constraint` defines whether ancestry prefixes can be used.
         */
        interface GoogleCloudOrgpolicyV2PolicySpecPolicyRuleStringValues {
            /**
             * List of values allowed at this resource.
             */
            allowedValues?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of values denied at this resource.
             */
            deniedValues?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface GoogleTypeExpr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace osconfig {
    namespace v1 {
        /**
         * Apt patching is completed by executing `apt-get update && apt-get upgrade`. Additional options can be set to control how this is executed.
         */
        interface AptSettings {
            /**
             * List of packages to exclude from update. These packages will be excluded
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.
             */
            exclusivePackages?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * By changing the type to DIST, the patching is performed using `apt-get dist-upgrade` instead.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A step that runs an executable for a PatchJob.
         */
        interface ExecStep {
            /**
             * The ExecStepConfig for all Linux VMs targeted by the PatchJob.
             */
            linuxExecStepConfig?: pulumi.Input<inputs.osconfig.v1.ExecStepConfig>;
            /**
             * The ExecStepConfig for all Windows VMs targeted by the PatchJob.
             */
            windowsExecStepConfig?: pulumi.Input<inputs.osconfig.v1.ExecStepConfig>;
        }
        /**
         * Common configurations for an ExecStep.
         */
        interface ExecStepConfig {
            /**
             * Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
             */
            allowedSuccessCodes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * A Cloud Storage object containing the executable.
             */
            gcsObject?: pulumi.Input<inputs.osconfig.v1.GcsObject>;
            /**
             * The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with [shebang lines] (https://en.wikipedia.org/wiki/Shebang_\(Unix\)).
             */
            interpreter?: pulumi.Input<string>;
            /**
             * An absolute path to the executable on the VM.
             */
            localPath?: pulumi.Input<string>;
        }
        /**
         * Message encapsulating a value that can be either absolute ("fixed") or relative ("percent") to a value.
         */
        interface FixedOrPercent {
            /**
             * Specifies a fixed value.
             */
            fixed?: pulumi.Input<number>;
            /**
             * Specifies the relative value defined as a percentage, which will be multiplied by a reference value.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * Cloud Storage object representation.
         */
        interface GcsObject {
            /**
             * Required. Bucket of the Cloud Storage object.
             */
            bucket?: pulumi.Input<string>;
            /**
             * Required. Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.
             */
            generationNumber?: pulumi.Input<string>;
            /**
             * Required. Name of the Cloud Storage object.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * Googet patching is performed by running `googet update`.
         */
        interface GooSettings {
        }
        /**
         * Represents a monthly schedule. An example of a valid monthly schedule is "on the third Tuesday of the month" or "on the 15th of the month".
         */
        interface MonthlySchedule {
            /**
             * Required. One day of the month. 1-31 indicates the 1st to the 31st day. -1 indicates the last day of the month. Months without the target day will be skipped. For example, a schedule to run "every month on the 31st" will not run in February, April, June, etc.
             */
            monthDay?: pulumi.Input<number>;
            /**
             * Required. Week day in a month.
             */
            weekDayOfMonth?: pulumi.Input<inputs.osconfig.v1.WeekDayOfMonth>;
        }
        /**
         * Sets the time for a one time patch deployment. Timestamp is in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
         */
        interface OneTimeSchedule {
            /**
             * Required. The desired patch job execution time.
             */
            executeTime?: pulumi.Input<string>;
        }
        /**
         * Patch configuration specifications. Contains details on how to apply the patch(es) to a VM instance.
         */
        interface PatchConfig {
            /**
             * Apt update settings. Use this setting to override the default `apt` patch rules.
             */
            apt?: pulumi.Input<inputs.osconfig.v1.AptSettings>;
            /**
             * Goo update settings. Use this setting to override the default `goo` patch rules.
             */
            goo?: pulumi.Input<inputs.osconfig.v1.GooSettings>;
            /**
             * The `ExecStep` to run after the patch update.
             */
            postStep?: pulumi.Input<inputs.osconfig.v1.ExecStep>;
            /**
             * The `ExecStep` to run before the patch update.
             */
            preStep?: pulumi.Input<inputs.osconfig.v1.ExecStep>;
            /**
             * Post-patch reboot settings.
             */
            rebootConfig?: pulumi.Input<string>;
            /**
             * Windows update settings. Use this override the default windows patch rules.
             */
            windowsUpdate?: pulumi.Input<inputs.osconfig.v1.WindowsUpdateSettings>;
            /**
             * Yum update settings. Use this setting to override the default `yum` patch rules.
             */
            yum?: pulumi.Input<inputs.osconfig.v1.YumSettings>;
            /**
             * Zypper update settings. Use this setting to override the default `zypper` patch rules.
             */
            zypper?: pulumi.Input<inputs.osconfig.v1.ZypperSettings>;
        }
        /**
         * A filter to target VM instances for patching. The targeted VMs must meet all criteria specified. So if both labels and zones are specified, the patch job targets only VMs with those labels and in those zones.
         */
        interface PatchInstanceFilter {
            /**
             * Target all VM instances in the project. If true, no other criteria is permitted.
             */
            all?: pulumi.Input<boolean>;
            /**
             * Targets VM instances matching ANY of these GroupLabels. This allows targeting of disparate groups of VM instances.
             */
            groupLabels?: pulumi.Input<pulumi.Input<inputs.osconfig.v1.PatchInstanceFilterGroupLabel>[]>;
            /**
             * Targets VMs whose name starts with one of these prefixes. Similar to labels, this is another way to group VMs when targeting configs, for example prefix="prod-".
             */
            instanceNamePrefixes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets any of the VM instances specified. Instances are specified by their URI in the form `zones/[ZONE]/instances/[INSTANCE_NAME]`, `projects/[PROJECT_ID]/zones/[ZONE]/instances/[INSTANCE_NAME]`, or `https://www.googleapis.com/compute/v1/projects/[PROJECT_ID]/zones/[ZONE]/instances/[INSTANCE_NAME]`
             */
            instances?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets VM instances in ANY of these zones. Leave empty to target VM instances in any zone.
             */
            zones?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Targets a group of VM instances by using their [assigned labels](https://cloud.google.com/compute/docs/labeling-resources). Labels are key-value pairs. A `GroupLabel` is a combination of labels that is used to target VMs for a patch job. For example, a patch job can target VMs that have the following `GroupLabel`: `{"env":"test", "app":"web"}`. This means that the patch job is applied to VMs that have both the labels `env=test` and `app=web`.
         */
        interface PatchInstanceFilterGroupLabel {
            /**
             * Compute Engine instance labels that must be present for a VM instance to be targeted by this filter.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Patch rollout configuration specifications. Contains details on the concurrency control when applying patch(es) to all targeted VMs.
         */
        interface PatchRollout {
            /**
             * The maximum number (or percentage) of VMs per zone to disrupt at any given moment. The number of VMs calculated from multiplying the percentage by the total number of VMs in a zone is rounded up. During patching, a VM is considered disrupted from the time the agent is notified to begin until patching has completed. This disruption time includes the time to complete reboot and any post-patch steps. A VM contributes to the disruption budget if its patching operation fails either when applying the patches, running pre or post patch steps, or if it fails to respond with a success notification before timing out. VMs that are not running or do not have an active agent do not count toward this disruption budget. For zone-by-zone rollouts, if the disruption budget in a zone is exceeded, the patch job stops, because continuing to the next zone requires completion of the patch process in the previous zone. For example, if the disruption budget has a fixed value of `10`, and 8 VMs fail to patch in the current zone, the patch job continues to patch 2 VMs at a time until the zone is completed. When that zone is completed successfully, patching begins with 10 VMs at a time in the next zone. If 10 VMs in the next zone fail to patch, the patch job stops.
             */
            disruptionBudget?: pulumi.Input<inputs.osconfig.v1.FixedOrPercent>;
            /**
             * Mode of the patch rollout.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Sets the time for recurring patch deployments.
         */
        interface RecurringSchedule {
            /**
             * Optional. The end time at which a recurring patch deployment schedule is no longer active.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Required. The frequency unit of this recurring schedule.
             */
            frequency?: pulumi.Input<string>;
            /**
             * Required. Schedule with monthly executions.
             */
            monthly?: pulumi.Input<inputs.osconfig.v1.MonthlySchedule>;
            /**
             * Optional. The time that the recurring schedule becomes effective. Defaults to `create_time` of the patch deployment.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Required. Time of the day to run a recurring deployment.
             */
            timeOfDay?: pulumi.Input<inputs.osconfig.v1.TimeOfDay>;
            /**
             * Required. Defines the time zone that `time_of_day` is relative to. The rules for daylight saving time are determined by the chosen time zone.
             */
            timeZone?: pulumi.Input<inputs.osconfig.v1.TimeZone>;
            /**
             * Required. Schedule with weekly executions.
             */
            weekly?: pulumi.Input<inputs.osconfig.v1.WeeklySchedule>;
        }
        /**
         * Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`.
         */
        interface TimeOfDay {
            /**
             * Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
             */
            hours?: pulumi.Input<number>;
            /**
             * Minutes of hour of day. Must be from 0 to 59.
             */
            minutes?: pulumi.Input<number>;
            /**
             * Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
             */
            seconds?: pulumi.Input<number>;
        }
        /**
         * Represents a time zone from the [IANA Time Zone Database](https://www.iana.org/time-zones).
         */
        interface TimeZone {
            /**
             * IANA Time Zone Database time zone, e.g. "America/New_York".
             */
            id?: pulumi.Input<string>;
            /**
             * Optional. IANA Time Zone Database version number, e.g. "2019a".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Represents one week day in a month. An example is "the 4th Sunday".
         */
        interface WeekDayOfMonth {
            /**
             * Required. A day of the week.
             */
            dayOfWeek?: pulumi.Input<string>;
            /**
             * Required. Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.
             */
            weekOrdinal?: pulumi.Input<number>;
        }
        /**
         * Represents a weekly schedule.
         */
        interface WeeklySchedule {
            /**
             * Required. Day of the week.
             */
            dayOfWeek?: pulumi.Input<string>;
        }
        /**
         * Windows patching is performed using the Windows Update Agent.
         */
        interface WindowsUpdateSettings {
            /**
             * Only apply updates of these windows update classifications. If empty, all updates are applied.
             */
            classifications?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of KBs to exclude from update.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of kbs to be updated. These are the only patches that will be updated. This field must not be used with other patch configurations.
             */
            exclusivePatches?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Yum patching is performed by executing `yum update`. Additional options can be set to control how this is executed. Note that not all settings are supported on all platforms.
         */
        interface YumSettings {
            /**
             * List of packages to exclude from update. These packages are excluded by using the yum `--exclude` flag.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field must not be specified with any other patch configuration fields.
             */
            exclusivePackages?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Will cause patch to run `yum update-minimal` instead.
             */
            minimal?: pulumi.Input<boolean>;
            /**
             * Adds the `--security` flag to `yum update`. Not supported on all platforms.
             */
            security?: pulumi.Input<boolean>;
        }
        /**
         * Zypper patching is performed by running `zypper patch`. See also https://en.opensuse.org/SDB:Zypper_manual.
         */
        interface ZypperSettings {
            /**
             * Install only patches with these categories. Common categories include security, recommended, and feature.
             */
            categories?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of patches to exclude from update.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of patches to be updated. These are the only patches that will be installed using 'zypper patch patch:' command. This field must not be used with any other patch configuration fields.
             */
            exclusivePatches?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Install only patches with these severities. Common severities include critical, important, moderate, and low.
             */
            severities?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Adds the `--with-optional` flag to `zypper patch`.
             */
            withOptional?: pulumi.Input<boolean>;
            /**
             * Adds the `--with-update` flag, to `zypper patch`.
             */
            withUpdate?: pulumi.Input<boolean>;
        }
    }
    namespace v1beta {
        /**
         * Represents a single Apt package repository. This repository is added to a repo file that is stored at `/etc/apt/sources.list.d/google_osconfig.list`.
         */
        interface AptRepository {
            /**
             * Type of archive files in this repository. The default behavior is DEB.
             */
            archiveType?: pulumi.Input<string>;
            /**
             * Required. List of components for this repository. Must contain at least one item.
             */
            components?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. Distribution of this repository.
             */
            distribution?: pulumi.Input<string>;
            /**
             * URI of the key file for this repository. The agent maintains a keyring at `/etc/apt/trusted.gpg.d/osconfig_agent_managed.gpg` containing all the keys in any applied guest policy.
             */
            gpgKey?: pulumi.Input<string>;
            /**
             * Required. URI for this repository.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Apt patching is completed by executing `apt-get update && apt-get upgrade`. Additional options can be set to control how this is executed.
         */
        interface AptSettings {
            /**
             * List of packages to exclude from update. These packages will be excluded
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.
             */
            exclusivePackages?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * By changing the type to DIST, the patching is performed using `apt-get dist-upgrade` instead.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * An assignment represents the group or groups of VM instances that the policy applies to. If an assignment is empty, it applies to all VM instances. Otherwise, the targeted VM instances must meet all the criteria specified. So if both labels and zones are specified, the policy applies to VM instances with those labels and in those zones.
         */
        interface Assignment {
            /**
             * Targets instances matching at least one of these label sets. This allows an assignment to target disparate groups, for example "env=prod or env=staging".
             */
            groupLabels?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.AssignmentGroupLabel>[]>;
            /**
             * Targets VM instances whose name starts with one of these prefixes. Like labels, this is another way to group VM instances when targeting configs, for example prefix="prod-". Only supported for project-level policies.
             */
            instanceNamePrefixes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets any of the instances specified. Instances are specified by their URI in the form `zones/[ZONE]/instances/[INSTANCE_NAME]`. Instance targeting is uncommon and is supported to facilitate the management of changes by the instance or to target specific VM instances for development and testing. Only supported for project-level policies and must reference instances within this project.
             */
            instances?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets VM instances matching at least one of the following OS types. VM instances must match all supplied criteria for a given OsType to be included.
             */
            osTypes?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.AssignmentOsType>[]>;
            /**
             * Targets instances in any of these zones. Leave empty to target instances in any zone. Zonal targeting is uncommon and is supported to facilitate the management of changes by zone.
             */
            zones?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a group of VM intances that can be identified as having all these labels, for example "env=prod and app=web".
         */
        interface AssignmentGroupLabel {
            /**
             * Google Compute Engine instance labels that must be present for an instance to be included in this assignment group.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Defines the criteria for selecting VM Instances by OS type.
         */
        interface AssignmentOsType {
            /**
             * Targets VM instances with OS Inventory enabled and having the following OS architecture.
             */
            osArchitecture?: pulumi.Input<string>;
            /**
             * Targets VM instances with OS Inventory enabled and having the following OS short name, for example "debian" or "windows".
             */
            osShortName?: pulumi.Input<string>;
            /**
             * Targets VM instances with OS Inventory enabled and having the following following OS version.
             */
            osVersion?: pulumi.Input<string>;
        }
        /**
         * A step that runs an executable for a PatchJob.
         */
        interface ExecStep {
            /**
             * The ExecStepConfig for all Linux VMs targeted by the PatchJob.
             */
            linuxExecStepConfig?: pulumi.Input<inputs.osconfig.v1beta.ExecStepConfig>;
            /**
             * The ExecStepConfig for all Windows VMs targeted by the PatchJob.
             */
            windowsExecStepConfig?: pulumi.Input<inputs.osconfig.v1beta.ExecStepConfig>;
        }
        /**
         * Common configurations for an ExecStep.
         */
        interface ExecStepConfig {
            /**
             * Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
             */
            allowedSuccessCodes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * A Google Cloud Storage object containing the executable.
             */
            gcsObject?: pulumi.Input<inputs.osconfig.v1beta.GcsObject>;
            /**
             * The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with [shebang lines] (https://en.wikipedia.org/wiki/Shebang_\(Unix\)).
             */
            interpreter?: pulumi.Input<string>;
            /**
             * An absolute path to the executable on the VM.
             */
            localPath?: pulumi.Input<string>;
        }
        /**
         * Message encapsulating a value that can be either absolute ("fixed") or relative ("percent") to a value.
         */
        interface FixedOrPercent {
            /**
             * Specifies a fixed value.
             */
            fixed?: pulumi.Input<number>;
            /**
             * Specifies the relative value defined as a percentage, which will be multiplied by a reference value.
             */
            percent?: pulumi.Input<number>;
        }
        /**
         * Google Cloud Storage object representation.
         */
        interface GcsObject {
            /**
             * Required. Bucket of the Google Cloud Storage object.
             */
            bucket?: pulumi.Input<string>;
            /**
             * Required. Generation number of the Google Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.
             */
            generationNumber?: pulumi.Input<string>;
            /**
             * Required. Name of the Google Cloud Storage object.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * Represents a Goo package repository. These is added to a repo file that is stored at C:/ProgramData/GooGet/repos/google_osconfig.repo.
         */
        interface GooRepository {
            /**
             * Required. The name of the repository.
             */
            name?: pulumi.Input<string>;
            /**
             * Required. The url of the repository.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Googet patching is performed by running `googet update`.
         */
        interface GooSettings {
        }
        /**
         * Represents a monthly schedule. An example of a valid monthly schedule is "on the third Tuesday of the month" or "on the 15th of the month".
         */
        interface MonthlySchedule {
            /**
             * Required. One day of the month. 1-31 indicates the 1st to the 31st day. -1 indicates the last day of the month. Months without the target day will be skipped. For example, a schedule to run "every month on the 31st" will not run in February, April, June, etc.
             */
            monthDay?: pulumi.Input<number>;
            /**
             * Required. Week day in a month.
             */
            weekDayOfMonth?: pulumi.Input<inputs.osconfig.v1beta.WeekDayOfMonth>;
        }
        /**
         * Sets the time for a one time patch deployment. Timestamp is in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
         */
        interface OneTimeSchedule {
            /**
             * Required. The desired patch job execution time.
             */
            executeTime?: pulumi.Input<string>;
        }
        /**
         * Package is a reference to the software package to be installed or removed. The agent on the VM instance uses the system package manager to apply the config. These are the commands that the agent uses to install or remove packages. Apt install: `apt-get update && apt-get -y install package1 package2 package3` remove: `apt-get -y remove package1 package2 package3` Yum install: `yum -y install package1 package2 package3` remove: `yum -y remove package1 package2 package3` Zypper install: `zypper install package1 package2 package3` remove: `zypper rm package1 package2` Googet install: `googet -noconfirm install package1 package2 package3` remove: `googet -noconfirm remove package1 package2 package3`
         */
        interface Package {
            /**
             * The desired_state the agent should maintain for this package. The default is to ensure the package is installed.
             */
            desiredState?: pulumi.Input<string>;
            /**
             * Type of package manager that can be used to install this package. If a system does not have the package manager, the package is not installed or removed no error message is returned. By default, or if you specify `ANY`, the agent attempts to install and remove this package using the default package manager. This is useful when creating a policy that applies to different types of systems. The default behavior is ANY.
             */
            manager?: pulumi.Input<string>;
            /**
             * Required. The name of the package. A package is uniquely identified for conflict validation by checking the package name and the manager(s) that the package targets.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * A package repository.
         */
        interface PackageRepository {
            /**
             * An Apt Repository.
             */
            apt?: pulumi.Input<inputs.osconfig.v1beta.AptRepository>;
            /**
             * A Goo Repository.
             */
            goo?: pulumi.Input<inputs.osconfig.v1beta.GooRepository>;
            /**
             * A Yum Repository.
             */
            yum?: pulumi.Input<inputs.osconfig.v1beta.YumRepository>;
            /**
             * A Zypper Repository.
             */
            zypper?: pulumi.Input<inputs.osconfig.v1beta.ZypperRepository>;
        }
        /**
         * Patch configuration specifications. Contains details on how to apply the patch(es) to a VM instance.
         */
        interface PatchConfig {
            /**
             * Apt update settings. Use this setting to override the default `apt` patch rules.
             */
            apt?: pulumi.Input<inputs.osconfig.v1beta.AptSettings>;
            /**
             * Goo update settings. Use this setting to override the default `goo` patch rules.
             */
            goo?: pulumi.Input<inputs.osconfig.v1beta.GooSettings>;
            /**
             * The `ExecStep` to run after the patch update.
             */
            postStep?: pulumi.Input<inputs.osconfig.v1beta.ExecStep>;
            /**
             * The `ExecStep` to run before the patch update.
             */
            preStep?: pulumi.Input<inputs.osconfig.v1beta.ExecStep>;
            /**
             * Post-patch reboot settings.
             */
            rebootConfig?: pulumi.Input<string>;
            /**
             * Windows update settings. Use this override the default windows patch rules.
             */
            windowsUpdate?: pulumi.Input<inputs.osconfig.v1beta.WindowsUpdateSettings>;
            /**
             * Yum update settings. Use this setting to override the default `yum` patch rules.
             */
            yum?: pulumi.Input<inputs.osconfig.v1beta.YumSettings>;
            /**
             * Zypper update settings. Use this setting to override the default `zypper` patch rules.
             */
            zypper?: pulumi.Input<inputs.osconfig.v1beta.ZypperSettings>;
        }
        /**
         * A filter to target VM instances for patching. The targeted VMs must meet all criteria specified. So if both labels and zones are specified, the patch job targets only VMs with those labels and in those zones.
         */
        interface PatchInstanceFilter {
            /**
             * Target all VM instances in the project. If true, no other criteria is permitted.
             */
            all?: pulumi.Input<boolean>;
            /**
             * Targets VM instances matching at least one of these label sets. This allows targeting of disparate groups, for example "env=prod or env=staging".
             */
            groupLabels?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.PatchInstanceFilterGroupLabel>[]>;
            /**
             * Targets VMs whose name starts with one of these prefixes. Similar to labels, this is another way to group VMs when targeting configs, for example prefix="prod-".
             */
            instanceNamePrefixes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets any of the VM instances specified. Instances are specified by their URI in the form `zones/[ZONE]/instances/[INSTANCE_NAME]`, `projects/[PROJECT_ID]/zones/[ZONE]/instances/[INSTANCE_NAME]`, or `https://www.googleapis.com/compute/v1/projects/[PROJECT_ID]/zones/[ZONE]/instances/[INSTANCE_NAME]`
             */
            instances?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Targets VM instances in ANY of these zones. Leave empty to target VM instances in any zone.
             */
            zones?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a group of VMs that can be identified as having all these labels, for example "env=prod and app=web".
         */
        interface PatchInstanceFilterGroupLabel {
            /**
             * Compute Engine instance labels that must be present for a VM instance to be targeted by this filter.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Patch rollout configuration specifications. Contains details on the concurrency control when applying patch(es) to all targeted VMs.
         */
        interface PatchRollout {
            /**
             * The maximum number (or percentage) of VMs per zone to disrupt at any given moment. The number of VMs calculated from multiplying the percentage by the total number of VMs in a zone is rounded up. During patching, a VM is considered disrupted from the time the agent is notified to begin until patching has completed. This disruption time includes the time to complete reboot and any post-patch steps. A VM contributes to the disruption budget if its patching operation fails either when applying the patches, running pre or post patch steps, or if it fails to respond with a success notification before timing out. VMs that are not running or do not have an active agent do not count toward this disruption budget. For zone-by-zone rollouts, if the disruption budget in a zone is exceeded, the patch job stops, because continuing to the next zone requires completion of the patch process in the previous zone. For example, if the disruption budget has a fixed value of `10`, and 8 VMs fail to patch in the current zone, the patch job continues to patch 2 VMs at a time until the zone is completed. When that zone is completed successfully, patching begins with 10 VMs at a time in the next zone. If 10 VMs in the next zone fail to patch, the patch job stops.
             */
            disruptionBudget?: pulumi.Input<inputs.osconfig.v1beta.FixedOrPercent>;
            /**
             * Mode of the patch rollout.
             */
            mode?: pulumi.Input<string>;
        }
        /**
         * Sets the time for recurring patch deployments.
         */
        interface RecurringSchedule {
            /**
             * Optional. The end time at which a recurring patch deployment schedule is no longer active.
             */
            endTime?: pulumi.Input<string>;
            /**
             * Required. The frequency unit of this recurring schedule.
             */
            frequency?: pulumi.Input<string>;
            /**
             * Required. Schedule with monthly executions.
             */
            monthly?: pulumi.Input<inputs.osconfig.v1beta.MonthlySchedule>;
            /**
             * Optional. The time that the recurring schedule becomes effective. Defaults to `create_time` of the patch deployment.
             */
            startTime?: pulumi.Input<string>;
            /**
             * Required. Time of the day to run a recurring deployment.
             */
            timeOfDay?: pulumi.Input<inputs.osconfig.v1beta.TimeOfDay>;
            /**
             * Required. Defines the time zone that `time_of_day` is relative to. The rules for daylight saving time are determined by the chosen time zone.
             */
            timeZone?: pulumi.Input<inputs.osconfig.v1beta.TimeZone>;
            /**
             * Required. Schedule with weekly executions.
             */
            weekly?: pulumi.Input<inputs.osconfig.v1beta.WeeklySchedule>;
        }
        /**
         * A software recipe is a set of instructions for installing and configuring a piece of software. It consists of a set of artifacts that are downloaded, and a set of steps that install, configure, and/or update the software. Recipes support installing and updating software from artifacts in the following formats: Zip archive, Tar archive, Windows MSI, Debian package, and RPM package. Additionally, recipes support executing a script (either defined in a file or directly in this api) in bash, sh, cmd, and powershell. Updating a software recipe If a recipe is assigned to an instance and there is a recipe with the same name but a lower version already installed and the assigned state of the recipe is `UPDATED`, then the recipe is updated to the new version. Script Working Directories Each script or execution step is run in its own temporary directory which is deleted after completing the step.
         */
        interface SoftwareRecipe {
            /**
             * Resources available to be used in the steps in the recipe.
             */
            artifacts?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeArtifact>[]>;
            /**
             * Default is INSTALLED. The desired state the agent should maintain for this recipe. INSTALLED: The software recipe is installed on the instance but won't be updated to new versions. UPDATED: The software recipe is installed on the instance. The recipe is updated to a higher version, if a higher version of the recipe is assigned to this instance. REMOVE: Remove is unsupported for software recipes and attempts to create or update a recipe to the REMOVE state is rejected.
             */
            desiredState?: pulumi.Input<string>;
            /**
             * Actions to be taken for installing this recipe. On failure it stops executing steps and does not attempt another installation. Any steps taken (including partially completed steps) are not rolled back.
             */
            installSteps?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStep>[]>;
            /**
             * Required. Unique identifier for the recipe. Only one recipe with a given name is installed on an instance. Names are also used to identify resources which helps to determine whether guest policies have conflicts. This means that requests to create multiple recipes with the same name and version are rejected since they could potentially have conflicting assignments.
             */
            name?: pulumi.Input<string>;
            /**
             * Actions to be taken for updating this recipe. On failure it stops executing steps and does not attempt another update for this recipe. Any steps taken (including partially completed steps) are not rolled back.
             */
            updateSteps?: pulumi.Input<pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStep>[]>;
            /**
             * The version of this software recipe. Version can be up to 4 period separated numbers (e.g. 12.34.56.78).
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Specifies a resource to be used in the recipe.
         */
        interface SoftwareRecipeArtifact {
            /**
             * Defaults to false. When false, recipes are subject to validations based on the artifact type: Remote: A checksum must be specified, and only protocols with transport-layer security are permitted. GCS: An object generation number must be specified.
             */
            allowInsecure?: pulumi.Input<boolean>;
            /**
             * A Google Cloud Storage artifact.
             */
            gcs?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeArtifactGcs>;
            /**
             * Required. Id of the artifact, which the installation and update steps of this recipe can reference. Artifacts in a recipe cannot have the same id.
             */
            id?: pulumi.Input<string>;
            /**
             * A generic remote artifact.
             */
            remote?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeArtifactRemote>;
        }
        /**
         * Specifies an artifact available as a Google Cloud Storage object.
         */
        interface SoftwareRecipeArtifactGcs {
            /**
             * Bucket of the Google Cloud Storage object. Given an example URL: `https://storage.googleapis.com/my-bucket/foo/bar#1234567` this value would be `my-bucket`.
             */
            bucket?: pulumi.Input<string>;
            /**
             * Must be provided if allow_insecure is false. Generation number of the Google Cloud Storage object. `https://storage.googleapis.com/my-bucket/foo/bar#1234567` this value would be `1234567`.
             */
            generation?: pulumi.Input<string>;
            /**
             * Name of the Google Cloud Storage object. As specified [here] (https://cloud.google.com/storage/docs/naming#objectnames) Given an example URL: `https://storage.googleapis.com/my-bucket/foo/bar#1234567` this value would be `foo/bar`.
             */
            object?: pulumi.Input<string>;
        }
        /**
         * Specifies an artifact available via some URI.
         */
        interface SoftwareRecipeArtifactRemote {
            /**
             * Must be provided if `allow_insecure` is `false`. SHA256 checksum in hex format, to compare to the checksum of the artifact. If the checksum is not empty and it doesn't match the artifact then the recipe installation fails before running any of the steps.
             */
            checksum?: pulumi.Input<string>;
            /**
             * URI from which to fetch the object. It should contain both the protocol and path following the format {protocol}://{location}.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * An action that can be taken as part of installing or updating a recipe.
         */
        interface SoftwareRecipeStep {
            /**
             * Extracts an archive into the specified directory.
             */
            archiveExtraction?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepExtractArchive>;
            /**
             * Installs a deb file via dpkg.
             */
            dpkgInstallation?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepInstallDpkg>;
            /**
             * Copies a file onto the instance.
             */
            fileCopy?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepCopyFile>;
            /**
             * Executes an artifact or local file.
             */
            fileExec?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepExecFile>;
            /**
             * Installs an MSI file.
             */
            msiInstallation?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepInstallMsi>;
            /**
             * Installs an rpm file via the rpm utility.
             */
            rpmInstallation?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepInstallRpm>;
            /**
             * Runs commands in a shell.
             */
            scriptRun?: pulumi.Input<inputs.osconfig.v1beta.SoftwareRecipeStepRunScript>;
        }
        /**
         * Copies the artifact to the specified path on the instance.
         */
        interface SoftwareRecipeStepCopyFile {
            /**
             * Required. The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
            /**
             * Required. The absolute path on the instance to put the file.
             */
            destination?: pulumi.Input<string>;
            /**
             * Whether to allow this step to overwrite existing files. If this is false and the file already exists the file is not overwritten and the step is considered a success. Defaults to false.
             */
            overwrite?: pulumi.Input<boolean>;
            /**
             * Consists of three octal digits which represent, in order, the permissions of the owner, group, and other users for the file (similarly to the numeric mode used in the linux chmod utility). Each digit represents a three bit number with the 4 bit corresponding to the read permissions, the 2 bit corresponds to the write bit, and the one bit corresponds to the execute permission. Default behavior is 755. Below are some examples of permissions and their associated values: read, write, and execute: 7 read and execute: 5 read and write: 6 read only: 4
             */
            permissions?: pulumi.Input<string>;
        }
        /**
         * Executes an artifact or local file.
         */
        interface SoftwareRecipeStepExecFile {
            /**
             * Defaults to [0]. A list of possible return values that the program can return to indicate a success.
             */
            allowedExitCodes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * Arguments to be passed to the provided executable.
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
            /**
             * The absolute path of the file on the local filesystem.
             */
            localPath?: pulumi.Input<string>;
        }
        /**
         * Extracts an archive of the type specified in the specified directory.
         */
        interface SoftwareRecipeStepExtractArchive {
            /**
             * Required. The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
            /**
             * Directory to extract archive to. Defaults to `/` on Linux or `C:\` on Windows.
             */
            destination?: pulumi.Input<string>;
            /**
             * Required. The type of the archive to extract.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Installs a deb via dpkg.
         */
        interface SoftwareRecipeStepInstallDpkg {
            /**
             * Required. The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
        }
        /**
         * Installs an MSI file.
         */
        interface SoftwareRecipeStepInstallMsi {
            /**
             * Return codes that indicate that the software installed or updated successfully. Behaviour defaults to [0]
             */
            allowedExitCodes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * Required. The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
            /**
             * The flags to use when installing the MSI defaults to ["/i"] (i.e. the install flag).
             */
            flags?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Installs an rpm file via the rpm utility.
         */
        interface SoftwareRecipeStepInstallRpm {
            /**
             * Required. The id of the relevant artifact in the recipe.
             */
            artifactId?: pulumi.Input<string>;
        }
        /**
         * Runs a script through an interpreter.
         */
        interface SoftwareRecipeStepRunScript {
            /**
             * Return codes that indicate that the software installed or updated successfully. Behaviour defaults to [0]
             */
            allowedExitCodes?: pulumi.Input<pulumi.Input<number>[]>;
            /**
             * The script interpreter to use to run the script. If no interpreter is specified the script is executed directly, which likely only succeed for scripts with [shebang lines](https://en.wikipedia.org/wiki/Shebang_\(Unix\)).
             */
            interpreter?: pulumi.Input<string>;
            /**
             * Required. The shell script to be executed.
             */
            script?: pulumi.Input<string>;
        }
        /**
         * Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`.
         */
        interface TimeOfDay {
            /**
             * Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
             */
            hours?: pulumi.Input<number>;
            /**
             * Minutes of hour of day. Must be from 0 to 59.
             */
            minutes?: pulumi.Input<number>;
            /**
             * Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
             */
            seconds?: pulumi.Input<number>;
        }
        /**
         * Represents a time zone from the [IANA Time Zone Database](https://www.iana.org/time-zones).
         */
        interface TimeZone {
            /**
             * IANA Time Zone Database time zone, e.g. "America/New_York".
             */
            id?: pulumi.Input<string>;
            /**
             * Optional. IANA Time Zone Database version number, e.g. "2019a".
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Represents one week day in a month. An example is "the 4th Sunday".
         */
        interface WeekDayOfMonth {
            /**
             * Required. A day of the week.
             */
            dayOfWeek?: pulumi.Input<string>;
            /**
             * Required. Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.
             */
            weekOrdinal?: pulumi.Input<number>;
        }
        /**
         * Represents a weekly schedule.
         */
        interface WeeklySchedule {
            /**
             * Required. Day of the week.
             */
            dayOfWeek?: pulumi.Input<string>;
        }
        /**
         * Windows patching is performed using the Windows Update Agent.
         */
        interface WindowsUpdateSettings {
            /**
             * Only apply updates of these windows update classifications. If empty, all updates are applied.
             */
            classifications?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of KBs to exclude from update.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of kbs to be updated. These are the only patches that will be updated. This field must not be used with other patch configurations.
             */
            exclusivePatches?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a single Yum package repository. This repository is added to a repo file that is stored at `/etc/yum.repos.d/google_osconfig.repo`.
         */
        interface YumRepository {
            /**
             * Required. The location of the repository directory.
             */
            baseUrl?: pulumi.Input<string>;
            /**
             * The display name of the repository.
             */
            displayName?: pulumi.Input<string>;
            /**
             * URIs of GPG keys.
             */
            gpgKeys?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. A one word, unique name for this repository. This is the `repo id` in the Yum config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for guest policy conflicts.
             */
            id?: pulumi.Input<string>;
        }
        /**
         * Yum patching is performed by executing `yum update`. Additional options can be set to control how this is executed. Note that not all settings are supported on all platforms.
         */
        interface YumSettings {
            /**
             * List of packages to exclude from update. These packages are excluded by using the yum `--exclude` flag.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field must not be specified with any other patch configuration fields.
             */
            exclusivePackages?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Will cause patch to run `yum update-minimal` instead.
             */
            minimal?: pulumi.Input<boolean>;
            /**
             * Adds the `--security` flag to `yum update`. Not supported on all platforms.
             */
            security?: pulumi.Input<boolean>;
        }
        /**
         * Represents a single Zypper package repository. This repository is added to a repo file that is stored at `/etc/zypp/repos.d/google_osconfig.repo`.
         */
        interface ZypperRepository {
            /**
             * Required. The location of the repository directory.
             */
            baseUrl?: pulumi.Input<string>;
            /**
             * The display name of the repository.
             */
            displayName?: pulumi.Input<string>;
            /**
             * URIs of GPG keys.
             */
            gpgKeys?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. A one word, unique name for this repository. This is the `repo id` in the zypper config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for guest policy conflicts.
             */
            id?: pulumi.Input<string>;
        }
        /**
         * Zypper patching is performed by running `zypper patch`. See also https://en.opensuse.org/SDB:Zypper_manual.
         */
        interface ZypperSettings {
            /**
             * Install only patches with these categories. Common categories include security, recommended, and feature.
             */
            categories?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of patches to exclude from update.
             */
            excludes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * An exclusive list of patches to be updated. These are the only patches that will be installed using 'zypper patch patch:' command. This field must not be used with any other patch configuration fields.
             */
            exclusivePatches?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Install only patches with these severities. Common severities include critical, important, moderate, and low.
             */
            severities?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Adds the `--with-optional` flag to `zypper patch`.
             */
            withOptional?: pulumi.Input<boolean>;
            /**
             * Adds the `--with-update` flag, to `zypper patch`.
             */
            withUpdate?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace policysimulator {
    namespace v1 {
        /**
         * The configuration used for a Replay.
         */
        interface GoogleCloudPolicysimulatorV1ReplayConfig {
            /**
             * The logs to use as input for the Replay.
             */
            logSource?: pulumi.Input<string>;
            /**
             * A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
             */
            policyOverlay?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
    }
    namespace v1beta1 {
        /**
         * The configuration used for a Replay.
         */
        interface GoogleCloudPolicysimulatorV1beta1ReplayConfig {
            /**
             * The logs to use as input for the Replay.
             */
            logSource?: pulumi.Input<string>;
            /**
             * A mapping of the resources that you want to simulate policies for and the policies that you want to simulate. Keys are the full resource names for the resources. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names. Values are Policy objects representing the policies that you want to simulate. Replays automatically take into account any IAM policies inherited through the resource hierarchy, and any policies set on descendant resources. You do not need to include these policies in the policy overlay.
             */
            policyOverlay?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
    }
}
export declare namespace privateca {
    namespace v1beta1 {
        interface AllowedConfigList {
            /**
             * Required. All Certificates issued by the CertificateAuthority must match at least one listed ReusableConfigWrapper. If a ReusableConfigWrapper has an empty field, any value will be allowed for that field.
             */
            allowedConfigValues?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.ReusableConfigWrapper>[]>;
        }
        /**
         * AllowedSubjectAltNames specifies the allowed values for SubjectAltNames by the CertificateAuthority when issuing Certificates.
         */
        interface AllowedSubjectAltNames {
            /**
             * Optional. Specifies if to allow custom X509Extension values.
             */
            allowCustomSans?: pulumi.Input<boolean>;
            /**
             * Optional. Specifies if glob patterns used for allowed_dns_names allow wildcard certificates. If this is set, certificate requests with wildcard domains will be permitted to match a glob pattern specified in allowed_dns_names. Otherwise, certificate requests with wildcard domains will be permitted only if allowed_dns_names contains a literal wildcard.
             */
            allowGlobbingDnsWildcards?: pulumi.Input<boolean>;
            /**
             * Optional. Contains valid, fully-qualified host names. Glob patterns are also supported. To allow an explicit wildcard certificate, escape with backlash (i.e. "\*"). E.g. for globbed entries: '*bar.com' will allow 'foo.bar.com', but not '*.bar.com', unless the allow_globbing_dns_wildcards field is set. E.g. for wildcard entries: '\*.bar.com' will allow '*.bar.com', but not 'foo.bar.com'.
             */
            allowedDnsNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Contains valid RFC 2822 E-mail addresses. Glob patterns are also supported.
             */
            allowedEmailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Contains valid 32-bit IPv4 addresses and subnet ranges or RFC 4291 IPv6 addresses and subnet ranges. Subnet ranges are specified using the '/' notation (e.g. 10.0.0.0/8, 2001:700:300:1800::/64). Glob patterns are supported only for ip address entries (i.e. not for subnet ranges).
             */
            allowedIps?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Contains valid RFC 3986 URIs. Glob patterns are also supported. To match across path seperators (i.e. '/') use the double star glob pattern (i.e. '**').
             */
            allowedUris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.privateca.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Describes values that are relevant in a CA certificate.
         */
        interface CaOptions {
            /**
             * Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
             */
            isCa?: pulumi.Input<boolean>;
            /**
             * Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
             */
            maxIssuerPathLength?: pulumi.Input<number>;
        }
        /**
         * The issuing policy for a CertificateAuthority. Certificates will not be successfully issued from this CertificateAuthority if they violate the policy.
         */
        interface CertificateAuthorityPolicy {
            /**
             * Optional. If any value is specified here, then all Certificates issued by the CertificateAuthority must match at least one listed value. If no value is specified, all values will be allowed for this fied. Glob patterns are also supported.
             */
            allowedCommonNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. All Certificates issued by the CertificateAuthority must match at least one listed ReusableConfigWrapper in the list.
             */
            allowedConfigList?: pulumi.Input<inputs.privateca.v1beta1.AllowedConfigList>;
            /**
             * Optional. If specified, then only methods allowed in the IssuanceModes may be used to issue Certificates.
             */
            allowedIssuanceModes?: pulumi.Input<inputs.privateca.v1beta1.IssuanceModes>;
            /**
             * Optional. If any Subject is specified here, then all Certificates issued by the CertificateAuthority must match at least one listed Subject. If a Subject has an empty field, any value will be allowed for that field.
             */
            allowedLocationsAndOrganizations?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.Subject>[]>;
            /**
             * Optional. If a AllowedSubjectAltNames is specified here, then all Certificates issued by the CertificateAuthority must match AllowedSubjectAltNames. If no value or an empty value is specified, any value will be allowed for the SubjectAltNames field.
             */
            allowedSans?: pulumi.Input<inputs.privateca.v1beta1.AllowedSubjectAltNames>;
            /**
             * Optional. The maximum lifetime allowed by the CertificateAuthority. Note that if the any part if the issuing chain expires before a Certificate's requested maximum_lifetime, the effective lifetime will be explicitly truncated.
             */
            maximumLifetime?: pulumi.Input<string>;
            /**
             * Optional. All Certificates issued by the CertificateAuthority will use the provided configuration values, overwriting any requested configuration values.
             */
            overwriteConfigValues?: pulumi.Input<inputs.privateca.v1beta1.ReusableConfigWrapper>;
        }
        /**
         * A CertificateConfig describes an X.509 certificate or CSR that is to be created, as an alternative to using ASN.1.
         */
        interface CertificateConfig {
            /**
             * Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
             */
            publicKey?: pulumi.Input<inputs.privateca.v1beta1.PublicKey>;
            /**
             * Required. Describes how some of the technical fields in a certificate should be populated.
             */
            reusableConfig?: pulumi.Input<inputs.privateca.v1beta1.ReusableConfigWrapper>;
            /**
             * Required. Specifies some of the values in a certificate that are related to the subject.
             */
            subjectConfig?: pulumi.Input<inputs.privateca.v1beta1.SubjectConfig>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * KeyUsage.ExtendedKeyUsageOptions has fields that correspond to certain common OIDs that could be specified as an extended key usage value.
         */
        interface ExtendedKeyUsageOptions {
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
             */
            clientAuth?: pulumi.Input<boolean>;
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
             */
            codeSigning?: pulumi.Input<boolean>;
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
             */
            emailProtection?: pulumi.Input<boolean>;
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
             */
            ocspSigning?: pulumi.Input<boolean>;
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
             */
            serverAuth?: pulumi.Input<boolean>;
            /**
             * Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
             */
            timeStamping?: pulumi.Input<boolean>;
        }
        /**
         * IssuanceModes specifies the allowed ways in which Certificates may be requested from this CertificateAuthority.
         */
        interface IssuanceModes {
            /**
             * Required. When true, allows callers to create Certificates by specifying a CertificateConfig.
             */
            allowConfigBasedIssuance?: pulumi.Input<boolean>;
            /**
             * Required. When true, allows callers to create Certificates by specifying a CSR.
             */
            allowCsrBasedIssuance?: pulumi.Input<boolean>;
        }
        /**
         * Options that affect all certificates issued by a CertificateAuthority.
         */
        interface IssuingOptions {
            /**
             * Required. When true, includes a URL to the issuing CA certificate in the "authority information access" X.509 extension.
             */
            includeCaCertUrl?: pulumi.Input<boolean>;
            /**
             * Required. When true, includes a URL to the CRL corresponding to certificates issued from a CertificateAuthority. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.
             */
            includeCrlAccessUrl?: pulumi.Input<boolean>;
        }
        /**
         * A KeyUsage describes key usage values that may appear in an X.509 certificate.
         */
        interface KeyUsage {
            /**
             * Describes high-level ways in which a key may be used.
             */
            baseKeyUsage?: pulumi.Input<inputs.privateca.v1beta1.KeyUsageOptions>;
            /**
             * Detailed scenarios in which a key may be used.
             */
            extendedKeyUsage?: pulumi.Input<inputs.privateca.v1beta1.ExtendedKeyUsageOptions>;
            /**
             * Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
             */
            unknownExtendedKeyUsages?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.ObjectId>[]>;
        }
        /**
         * KeyUsage.KeyUsageOptions corresponds to the key usage values described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3.
         */
        interface KeyUsageOptions {
            /**
             * The key may be used to sign certificates.
             */
            certSign?: pulumi.Input<boolean>;
            /**
             * The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
             */
            contentCommitment?: pulumi.Input<boolean>;
            /**
             * The key may be used sign certificate revocation lists.
             */
            crlSign?: pulumi.Input<boolean>;
            /**
             * The key may be used to encipher data.
             */
            dataEncipherment?: pulumi.Input<boolean>;
            /**
             * The key may be used to decipher only.
             */
            decipherOnly?: pulumi.Input<boolean>;
            /**
             * The key may be used for digital signatures.
             */
            digitalSignature?: pulumi.Input<boolean>;
            /**
             * The key may be used to encipher only.
             */
            encipherOnly?: pulumi.Input<boolean>;
            /**
             * The key may be used in a key agreement protocol.
             */
            keyAgreement?: pulumi.Input<boolean>;
            /**
             * The key may be used to encipher other keys.
             */
            keyEncipherment?: pulumi.Input<boolean>;
        }
        /**
         * A Cloud KMS key configuration that a CertificateAuthority will use.
         */
        interface KeyVersionSpec {
            /**
             * Required. The algorithm to use for creating a managed Cloud KMS key for a for a simplified experience. All managed keys will be have their ProtectionLevel as `HSM`.
             */
            algorithm?: pulumi.Input<string>;
            /**
             * Required. The resource name for an existing Cloud KMS CryptoKeyVersion in the format `projects/*&#47;locations/*&#47;keyRings/*&#47;cryptoKeys/*&#47;cryptoKeyVersions/*`. This option enables full flexibility in the key's capabilities and properties.
             */
            cloudKmsKeyVersion?: pulumi.Input<string>;
        }
        /**
         * An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
         */
        interface ObjectId {
            /**
             * Required. The parts of an OID path. The most significant parts of the path come first.
             */
            objectIdPath?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * A PublicKey describes a public key.
         */
        interface PublicKey {
            /**
             * Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1) structure containing an algorithm identifier and a key.
             */
            key?: pulumi.Input<string>;
            /**
             * Optional. The type of public key. If specified, it must match the public key used for the`key` field.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * A ReusableConfigValues is used to describe certain fields of an X.509 certificate, such as the key usage fields, fields specific to CA certificates, certificate policy extensions and custom extensions.
         */
        interface ReusableConfigValues {
            /**
             * Optional. Describes custom X.509 extensions.
             */
            additionalExtensions?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.X509Extension>[]>;
            /**
             * Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
             */
            aiaOcspServers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Optional. Describes options in this ReusableConfigValues that are relevant in a CA certificate.
             */
            caOptions?: pulumi.Input<inputs.privateca.v1beta1.CaOptions>;
            /**
             * Optional. Indicates the intended use for keys that correspond to a certificate.
             */
            keyUsage?: pulumi.Input<inputs.privateca.v1beta1.KeyUsage>;
            /**
             * Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
             */
            policyIds?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.ObjectId>[]>;
        }
        /**
         * A ReusableConfigWrapper describes values that may assist in creating an X.509 certificate, or a reference to a pre-defined set of values.
         */
        interface ReusableConfigWrapper {
            /**
             * Required. A resource path to a ReusableConfig in the format `projects/*&#47;locations/*&#47;reusableConfigs/*`.
             */
            reusableConfig?: pulumi.Input<string>;
            /**
             * Required. A user-specified inline ReusableConfigValues.
             */
            reusableConfigValues?: pulumi.Input<inputs.privateca.v1beta1.ReusableConfigValues>;
        }
        /**
         * Subject describes parts of a distinguished name that, in turn, describes the subject of the certificate.
         */
        interface Subject {
            /**
             * The country code of the subject.
             */
            countryCode?: pulumi.Input<string>;
            /**
             * The locality or city of the subject.
             */
            locality?: pulumi.Input<string>;
            /**
             * The organization of the subject.
             */
            organization?: pulumi.Input<string>;
            /**
             * The organizational_unit of the subject.
             */
            organizationalUnit?: pulumi.Input<string>;
            /**
             * The postal code of the subject.
             */
            postalCode?: pulumi.Input<string>;
            /**
             * The province, territory, or regional state of the subject.
             */
            province?: pulumi.Input<string>;
            /**
             * The street address of the subject.
             */
            streetAddress?: pulumi.Input<string>;
        }
        /**
         * SubjectAltNames corresponds to a more modern way of listing what the asserted identity is in a certificate (i.e., compared to the "common name" in the distinguished name).
         */
        interface SubjectAltNames {
            /**
             * Contains additional subject alternative name values.
             */
            customSans?: pulumi.Input<pulumi.Input<inputs.privateca.v1beta1.X509Extension>[]>;
            /**
             * Contains only valid, fully-qualified host names.
             */
            dnsNames?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Contains only valid RFC 2822 E-mail addresses.
             */
            emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
             */
            ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Contains only valid RFC 3986 URIs.
             */
            uris?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * These values are used to create the distinguished name and subject alternative name fields in an X.509 certificate.
         */
        interface SubjectConfig {
            /**
             * Optional. The "common name" of the distinguished name.
             */
            commonName?: pulumi.Input<string>;
            /**
             * Required. Contains distinguished name fields such as the location and organization.
             */
            subject?: pulumi.Input<inputs.privateca.v1beta1.Subject>;
            /**
             * Optional. The subject alternative name fields.
             */
            subjectAltName?: pulumi.Input<inputs.privateca.v1beta1.SubjectAltNames>;
        }
        /**
         * Describes a subordinate CA's issuers. This is either a resource path to a known issuing CertificateAuthority, or a PEM issuer certificate chain.
         */
        interface SubordinateConfig {
            /**
             * Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*&#47;locations/*&#47;certificateAuthorities/*`.
             */
            certificateAuthority?: pulumi.Input<string>;
            /**
             * Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.
             */
            pemIssuerChain?: pulumi.Input<inputs.privateca.v1beta1.SubordinateConfigChain>;
        }
        /**
         * This message describes a subordinate CA's issuer certificate chain. This wrapper exists for compatibility reasons.
         */
        interface SubordinateConfigChain {
            /**
             * Required. Expected to be in leaf-to-root order according to RFC 5246.
             */
            pemCertificates?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * An X509Extension specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
         */
        interface X509Extension {
            /**
             * Required. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
             */
            critical?: pulumi.Input<boolean>;
            /**
             * Required. The OID for this X.509 extension.
             */
            objectId?: pulumi.Input<inputs.privateca.v1beta1.ObjectId>;
            /**
             * Required. The value of this X.509 extension.
             */
            value?: pulumi.Input<string>;
        }
    }
}
export declare namespace pubsub {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.pubsub.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Dead lettering is done on a best effort basis. The same message might be dead lettered multiple times. If validation on any of the fields fails at subscription creation/updation, the create/update subscription request will fail.
         */
        interface DeadLetterPolicy {
            /**
             * The name of the topic to which dead letter messages should be published. Format is `projects/{project}/topics/{topic}`.The Cloud Pub/Sub service account associated with the enclosing subscription's parent project (i.e., service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have permission to Publish() to this topic. The operation will fail if the topic does not exist. Users should ensure that there is a subscription attached to this topic since messages published to a topic with no subscriptions are lost.
             */
            deadLetterTopic?: pulumi.Input<string>;
            /**
             * The maximum number of delivery attempts for any message. The value must be between 5 and 100. The number of delivery attempts is defined as 1 + (the sum of number of NACKs and number of times the acknowledgement deadline has been exceeded for the message). A NACK is any call to ModifyAckDeadline with a 0 deadline. Note that client libraries may automatically extend ack_deadlines. This field will be honored on a best effort basis. If this parameter is 0, a default value of 5 is used.
             */
            maxDeliveryAttempts?: pulumi.Input<number>;
        }
        /**
         * A policy that specifies the conditions for resource expiration (i.e., automatic resource deletion).
         */
        interface ExpirationPolicy {
            /**
             * Specifies the "time-to-live" duration for an associated resource. The resource expires if it is not active for a period of `ttl`. The definition of "activity" depends on the type of the associated resource. The minimum and maximum allowed values for `ttl` depend on the type of the associated resource, as well. If `ttl` is not set, the associated resource never expires.
             */
            ttl?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A policy constraining the storage of messages published to the topic.
         */
        interface MessageStoragePolicy {
            /**
             * A list of IDs of GCP regions where messages that are published to the topic may be persisted in storage. Messages published by publishers running in non-allowed GCP regions (or running outside of GCP altogether) will be routed for storage in one of the allowed regions. An empty list means that no regions are allowed, and is not a valid configuration.
             */
            allowedPersistenceRegions?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect).
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. The audience claim identifies the recipients that the JWT is intended for. The audience value is a single case-sensitive string. Having multiple values (array) for the audience field is not supported. More info about the OIDC JWT token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3 Note: if not specified, the Push endpoint URL will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating the OIDC token. The caller (for CreateSubscription, UpdateSubscription, and ModifyPushConfig RPCs) must have the iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Configuration for a push delivery endpoint.
         */
        interface PushConfig {
            /**
             * Endpoint configuration attributes that can be used to control different aspects of the message delivery. The only currently supported attribute is `x-goog-version`, which you can use to change the format of the pushed message. This attribute indicates the version of the data expected by the endpoint. This controls the shape of the pushed message (i.e., its fields and metadata). If not present during the `CreateSubscription` call, it will default to the version of the Pub/Sub API used to make such call. If not present in a `ModifyPushConfig` call, its value will not be changed. `GetSubscription` calls will always return a valid version, even if the subscription was created without this attribute. The only supported values for the `x-goog-version` attribute are: * `v1beta1`: uses the push format defined in the v1beta1 Pub/Sub API. * `v1` or `v1beta2`: uses the push format defined in the v1 Pub/Sub API. For example: attributes { "x-goog-version": "v1" }
             */
            attributes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * If specified, Pub/Sub will generate and attach an OIDC JWT token as an `Authorization` header in the HTTP request for every pushed message.
             */
            oidcToken?: pulumi.Input<inputs.pubsub.v1.OidcToken>;
            /**
             * A URL locating the endpoint to which messages should be pushed. For example, a Webhook endpoint might use `https://example.com/push`.
             */
            pushEndpoint?: pulumi.Input<string>;
        }
        /**
         * A policy that specifies how Cloud Pub/Sub retries message delivery. Retry delay will be exponential based on provided minimum and maximum backoffs. https://en.wikipedia.org/wiki/Exponential_backoff. RetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message. Retry Policy is implemented on a best effort basis. At times, the delay between consecutive deliveries may not match the configuration. That is, delay can be more or less than configured backoff.
         */
        interface RetryPolicy {
            /**
             * The maximum delay between consecutive deliveries of a given message. Value should be between 0 and 600 seconds. Defaults to 600 seconds.
             */
            maximumBackoff?: pulumi.Input<string>;
            /**
             * The minimum delay between consecutive deliveries of a given message. Value should be between 0 and 600 seconds. Defaults to 10 seconds.
             */
            minimumBackoff?: pulumi.Input<string>;
        }
        /**
         * Settings for validating messages published against a schema.
         */
        interface SchemaSettings {
            /**
             * The encoding of messages validated against `schema`.
             */
            encoding?: pulumi.Input<string>;
            /**
             * Required. The name of the schema that messages published should be validated against. Format is `projects/{project}/schemas/{schema}`. The value of this field will be `_deleted-schema_` if the schema has been deleted.
             */
            schema?: pulumi.Input<string>;
        }
    }
    namespace v1beta1a {
        /**
         * Configuration for a push delivery endpoint.
         */
        interface PushConfig {
            /**
             * A URL locating the endpoint to which messages should be pushed. For example, a Webhook endpoint might use "https://example.com/push".
             */
            pushEndpoint?: pulumi.Input<string>;
        }
    }
    namespace v1beta2 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.pubsub.v1beta2.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect).
         */
        interface OidcToken {
            /**
             * Audience to be used when generating OIDC token. The audience claim identifies the recipients that the JWT is intended for. The audience value is a single case-sensitive string. Having multiple values (array) for the audience field is not supported. More info about the OIDC JWT token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3 Note: if not specified, the Push endpoint URL will be used.
             */
            audience?: pulumi.Input<string>;
            /**
             * [Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating the OIDC token. The caller (for CreateSubscription, UpdateSubscription, and ModifyPushConfig RPCs) must have the iam.serviceAccounts.actAs permission for the service account.
             */
            serviceAccountEmail?: pulumi.Input<string>;
        }
        /**
         * Configuration for a push delivery endpoint.
         */
        interface PushConfig {
            /**
             * Endpoint configuration attributes. Every endpoint has a set of API supported attributes that can be used to control different aspects of the message delivery. The currently supported attribute is `x-goog-version`, which you can use to change the format of the push message. This attribute indicates the version of the data expected by the endpoint. This controls the shape of the envelope (i.e. its fields and metadata). The endpoint version is based on the version of the Pub/Sub API. If not present during the `CreateSubscription` call, it will default to the version of the API used to make such call. If not present during a `ModifyPushConfig` call, its value will not be changed. `GetSubscription` calls will always return a valid version, even if the subscription was created without this attribute. The possible values for this attribute are: * `v1beta1`: uses the push format defined in the v1beta1 Pub/Sub API. * `v1` or `v1beta2`: uses the push format defined in the v1 Pub/Sub API.
             */
            attributes?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * If specified, Pub/Sub will generate and attach an OIDC JWT token as an `Authorization` header in the HTTP request for every pushed message.
             */
            oidcToken?: pulumi.Input<inputs.pubsub.v1beta2.OidcToken>;
            /**
             * A URL locating the endpoint to which messages should be pushed. For example, a Webhook endpoint might use "https://example.com/push".
             */
            pushEndpoint?: pulumi.Input<string>;
        }
    }
}
export declare namespace pubsublite {
    namespace v1 {
        /**
         * The throughput capacity configuration for each partition.
         */
        interface Capacity {
            /**
             * Publish throughput capacity per partition in MiB/s. Must be >= 4 and <= 16.
             */
            publishMibPerSec?: pulumi.Input<number>;
            /**
             * Subscribe throughput capacity per partition in MiB/s. Must be >= 4 and <= 32.
             */
            subscribeMibPerSec?: pulumi.Input<number>;
        }
        /**
         * The settings for a subscription's message delivery.
         */
        interface DeliveryConfig {
            /**
             * The DeliveryRequirement for this subscription.
             */
            deliveryRequirement?: pulumi.Input<string>;
        }
        /**
         * The settings for a topic's partitions.
         */
        interface PartitionConfig {
            /**
             * The capacity configuration.
             */
            capacity?: pulumi.Input<inputs.pubsublite.v1.Capacity>;
            /**
             * The number of partitions in the topic. Must be at least 1. Once a topic has been created the number of partitions can be increased but not decreased. Message ordering is not guaranteed across a topic resize. For more information see https://cloud.google.com/pubsub/lite/docs/topics#scaling_capacity
             */
            count?: pulumi.Input<string>;
            /**
             * DEPRECATED: Use capacity instead which can express a superset of configurations. Every partition in the topic is allocated throughput equivalent to `scale` times the standard partition throughput (4 MiB/s). This is also reflected in the cost of this topic; a topic with `scale` of 2 and count of 10 is charged for 20 partitions. This value must be in the range [1,4].
             */
            scale?: pulumi.Input<number>;
        }
        /**
         * The settings for a topic's message retention.
         */
        interface RetentionConfig {
            /**
             * The provisioned storage, in bytes, per partition. If the number of bytes stored in any of the topic's partitions grows beyond this value, older messages will be dropped to make room for newer ones, regardless of the value of `period`.
             */
            perPartitionBytes?: pulumi.Input<string>;
            /**
             * How long a published message is retained. If unset, messages will be retained as long as the bytes retained for each partition is below `per_partition_bytes`.
             */
            period?: pulumi.Input<string>;
        }
    }
}
export declare namespace recommendationengine {
    namespace v1beta1 {
        /**
         * Category represents catalog item category hierarchy.
         */
        interface GoogleCloudRecommendationengineV1beta1CatalogItemCategoryHierarchy {
            /**
             * Required. Catalog item categories. Each category should be a UTF-8 encoded string with a length limit of 2 KiB. Note that the order in the list denotes the specificity (from least to most specific).
             */
            categories?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * FeatureMap represents extra features that customers want to include in the recommendation model for catalogs/user events as categorical/numerical features.
         */
        interface GoogleCloudRecommendationengineV1beta1FeatureMap {
            /**
             * Categorical features that can take on one of a limited number of possible values. Some examples would be the brand/maker of a product, or country of a customer. Feature names and values must be UTF-8 encoded strings. For example: `{ "colors": {"value": ["yellow", "green"]}, "sizes": {"value":["S", "M"]}`
             */
            categoricalFeatures?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Numerical features. Some examples would be the height/weight of a product, or age of a customer. Feature names must be UTF-8 encoded strings. For example: `{ "lengths_cm": {"value":[2.3, 15.4]}, "heights_cm": {"value":[8.1, 6.4]} }`
             */
            numericalFeatures?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Catalog item thumbnail/detail image.
         */
        interface GoogleCloudRecommendationengineV1beta1Image {
            /**
             * Optional. Height of the image in number of pixels.
             */
            height?: pulumi.Input<number>;
            /**
             * Required. URL of the image with a length limit of 5 KiB.
             */
            uri?: pulumi.Input<string>;
            /**
             * Optional. Width of the image in number of pixels.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * Registered Api Key.
         */
        interface GoogleCloudRecommendationengineV1beta1PredictionApiKeyRegistration {
            /**
             * The API key.
             */
            apiKey?: pulumi.Input<string>;
        }
        /**
         * ProductCatalogItem captures item metadata specific to retail products.
         */
        interface GoogleCloudRecommendationengineV1beta1ProductCatalogItem {
            /**
             * Optional. The available quantity of the item.
             */
            availableQuantity?: pulumi.Input<string>;
            /**
             * Optional. Canonical URL directly linking to the item detail page with a length limit of 5 KiB..
             */
            canonicalProductUri?: pulumi.Input<string>;
            /**
             * Optional. A map to pass the costs associated with the product. For example: {"manufacturing": 45.5} The profit of selling this item is computed like so: * If 'exactPrice' is provided, profit = displayPrice - sum(costs) * If 'priceRange' is provided, profit = minPrice - sum(costs)
             */
            costs?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Optional. Only required if the price is set. Currency code for price/costs. Use three-character ISO-4217 code.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Optional. The exact product price.
             */
            exactPrice?: pulumi.Input<inputs.recommendationengine.v1beta1.GoogleCloudRecommendationengineV1beta1ProductCatalogItemExactPrice>;
            /**
             * Optional. Product images for the catalog item.
             */
            images?: pulumi.Input<pulumi.Input<inputs.recommendationengine.v1beta1.GoogleCloudRecommendationengineV1beta1Image>[]>;
            /**
             * Optional. The product price range.
             */
            priceRange?: pulumi.Input<inputs.recommendationengine.v1beta1.GoogleCloudRecommendationengineV1beta1ProductCatalogItemPriceRange>;
            /**
             * Optional. Online stock state of the catalog item. Default is `IN_STOCK`.
             */
            stockState?: pulumi.Input<string>;
        }
        /**
         * Exact product price.
         */
        interface GoogleCloudRecommendationengineV1beta1ProductCatalogItemExactPrice {
            /**
             * Optional. Display price of the product.
             */
            displayPrice?: pulumi.Input<number>;
            /**
             * Optional. Price of the product without any discount. If zero, by default set to be the 'displayPrice'.
             */
            originalPrice?: pulumi.Input<number>;
        }
        /**
         * Product price range when there are a range of prices for different variations of the same product.
         */
        interface GoogleCloudRecommendationengineV1beta1ProductCatalogItemPriceRange {
            /**
             * Required. The maximum product price.
             */
            max?: pulumi.Input<number>;
            /**
             * Required. The minimum product price.
             */
            min?: pulumi.Input<number>;
        }
    }
}
export declare namespace redis {
    namespace v1 {
    }
    namespace v1beta1 {
    }
}
export declare namespace remotebuildexecution {
    namespace v1alpha {
        /**
         * AcceleratorConfig defines the accelerator cards to attach to the VM.
         */
        interface GoogleDevtoolsRemotebuildexecutionAdminV1alphaAcceleratorConfig {
            /**
             * The number of guest accelerator cards exposed to each VM.
             */
            acceleratorCount?: pulumi.Input<string>;
            /**
             * The type of accelerator to attach to each VM, e.g. "nvidia-tesla-k80" for nVidia Tesla K80.
             */
            acceleratorType?: pulumi.Input<string>;
        }
        /**
         * Autoscale defines the autoscaling policy of a worker pool.
         */
        interface GoogleDevtoolsRemotebuildexecutionAdminV1alphaAutoscale {
            /**
             * The maximal number of workers. Must be equal to or greater than min_size.
             */
            maxSize?: pulumi.Input<string>;
            /**
             * The minimal number of workers. Must be greater than 0.
             */
            minSize?: pulumi.Input<string>;
        }
        /**
         * FeaturePolicy defines features allowed to be used on RBE instances, as well as instance-wide behavior changes that take effect without opt-in or opt-out at usage time.
         */
        interface GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicy {
            /**
             * Which container image sources are allowed. Currently only RBE-supported registry (gcr.io) is allowed. One can allow all repositories under a project or one specific repository only. E.g. container_image_sources { policy: RESTRICTED allowed_values: [ "gcr.io/project-foo", "gcr.io/project-bar/repo-baz", ] } will allow any repositories under "gcr.io/project-foo" plus the repository "gcr.io/project-bar/repo-baz". Default (UNSPECIFIED) is equivalent to any source is allowed.
             */
            containerImageSources?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerAddCapabilities can be used or what capabilities are allowed.
             */
            dockerAddCapabilities?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerChrootPath can be used.
             */
            dockerChrootPath?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerNetwork can be used or what network modes are allowed. E.g. one may allow `off` value only via `allowed_values`.
             */
            dockerNetwork?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerPrivileged can be used.
             */
            dockerPrivileged?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerRunAsRoot can be used.
             */
            dockerRunAsRoot?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerRuntime is allowed to be set or what runtimes are allowed. Note linux_isolation takes precedence, and if set, docker_runtime values may be rejected if they are incompatible with the selected isolation.
             */
            dockerRuntime?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * Whether dockerSiblingContainers can be used.
             */
            dockerSiblingContainers?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature>;
            /**
             * linux_isolation allows overriding the docker runtime used for containers started on Linux.
             */
            linuxIsolation?: pulumi.Input<string>;
        }
        /**
         * Defines whether a feature can be used or what values are accepted.
         */
        interface GoogleDevtoolsRemotebuildexecutionAdminV1alphaFeaturePolicyFeature {
            /**
             * A list of acceptable values. Only effective when the policy is `RESTRICTED`.
             */
            allowedValues?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The policy of the feature.
             */
            policy?: pulumi.Input<string>;
        }
        /**
         * Defines the configuration to be used for creating workers in the worker pool.
         */
        interface GoogleDevtoolsRemotebuildexecutionAdminV1alphaWorkerConfig {
            /**
             * The accelerator card attached to each VM.
             */
            accelerator?: pulumi.Input<inputs.remotebuildexecution.v1alpha.GoogleDevtoolsRemotebuildexecutionAdminV1alphaAcceleratorConfig>;
            /**
             * Required. Size of the disk attached to the worker, in GB. See https://cloud.google.com/compute/docs/disks/
             */
            diskSizeGb?: pulumi.Input<string>;
            /**
             * Required. Disk Type to use for the worker. See [Storage options](https://cloud.google.com/compute/docs/disks/#introduction). Currently only `pd-standard` and `pd-ssd` are supported.
             */
            diskType?: pulumi.Input<string>;
            /**
             * Labels associated with the workers. Label keys and values can be no longer than 63 characters, can only contain lowercase letters, numeric characters, underscores and dashes. International letters are permitted. Label keys must start with a letter. Label values are optional. There can not be more than 64 labels per resource.
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Required. Machine type of the worker, such as `e2-standard-2`. See https://cloud.google.com/compute/docs/machine-types for a list of supported machine types. Note that `f1-micro` and `g1-small` are not yet supported.
             */
            machineType?: pulumi.Input<string>;
            /**
             * The maximum number of actions a worker can execute concurrently.
             */
            maxConcurrentActions?: pulumi.Input<string>;
            /**
             * Minimum CPU platform to use when creating the worker. See [CPU Platforms](https://cloud.google.com/compute/docs/cpu-platforms).
             */
            minCpuPlatform?: pulumi.Input<string>;
            /**
             * Determines the type of network access granted to workers. Possible values: - "public": Workers can connect to the public internet. - "private": Workers can only connect to Google APIs and services. - "restricted-private": Workers can only connect to Google APIs that are reachable through `restricted.googleapis.com` (`199.36.153.4/30`).
             */
            networkAccess?: pulumi.Input<string>;
            /**
             * Determines whether the worker is reserved (equivalent to a Compute Engine on-demand VM and therefore won't be preempted). See [Preemptible VMs](https://cloud.google.com/preemptible-vms/) for more details.
             */
            reserved?: pulumi.Input<boolean>;
            /**
             * The node type name to be used for sole-tenant nodes.
             */
            soleTenantNodeType?: pulumi.Input<string>;
            /**
             * The name of the image used by each VM.
             */
            vmImage?: pulumi.Input<string>;
        }
    }
}
export declare namespace retail {
    namespace v2 {
        /**
         * Product thumbnail/detail image.
         */
        interface GoogleCloudRetailV2Image {
            /**
             * Height of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            height?: pulumi.Input<number>;
            /**
             * Required. URI of the image. This field must be a valid UTF-8 encoded URI with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [image_link](https://support.google.com/merchants/answer/6324350). Schema.org property [Product.image](https://schema.org/image).
             */
            uri?: pulumi.Input<string>;
            /**
             * Width of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * The price information of a Product.
         */
        interface GoogleCloudRetailV2PriceInfo {
            /**
             * The costs associated with the sale of a particular product. Used for gross profit reporting. * Profit = price - cost Google Merchant Center property [cost_of_goods_sold](https://support.google.com/merchants/answer/9017895).
             */
            cost?: pulumi.Input<number>;
            /**
             * The 3-letter currency code defined in [ISO 4217](https://www.iso.org/iso-4217-currency-codes.html). If this field is an unrecognizable currency code, an INVALID_ARGUMENT error is returned.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Price of the product without any discount. If zero, by default set to be the price.
             */
            originalPrice?: pulumi.Input<number>;
            /**
             * Price of the product. Google Merchant Center property [price](https://support.google.com/merchants/answer/6324371). Schema.org property [Offer.priceSpecification](https://schema.org/priceSpecification).
             */
            price?: pulumi.Input<number>;
        }
    }
    namespace v2alpha {
        /**
         * Product thumbnail/detail image.
         */
        interface GoogleCloudRetailV2alphaImage {
            /**
             * Height of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            height?: pulumi.Input<number>;
            /**
             * Required. URI of the image. This field must be a valid UTF-8 encoded URI with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [image_link](https://support.google.com/merchants/answer/6324350). Schema.org property [Product.image](https://schema.org/image).
             */
            uri?: pulumi.Input<string>;
            /**
             * Width of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * The price information of a Product.
         */
        interface GoogleCloudRetailV2alphaPriceInfo {
            /**
             * The costs associated with the sale of a particular product. Used for gross profit reporting. * Profit = price - cost Google Merchant Center property [cost_of_goods_sold](https://support.google.com/merchants/answer/9017895).
             */
            cost?: pulumi.Input<number>;
            /**
             * The 3-letter currency code defined in [ISO 4217](https://www.iso.org/iso-4217-currency-codes.html). If this field is an unrecognizable currency code, an INVALID_ARGUMENT error is returned.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Price of the product without any discount. If zero, by default set to be the price.
             */
            originalPrice?: pulumi.Input<number>;
            /**
             * Price of the product. Google Merchant Center property [price](https://support.google.com/merchants/answer/6324371). Schema.org property [Offer.priceSpecification](https://schema.org/priceSpecification).
             */
            price?: pulumi.Input<number>;
        }
    }
    namespace v2beta {
        /**
         * Product thumbnail/detail image.
         */
        interface GoogleCloudRetailV2betaImage {
            /**
             * Height of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            height?: pulumi.Input<number>;
            /**
             * Required. URI of the image. This field must be a valid UTF-8 encoded URI with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [image_link](https://support.google.com/merchants/answer/6324350). Schema.org property [Product.image](https://schema.org/image).
             */
            uri?: pulumi.Input<string>;
            /**
             * Width of the image in number of pixels. This field must be nonnegative. Otherwise, an INVALID_ARGUMENT error is returned.
             */
            width?: pulumi.Input<number>;
        }
        /**
         * The price information of a Product.
         */
        interface GoogleCloudRetailV2betaPriceInfo {
            /**
             * The costs associated with the sale of a particular product. Used for gross profit reporting. * Profit = price - cost Google Merchant Center property [cost_of_goods_sold](https://support.google.com/merchants/answer/9017895).
             */
            cost?: pulumi.Input<number>;
            /**
             * The 3-letter currency code defined in [ISO 4217](https://www.iso.org/iso-4217-currency-codes.html). If this field is an unrecognizable currency code, an INVALID_ARGUMENT error is returned.
             */
            currencyCode?: pulumi.Input<string>;
            /**
             * Price of the product without any discount. If zero, by default set to be the price.
             */
            originalPrice?: pulumi.Input<number>;
            /**
             * Price of the product. Google Merchant Center property [price](https://support.google.com/merchants/answer/6324371). Schema.org property [Offer.priceSpecification](https://schema.org/priceSpecification).
             */
            price?: pulumi.Input<number>;
        }
    }
}
export declare namespace run {
    namespace v1 {
        /**
         * Information for connecting over HTTP(s).
         */
        interface Addressable {
            url?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.run.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.run.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported ConfigMapEnvSource selects a ConfigMap to populate the environment variables with. The contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.
         */
        interface ConfigMapEnvSource {
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The ConfigMap to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the ConfigMap must be defined
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Selects a key from a ConfigMap.
         */
        interface ConfigMapKeySelector {
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The key to select.
             */
            key?: pulumi.Input<string>;
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The ConfigMap to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the ConfigMap or its key must be defined
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
         */
        interface ConfigMapVolumeSource {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
             */
            defaultMode?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional.
             */
            items?: pulumi.Input<pulumi.Input<inputs.run.v1.KeyToPath>[]>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Name of the config.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the Secret or its keys must be defined.
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * A single application container. This specifies both the container to run, the command to run in the container and the arguments to supply to it. Note that additional arguments may be supplied by the system to the container at runtime.
         */
        interface Container {
            /**
             * (Optional) Cloud Run fully managed: supported Cloud Run for Anthos: supported Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            command?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * (Optional) Cloud Run fully managed: supported Cloud Run for Anthos: supported List of environment variables to set in the container.
             */
            env?: pulumi.Input<pulumi.Input<inputs.run.v1.EnvVar>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.
             */
            envFrom?: pulumi.Input<pulumi.Input<inputs.run.v1.EnvFromSource>[]>;
            /**
             * Cloud Run fully managed: only supports containers from Google Container Registry Cloud Run for Anthos: supported URL of the Container image. More info: https://kubernetes.io/docs/concepts/containers/images
             */
            image?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
             */
            imagePullPolicy?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
             */
            livenessProbe?: pulumi.Input<inputs.run.v1.Probe>;
            /**
             * (Optional) Name of the container specified as a DNS_LABEL. Currently unused in Cloud Run. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#dns-label-names
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible. If omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on.
             */
            ports?: pulumi.Input<pulumi.Input<inputs.run.v1.ContainerPort>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
             */
            readinessProbe?: pulumi.Input<inputs.run.v1.Probe>;
            /**
             * (Optional) Cloud Run fully managed: supported Cloud Run for Anthos: supported Compute Resources required by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
             */
            resources?: pulumi.Input<inputs.run.v1.ResourceRequirements>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Security options the pod should run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
             */
            securityContext?: pulumi.Input<inputs.run.v1.SecurityContext>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log.
             */
            terminationMessagePath?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
             */
            terminationMessagePolicy?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: supported Volume to mount into the container's filesystem. Only supports SecretVolumeSources. Cloud Run for Anthos: supported Pod volumes to mount into the container's filesystem.
             */
            volumeMounts?: pulumi.Input<pulumi.Input<inputs.run.v1.VolumeMount>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image.
             */
            workingDir?: pulumi.Input<string>;
        }
        /**
         * ContainerPort represents a network port in a single container.
         */
        interface ContainerPort {
            /**
             * (Optional) Port number the container listens on. This must be a valid port number, 0 < x < 65536.
             */
            containerPort?: pulumi.Input<number>;
            /**
             * (Optional) If specified, used to specify which protocol to use. Allowed values are "http1" and "h2c".
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Protocol for port. Must be "TCP". Defaults to "TCP".
             */
            protocol?: pulumi.Input<string>;
        }
        /**
         * The desired state of the Domain Mapping.
         */
        interface DomainMappingSpec {
            /**
             * The mode of the certificate.
             */
            certificateMode?: pulumi.Input<string>;
            /**
             * If set, the mapping will override any mapping set before this spec was set. It is recommended that the user leaves this empty to receive an error warning about a potential conflict and only set it once the respective UI has given such a warning.
             */
            forceOverride?: pulumi.Input<boolean>;
            /**
             * The name of the Knative Route that this DomainMapping applies to. The route must exist.
             */
            routeName?: pulumi.Input<string>;
        }
        /**
         * The current state of the Domain Mapping.
         */
        interface DomainMappingStatus {
            /**
             * Array of observed DomainMappingConditions, indicating the current state of the DomainMapping.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.run.v1.GoogleCloudRunV1Condition>[]>;
            /**
             * The name of the route that the mapping currently points to.
             */
            mappedRouteName?: pulumi.Input<string>;
            /**
             * ObservedGeneration is the 'Generation' of the DomainMapping that was last processed by the controller. Clients polling for completed reconciliation should poll until observedGeneration = metadata.generation and the Ready condition's status is True or False.
             */
            observedGeneration?: pulumi.Input<number>;
            /**
             * The resource records required to configure this domain mapping. These records must be added to the domain's DNS configuration in order to serve the application via this domain mapping.
             */
            resourceRecords?: pulumi.Input<pulumi.Input<inputs.run.v1.ResourceRecord>[]>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Holds the URL that will serve the traffic of the DomainMapping. +optional
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported EnvFromSource represents the source of a set of ConfigMaps
         */
        interface EnvFromSource {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported The ConfigMap to select from
             */
            configMapRef?: pulumi.Input<inputs.run.v1.ConfigMapEnvSource>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
             */
            prefix?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported The Secret to select from
             */
            secretRef?: pulumi.Input<inputs.run.v1.SecretEnvSource>;
        }
        /**
         * EnvVar represents an environment variable present in a Container.
         */
        interface EnvVar {
            /**
             * Name of the environment variable. Must be a C_IDENTIFIER.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any route environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".
             */
            value?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: supported Source for the environment variable's value. Only supports secret_key_ref. Cloud Run for Anthos: supported Source for the environment variable's value. Cannot be used if value is not empty.
             */
            valueFrom?: pulumi.Input<inputs.run.v1.EnvVarSource>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported EnvVarSource represents a source for the value of an EnvVar.
         */
        interface EnvVarSource {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Selects a key of a ConfigMap.
             */
            configMapKeyRef?: pulumi.Input<inputs.run.v1.ConfigMapKeySelector>;
            /**
             * (Optional) Cloud Run fully managed: supported. Selects a key (version) of a secret in Secret Manager. Cloud Run for Anthos: supported. Selects a key of a secret in the pod's namespace.
             */
            secretKeyRef?: pulumi.Input<inputs.run.v1.SecretKeySelector>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported ExecAction describes a "run in container" action.
         */
        interface ExecAction {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
             */
            command?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Condition defines a generic condition for a Resource
         */
        interface GoogleCloudRunV1Condition {
            /**
             * Optional. Last time the condition transitioned from one status to another.
             */
            lastTransitionTime?: pulumi.Input<string>;
            /**
             * Optional. Human readable message indicating details about the current status.
             */
            message?: pulumi.Input<string>;
            /**
             * Optional. One-word CamelCase reason for the condition's last transition.
             */
            reason?: pulumi.Input<string>;
            /**
             * Optional. How to interpret failures of this condition, one of Error, Warning, Info
             */
            severity?: pulumi.Input<string>;
            /**
             * Status of the condition, one of True, False, Unknown.
             */
            status?: pulumi.Input<string>;
            /**
             * type is used to communicate the status of the reconciliation process. See also: https://github.com/knative/serving/blob/master/docs/spec/errors.md#error-conditions-and-reporting Types common to all resources include: * "Ready": True when the Resource is ready.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported HTTPGetAction describes an action based on HTTP Get requests.
         */
        interface HTTPGetAction {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
             */
            host?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Custom headers to set in the request. HTTP allows repeated headers.
             */
            httpHeaders?: pulumi.Input<pulumi.Input<inputs.run.v1.HTTPHeader>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Path to access on the HTTP server.
             */
            path?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Scheme to use for connecting to the host. Defaults to HTTP.
             */
            scheme?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported HTTPHeader describes a custom header to be used in HTTP probes
         */
        interface HTTPHeader {
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The header field name
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The header field value
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: supported Cloud Run for Anthos: supported Maps a string key to a path within a volume.
         */
        interface KeyToPath {
            /**
             * Cloud Run fully managed: supported The Cloud Secret Manager secret version. Can be 'latest' for the latest value or an integer for a specific version. Cloud Run for Anthos: supported The key to project.
             */
            key?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Mode bits to use on this file, must be a value between 0000 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
             */
            mode?: pulumi.Input<number>;
            /**
             * Cloud Run fully managed: supported Cloud Run for Anthos: supported The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
         */
        interface LocalObjectReference {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
             */
            name?: pulumi.Input<string>;
        }
        /**
         * k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
         */
        interface ObjectMeta {
            /**
             * (Optional) Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
             */
            annotations?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
             */
            clusterName?: pulumi.Input<string>;
            /**
             * (Optional) CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
             */
            deletionGracePeriodSeconds?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
             */
            deletionTimestamp?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. +patchStrategy=merge
             */
            finalizers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#idempotency string generateName = 2;
             */
            generateName?: pulumi.Input<string>;
            /**
             * (Optional) A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
             */
            generation?: pulumi.Input<number>;
            /**
             * (Optional) Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and routes. More info: http://kubernetes.io/docs/user-guide/labels
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Name must be unique within a namespace, within a Cloud Run region. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +optional
             */
            name?: pulumi.Input<string>;
            /**
             * Namespace defines the space within each name must be unique, within a Cloud Run region. In Cloud Run the namespace must be equal to either the project ID or project number.
             */
            namespace?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported List of objects that own this object. If ALL objects in the list have been deleted, this object will be garbage collected.
             */
            ownerReferences?: pulumi.Input<pulumi.Input<inputs.run.v1.OwnerReference>[]>;
            /**
             * Optional. An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server or omit the value to disable conflict-detection. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients or omitted. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
             */
            resourceVersion?: pulumi.Input<string>;
            /**
             * (Optional) SelfLink is a URL representing this object. Populated by the system. Read-only. string selfLink = 4;
             */
            selfLink?: pulumi.Input<string>;
            /**
             * (Optional) UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * OwnerReference contains enough information to let you identify an owning object. Currently, an owning object must be in the same namespace, so there is no namespace field.
         */
        interface OwnerReference {
            /**
             * API version of the referent.
             */
            apiVersion?: pulumi.Input<string>;
            /**
             * If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned. +optional
             */
            blockOwnerDeletion?: pulumi.Input<boolean>;
            /**
             * If true, this reference points to the managing controller. +optional
             */
            controller?: pulumi.Input<boolean>;
            /**
             * Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             */
            kind?: pulumi.Input<string>;
            /**
             * Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
             */
            name?: pulumi.Input<string>;
            /**
             * UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.
         */
        interface Probe {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported One and only one of the following should be specified. Exec specifies the action to take. A field inlined from the Handler message.
             */
            exec?: pulumi.Input<inputs.run.v1.ExecAction>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported HTTPGet specifies the http request to perform. A field inlined from the Handler message.
             */
            httpGet?: pulumi.Input<inputs.run.v1.HTTPGetAction>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
             */
            initialDelaySeconds?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1.
             */
            periodSeconds?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness. Minimum value is 1.
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported A field inlined from the Handler message.
             */
            tcpSocket?: pulumi.Input<inputs.run.v1.TCPSocketAction>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
             */
            timeoutSeconds?: pulumi.Input<number>;
        }
        /**
         * A DNS resource record.
         */
        interface ResourceRecord {
            /**
             * Relative name of the object affected by this record. Only applicable for `CNAME` records. Example: 'www'.
             */
            name?: pulumi.Input<string>;
            /**
             * Data for this record. Values vary by record type, as defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1).
             */
            rrdata?: pulumi.Input<string>;
            /**
             * Resource record type. Example: `AAAA`.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * ResourceRequirements describes the compute resource requirements.
         */
        interface ResourceRequirements {
            /**
             * (Optional) Cloud Run fully managed: Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', and '4'. Setting 4 CPU requires at least 2Gi of memory. Cloud Run for Anthos: supported Limits describes the maximum amount of compute resources allowed. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
             */
            limits?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * (Optional) Cloud Run fully managed: Only memory and CPU are supported. Note: The only supported values for CPU are '1' and '2'. Cloud Run for Anthos: supported Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
             */
            requests?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * RevisionSpec holds the desired state of the Revision (from the client).
         */
        interface RevisionSpec {
            /**
             * (Optional) ContainerConcurrency specifies the maximum allowed in-flight (concurrent) requests per container instance of the Revision. Cloud Run fully managed: supported, defaults to 80 Cloud Run for Anthos: supported, defaults to 0, which means concurrency to the application is not limited, and the system decides the target concurrency for the autoscaler.
             */
            containerConcurrency?: pulumi.Input<number>;
            /**
             * Containers holds the single container that defines the unit of execution for this Revision. In the context of a Revision, we disallow a number of fields on this Container, including: name and lifecycle. In Cloud Run, only a single container may be provided. The runtime contract is documented here: https://github.com/knative/serving/blob/master/docs/runtime-contract.md
             */
            containers?: pulumi.Input<pulumi.Input<inputs.run.v1.Container>[]>;
            /**
             * Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             */
            serviceAccountName?: pulumi.Input<string>;
            /**
             * TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Cloud Run fully managed: defaults to 300 seconds (5 minutes). Maximum allowed value is 900 seconds (15 minutes). Cloud Run for Anthos: defaults to 300 seconds (5 minutes). Maximum allowed value is configurable by the cluster operator.
             */
            timeoutSeconds?: pulumi.Input<number>;
            volumes?: pulumi.Input<pulumi.Input<inputs.run.v1.Volume>[]>;
        }
        /**
         * RevisionTemplateSpec describes the data a revision should have when created from a template. Based on: https://github.com/kubernetes/api/blob/e771f807/core/v1/types.go#L3179-L3190
         */
        interface RevisionTemplate {
            /**
             * Optional metadata for this Revision, including labels and annotations. Name will be generated by the Configuration. The following annotation keys set properties of the created revision: * `autoscaling.knative.dev/minScale` sets the minimum number of instances. * `autoscaling.knative.dev/maxScale` sets the maximum number of instances. * `run.googleapis.com/cloudsql-instances` sets Cloud SQL connections. Multiple values should be comma separated. * `run.googleapis.com/vpc-access-connector` sets a Serverless VPC Access connector. * `run.googleapis.com/vpc-access-egress` sets VPC egress. Supported values are `all` and `private-ranges-only`.
             */
            metadata?: pulumi.Input<inputs.run.v1.ObjectMeta>;
            /**
             * RevisionSpec holds the desired state of the Revision (from the client).
             */
            spec?: pulumi.Input<inputs.run.v1.RevisionSpec>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported SecretEnvSource selects a Secret to populate the environment variables with. The contents of the target Secret's Data field will represent the key-value pairs as environment variables.
         */
        interface SecretEnvSource {
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The Secret to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the Secret must be defined
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported SecretKeySelector selects a key of a Secret.
         */
        interface SecretKeySelector {
            /**
             * Cloud Run fully managed: supported A Cloud Secret Manager secret version. Must be 'latest' for the latest version or an integer for a specific version. Cloud Run for Anthos: supported The key of the secret to select from. Must be a valid secret key.
             */
            key?: pulumi.Input<string>;
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: supported The name of the secret in Cloud Secret Manager. By default, the secret is assumed to be in the same project. If the secret is in another project, you must define an alias. An alias definition has the form: :projects//secrets/. If multiple alias definitions are needed, they must be separated by commas. The alias definitions must be set on the run.googleapis.com/secrets annotation. Cloud Run for Anthos: supported The name of the secret in the pod's namespace to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the Secret or its key must be defined
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: supported The secret's value will be presented as the content of a file whose name is defined in the item path. If no items are defined, the name of the file is the secret_name. Cloud Run for Anthos: supported The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
         */
        interface SecretVolumeSource {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Mode bits to use on created files by default. Must be a value between 0000 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. NOTE: This is an integer representation of the mode bits. So, the integer value should look exactly as the chmod numeric notation, i.e. Unix chmod "777" (a=rwx) should have the integer value 777.
             */
            defaultMode?: pulumi.Input<number>;
            /**
             * (Optional) Cloud Run fully managed: supported If unspecified, the volume will expose a file whose name is the secret_name. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a key and a path. Cloud Run for Anthos: supported If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional.
             */
            items?: pulumi.Input<pulumi.Input<inputs.run.v1.KeyToPath>[]>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the Secret or its keys must be defined.
             */
            optional?: pulumi.Input<boolean>;
            /**
             * Cloud Run fully managed: supported The name of the secret in Cloud Secret Manager. By default, the secret is assumed to be in the same project. If the secret is in another project, you must define an alias. An alias definition has the form: :projects//secrets/. If multiple alias definitions are needed, they must be separated by commas. The alias definitions must be set on the run.googleapis.com/secrets annotation. Cloud Run for Anthos: supported Name of the secret in the container's namespace to use.
             */
            secretName?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.
         */
        interface SecurityContext {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
             */
            runAsUser?: pulumi.Input<number>;
        }
        /**
         * ServiceSpec holds the desired state of the Route (from the client), which is used to manipulate the underlying Route and Configuration(s).
         */
        interface ServiceSpec {
            /**
             * Template holds the latest specification for the Revision to be stamped out.
             */
            template?: pulumi.Input<inputs.run.v1.RevisionTemplate>;
            /**
             * Traffic specifies how to distribute traffic over a collection of Knative Revisions and Configurations.
             */
            traffic?: pulumi.Input<pulumi.Input<inputs.run.v1.TrafficTarget>[]>;
        }
        /**
         * The current state of the Service. Output only.
         */
        interface ServiceStatus {
            /**
             * From RouteStatus. Similar to url, information on where the service is available on HTTP.
             */
            address?: pulumi.Input<inputs.run.v1.Addressable>;
            /**
             * Conditions communicates information about ongoing/complete reconciliation processes that bring the "spec" inline with the observed state of the world. Service-specific conditions include: * "ConfigurationsReady": true when the underlying Configuration is ready. * "RoutesReady": true when the underlying Route is ready. * "Ready": true when both the underlying Route and Configuration are ready.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.run.v1.GoogleCloudRunV1Condition>[]>;
            /**
             * From ConfigurationStatus. LatestCreatedRevisionName is the last revision that was created from this Service's Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
             */
            latestCreatedRevisionName?: pulumi.Input<string>;
            /**
             * From ConfigurationStatus. LatestReadyRevisionName holds the name of the latest Revision stamped out from this Service's Configuration that has had its "Ready" condition become "True".
             */
            latestReadyRevisionName?: pulumi.Input<string>;
            /**
             * ObservedGeneration is the 'Generation' of the Route that was last processed by the controller. Clients polling for completed reconciliation should poll until observedGeneration = metadata.generation and the Ready condition's status is True or False.
             */
            observedGeneration?: pulumi.Input<number>;
            /**
             * From RouteStatus. Traffic holds the configured traffic distribution. These entries will always contain RevisionName references. When ConfigurationName appears in the spec, this will hold the LatestReadyRevisionName that we last observed.
             */
            traffic?: pulumi.Input<pulumi.Input<inputs.run.v1.TrafficTarget>[]>;
            /**
             * From RouteStatus. URL holds the url that will distribute traffic over the provided traffic targets. It generally has the form https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported TCPSocketAction describes an action based on opening a socket
         */
        interface TCPSocketAction {
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Optional: Host name to connect to, defaults to the pod IP.
             */
            host?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. This field is currently limited to integer types only because of proto's inability to properly support the IntOrString golang type.
             */
            port?: pulumi.Input<number>;
        }
        /**
         * TrafficTarget holds a single entry of the routing table for a Route.
         */
        interface TrafficTarget {
            /**
             * ConfigurationName of a configuration to whose latest revision we will send this portion of traffic. When the "status.latestReadyRevisionName" of the referenced configuration changes, we will automatically migrate traffic from the prior "latest ready" revision to the new one. This field is never set in Route's status, only its spec. This is mutually exclusive with RevisionName. Cloud Run currently supports a single ConfigurationName.
             */
            configurationName?: pulumi.Input<string>;
            /**
             * LatestRevision may be optionally provided to indicate that the latest ready Revision of the Configuration should be used for this traffic target. When provided LatestRevision must be true if RevisionName is empty; it must be false when RevisionName is non-empty. +optional
             */
            latestRevision?: pulumi.Input<boolean>;
            /**
             * Percent specifies percent of the traffic to this Revision or Configuration. This defaults to zero if unspecified. Cloud Run currently requires 100 percent for a single ConfigurationName TrafficTarget entry.
             */
            percent?: pulumi.Input<number>;
            /**
             * RevisionName of a specific revision to which to send this portion of traffic. This is mutually exclusive with ConfigurationName. Providing RevisionName in spec is not currently supported by Cloud Run.
             */
            revisionName?: pulumi.Input<string>;
            /**
             * Tag is optionally used to expose a dedicated url for referencing this target exclusively. +optional
             */
            tag?: pulumi.Input<string>;
            /**
             * URL displays the URL for accessing tagged traffic targets. URL is displayed in status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and a hostname, but may not contain anything else (e.g. basic auth, url path, etc.)
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Volume represents a named volume in a container.
         */
        interface Volume {
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported
             */
            configMap?: pulumi.Input<inputs.run.v1.ConfigMapVolumeSource>;
            /**
             * Cloud Run fully managed: supported Cloud Run for Anthos: supported Volume's name.
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: supported Cloud Run for Anthos: supported
             */
            secret?: pulumi.Input<inputs.run.v1.SecretVolumeSource>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run for Anthos: supported VolumeMount describes a mounting of a Volume within a container.
         */
        interface VolumeMount {
            /**
             * Cloud Run fully managed: supported Cloud Run for Anthos: supported Path within the container at which the volume should be mounted. Must not contain ':'.
             */
            mountPath?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: supported Cloud Run for Anthos: supported This must match the Name of a Volume.
             */
            name?: pulumi.Input<string>;
            /**
             * (Optional) Cloud Run fully managed: supported Cloud Run for Anthos: supported Only true is accepted. Defaults to true.
             */
            readOnly?: pulumi.Input<boolean>;
            /**
             * (Optional) Cloud Run fully managed: not supported Cloud Run for Anthos: supported Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
             */
            subPath?: pulumi.Input<string>;
        }
    }
    namespace v1alpha1 {
        /**
         * Information for connecting over HTTP(s).
         */
        interface Addressable {
            /**
             * Deprecated - use url instead.
             */
            hostname?: pulumi.Input<string>;
            url?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.run.v1alpha1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Adds and removes POSIX capabilities from running containers.
         */
        interface Capabilities {
            /**
             * Added capabilities +optional
             */
            add?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Removed capabilities +optional
             */
            drop?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * ConfigMapEnvSource selects a ConfigMap to populate the environment variables with. The contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.
         */
        interface ConfigMapEnvSource {
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1alpha1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The ConfigMap to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the ConfigMap must be defined +optional
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run on GKE: supported Selects a key from a ConfigMap.
         */
        interface ConfigMapKeySelector {
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported The key to select.
             */
            key?: pulumi.Input<string>;
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1alpha1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported The ConfigMap to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Specify whether the ConfigMap or its key must be defined +optional
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths.
         */
        interface ConfigMapVolumeSource {
            /**
             * Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
             */
            defaultMode?: pulumi.Input<number>;
            /**
             * If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional.
             */
            items?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.KeyToPath>[]>;
            /**
             * Name of the config.
             */
            name?: pulumi.Input<string>;
            /**
             * Specify whether the Secret or its keys must be defined.
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * ConfigurationSpec holds the desired state of the Configuration (from the client).
         */
        interface ConfigurationSpec {
            /**
             * Deprecated and not currently populated by Cloud Run. See metadata.generation instead, which is the sequence number containing the latest generation of the desired state. Read-only.
             */
            generation?: pulumi.Input<number>;
            /**
             * RevisionTemplate holds the latest specification for the Revision to be stamped out. The template references the container image, and may also include labels and annotations that should be attached to the Revision. To correlate a Revision, and/or to force a Revision to be created when the spec doesn't otherwise change, a nonce label may be provided in the template metadata. For more details, see: https://github.com/knative/serving/blob/master/docs/client-conventions.md#associate-modifications-with-revisions Cloud Run does not currently support referencing a build that is responsible for materializing the container image from source.
             */
            revisionTemplate?: pulumi.Input<inputs.run.v1alpha1.RevisionTemplate>;
            /**
             * Template holds the latest specification for the Revision to be stamped out.
             */
            template?: pulumi.Input<inputs.run.v1alpha1.RevisionTemplate>;
        }
        /**
         * A single application container. This specifies both the container to run, the command to run in the container and the arguments to supply to it. Note that additional arguments may be supplied by the system to the container at runtime.
         */
        interface Container {
            /**
             * Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell +optional
             */
            args?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell +optional
             */
            command?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * List of environment variables to set in the container. Cannot be updated. +optional
             */
            env?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.EnvVar>[]>;
            /**
             * List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. +optional
             */
            envFrom?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.EnvFromSource>[]>;
            /**
             * Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images
             */
            image?: pulumi.Input<string>;
            /**
             * Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images +optional
             */
            imagePullPolicy?: pulumi.Input<string>;
            /**
             * Actions that the management system should take in response to container lifecycle events. Cannot be updated. +optional
             */
            lifecycle?: pulumi.Input<inputs.run.v1alpha1.Lifecycle>;
            /**
             * Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes +optional
             */
            livenessProbe?: pulumi.Input<inputs.run.v1alpha1.Probe>;
            /**
             * Name of the container specified as a DNS_LABEL. Each container must have a unique name (DNS_LABEL). Cannot be updated.
             */
            name?: pulumi.Input<string>;
            /**
             * List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default "0.0.0.0" address inside a container will be accessible from the network. Cannot be updated. +optional
             */
            ports?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.ContainerPort>[]>;
            /**
             * Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes +optional
             */
            readinessProbe?: pulumi.Input<inputs.run.v1alpha1.Probe>;
            /**
             * Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources +optional
             */
            resources?: pulumi.Input<inputs.run.v1alpha1.ResourceRequirements>;
            /**
             * Security options the pod should run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +optional
             */
            securityContext?: pulumi.Input<inputs.run.v1alpha1.SecurityContext>;
            /**
             * Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false. +optional
             */
            stdin?: pulumi.Input<boolean>;
            /**
             * Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false +optional
             */
            stdinOnce?: pulumi.Input<boolean>;
            /**
             * Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated. +optional
             */
            terminationMessagePath?: pulumi.Input<string>;
            /**
             * Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated. +optional
             */
            terminationMessagePolicy?: pulumi.Input<string>;
            /**
             * Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false. +optional
             */
            tty?: pulumi.Input<boolean>;
            /**
             * volumeDevices is the list of block devices to be used by the container. This is an alpha feature and may change in the future. +optional
             */
            volumeDevices?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.VolumeDevice>[]>;
            /**
             * Pod volumes to mount into the container's filesystem. Cannot be updated. +optional
             */
            volumeMounts?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.VolumeMount>[]>;
            /**
             * Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated. +optional
             */
            workingDir?: pulumi.Input<string>;
        }
        /**
         * ContainerPort represents a network port in a single container.
         */
        interface ContainerPort {
            /**
             * Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.
             */
            containerPort?: pulumi.Input<number>;
            /**
             * What host IP to bind the external port to. +optional
             */
            hostIP?: pulumi.Input<string>;
            /**
             * Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this. +optional
             */
            hostPort?: pulumi.Input<number>;
            /**
             * If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services. +optional
             */
            name?: pulumi.Input<string>;
            /**
             * Protocol for port. Must be UDP or TCP. Defaults to "TCP". +optional
             */
            protocol?: pulumi.Input<string>;
        }
        /**
         * DomainMappingCondition contains state information for a DomainMapping.
         */
        interface DomainMappingCondition {
            /**
             * Last time the condition transitioned from one status to another. +optional
             */
            lastTransitionTime?: pulumi.Input<string>;
            /**
             * Human readable message indicating details about the current status. +optional
             */
            message?: pulumi.Input<string>;
            /**
             * One-word CamelCase reason for the condition's current status. +optional
             */
            reason?: pulumi.Input<string>;
            /**
             * How to interpret failures of this condition, one of Error, Warning, Info +optional
             */
            severity?: pulumi.Input<string>;
            /**
             * Status of the condition, one of True, False, Unknown.
             */
            status?: pulumi.Input<string>;
            /**
             * Type of domain mapping condition.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * The desired state of the Domain Mapping.
         */
        interface DomainMappingSpec {
            /**
             * The mode of the certificate.
             */
            certificateMode?: pulumi.Input<string>;
            /**
             * If set, the mapping will override any mapping set before this spec was set. It is recommended that the user leaves this empty to receive an error warning about a potential conflict and only set it once the respective UI has given such a warning.
             */
            forceOverride?: pulumi.Input<boolean>;
            /**
             * The name of the Knative Route that this DomainMapping applies to. The route must exist.
             */
            routeName?: pulumi.Input<string>;
        }
        /**
         * The current state of the Domain Mapping.
         */
        interface DomainMappingStatus {
            /**
             * Array of observed DomainMappingConditions, indicating the current state of the DomainMapping.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.DomainMappingCondition>[]>;
            /**
             * The name of the route that the mapping currently points to.
             */
            mappedRouteName?: pulumi.Input<string>;
            /**
             * ObservedGeneration is the 'Generation' of the DomainMapping that was last processed by the controller. Clients polling for completed reconciliation should poll until observedGeneration = metadata.generation and the Ready condition's status is True or False.
             */
            observedGeneration?: pulumi.Input<number>;
            /**
             * The resource records required to configure this domain mapping. These records must be added to the domain's DNS configuration in order to serve the application via this domain mapping.
             */
            resourceRecords?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.ResourceRecord>[]>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Holds the URL that will serve the traffic of the DomainMapping. +optional
             */
            url?: pulumi.Input<string>;
        }
        /**
         * EnvFromSource represents the source of a set of ConfigMaps
         */
        interface EnvFromSource {
            /**
             * The ConfigMap to select from +optional
             */
            configMapRef?: pulumi.Input<inputs.run.v1alpha1.ConfigMapEnvSource>;
            /**
             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. +optional
             */
            prefix?: pulumi.Input<string>;
            /**
             * The Secret to select from +optional
             */
            secretRef?: pulumi.Input<inputs.run.v1alpha1.SecretEnvSource>;
        }
        /**
         * EnvVar represents an environment variable present in a Container.
         */
        interface EnvVar {
            /**
             * Name of the environment variable. Must be a C_IDENTIFIER.
             */
            name?: pulumi.Input<string>;
            /**
             * Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any route environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "". +optional
             */
            value?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Source for the environment variable's value. Cannot be used if value is not empty. +optional
             */
            valueFrom?: pulumi.Input<inputs.run.v1alpha1.EnvVarSource>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run on GKE: supported EnvVarSource represents a source for the value of an EnvVar.
         */
        interface EnvVarSource {
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Selects a key of a ConfigMap. +optional
             */
            configMapKeyRef?: pulumi.Input<inputs.run.v1alpha1.ConfigMapKeySelector>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Selects a key of a secret in the pod's namespace +optional
             */
            secretKeyRef?: pulumi.Input<inputs.run.v1alpha1.SecretKeySelector>;
        }
        /**
         * ExecAction describes a "run in container" action.
         */
        interface ExecAction {
            /**
             * Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy. +optional
             */
            command?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * HTTPGetAction describes an action based on HTTP Get requests.
         */
        interface HTTPGetAction {
            /**
             * Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead. +optional
             */
            host?: pulumi.Input<string>;
            /**
             * Custom headers to set in the request. HTTP allows repeated headers. +optional
             */
            httpHeaders?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.HTTPHeader>[]>;
            /**
             * Path to access on the HTTP server. +optional
             */
            path?: pulumi.Input<string>;
            /**
             * Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
             */
            port?: pulumi.Input<inputs.run.v1alpha1.IntOrString>;
            /**
             * Scheme to use for connecting to the host. Defaults to HTTP. +optional
             */
            scheme?: pulumi.Input<string>;
        }
        /**
         * HTTPHeader describes a custom header to be used in HTTP probes
         */
        interface HTTPHeader {
            /**
             * The header field name
             */
            name?: pulumi.Input<string>;
            /**
             * The header field value
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Handler defines a specific action that should be taken
         */
        interface Handler {
            /**
             * One and only one of the following should be specified. Exec specifies the action to take. +optional
             */
            exec?: pulumi.Input<inputs.run.v1alpha1.ExecAction>;
            /**
             * HTTPGet specifies the http request to perform. +optional
             */
            httpGet?: pulumi.Input<inputs.run.v1alpha1.HTTPGetAction>;
            /**
             * TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported
             */
            tcpSocket?: pulumi.Input<inputs.run.v1alpha1.TCPSocketAction>;
        }
        /**
         * InstanceSpec is a description of an instance.
         */
        interface InstanceSpec {
            /**
             * Optional. Optional duration in seconds the instance may be active relative to StartTime before the system will actively try to mark it failed and kill associated containers. If set to zero, the system will never attempt to kill an instance based on time. Otherwise, value must be a positive integer. +optional
             */
            activeDeadlineSeconds?: pulumi.Input<string>;
            /**
             * Optional. List of containers belonging to the instance. We disallow a number of fields on this Container. Only a single container may be provided.
             */
            containers?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.Container>[]>;
            /**
             * Optional. Restart policy for all containers within the instance. Allowed values are: - OnFailure: Instances will always be restarted on failure if the backoffLimit has not been reached. - Never: Instances are never restarted and all failures are permanent. Cannot be used if backoffLimit is set. +optional
             */
            restartPolicy?: pulumi.Input<string>;
            /**
             * Optional. Email address of the IAM service account associated with the instance of a Job. The service account represents the identity of the running instance, and determines what permissions the instance has. If not provided, the instance will use the project's default service account. +optional
             */
            serviceAccountName?: pulumi.Input<string>;
            /**
             * Optional. Optional duration in seconds the instance needs to terminate gracefully. Value must be non-negative integer. The value zero indicates delete immediately. The grace period is the duration in seconds after the processes running in the instance are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. +optional
             */
            terminationGracePeriodSeconds?: pulumi.Input<string>;
            /**
             * Optional. List of volumes that can be mounted by containers belonging to the instance. More info: https://kubernetes.io/docs/concepts/storage/volumes +optional
             */
            volumes?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.Volume>[]>;
        }
        /**
         * Instance represents the status of an instance of a Job.
         */
        interface InstanceStatus {
            /**
             * Optional. Represents time when the instance was completed. It is not guaranteed to be set in happens-before order across separate operations. It is represented in RFC3339 form and is in UTC. +optional
             */
            completionTime?: pulumi.Input<string>;
            /**
             * Optional. The number of times this instance exited with code > 0; +optional
             */
            failed?: pulumi.Input<number>;
            /**
             * Required. Index of the instance, unique per Job, and beginning at 0.
             */
            index?: pulumi.Input<number>;
            /**
             * Optional. Last exit code seen for this instance. +optional
             */
            lastExitCode?: pulumi.Input<number>;
            /**
             * Optional. The number of times this instance was restarted. Instances are restarted according the restartPolicy configured in the Job template. +optional
             */
            restarted?: pulumi.Input<number>;
            /**
             * Optional. Represents time when the instance was created by the job controller. It is not guaranteed to be set in happens-before order across separate operations. It is represented in RFC3339 form and is in UTC. +optional
             */
            startTime?: pulumi.Input<string>;
            /**
             * Optional. The number of times this instance exited with code == 0. +optional
             */
            succeeded?: pulumi.Input<number>;
        }
        /**
         * InstanceTemplateSpec describes the data an instance should have when created from a template.
         */
        interface InstanceTemplateSpec {
            /**
             * Optional. Specification of the desired behavior of the instance. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status +optional
             */
            spec?: pulumi.Input<inputs.run.v1alpha1.InstanceSpec>;
        }
        /**
         * IntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.
         */
        interface IntOrString {
            /**
             * The int value.
             */
            intVal?: pulumi.Input<number>;
            /**
             * The string value.
             */
            strVal?: pulumi.Input<string>;
            /**
             * The type of the value.
             */
            type?: pulumi.Input<number>;
        }
        /**
         * JobCondition defines a readiness condition for a Revision.
         */
        interface JobCondition {
            /**
             * Optional. Last time the condition transitioned from one status to another.
             */
            lastTransitionTime?: pulumi.Input<string>;
            /**
             * Optional. Human readable message indicating details about the current status.
             */
            message?: pulumi.Input<string>;
            /**
             * Optional. One-word CamelCase reason for the condition's last transition.
             */
            reason?: pulumi.Input<string>;
            /**
             * Optional. How to interpret failures of this condition, one of Error, Warning, Info
             */
            severity?: pulumi.Input<string>;
            /**
             * Required. Status of the condition, one of True, False, Unknown.
             */
            status?: pulumi.Input<string>;
            /**
             * Required. Type is used to communicate the status of the reconciliation process. See also: https://github.com/knative/serving/blob/master/docs/spec/errors.md#error-conditions-and-reporting Types include: * "Completed": True when the Job has successfully completed. * "Started": True when the Job has successfully started running. * "ResourcesAvailable": True when underlying resources have been provisioned.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * JobSpec describes how the job execution will look like.
         */
        interface JobSpec {
            /**
             * Optional. Specifies the duration in seconds relative to the startTime that the job may be active before the system tries to terminate it. If set to zero, the system will never attempt to terminate the job based on time. Otherwise, the value must be positive integer. +optional
             */
            activeDeadlineSeconds?: pulumi.Input<string>;
            /**
             * Optional. Specifies the number of retries per instance, before marking this job failed. If set to zero, instances will never retry on failure. +optional
             */
            backoffLimit?: pulumi.Input<number>;
            /**
             * Optional. Specifies the desired number of successfully finished instances the job should be run with. Setting to 1 means that parallelism is limited to 1 and the success of that instance signals the success of the job. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/ +optional
             */
            completions?: pulumi.Input<number>;
            /**
             * Optional. Specifies the maximum desired number of instances the job should run at any given time. Must be <= completions. The actual number of instances running in steady state will be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism), i.e. when the work left to do is less than max parallelism. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/ +optional
             */
            parallelism?: pulumi.Input<number>;
            /**
             * Optional. Describes the instance that will be created when executing a job.
             */
            template?: pulumi.Input<inputs.run.v1alpha1.InstanceTemplateSpec>;
            /**
             * Optional. ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is set to zero, the Job won't be automatically deleted. +optional
             */
            ttlSecondsAfterFinished?: pulumi.Input<number>;
        }
        /**
         * JobStatus represents the current state of a Job.
         */
        interface JobStatus {
            /**
             * Optional. The number of actively running instances. +optional
             */
            active?: pulumi.Input<number>;
            /**
             * Optional. Represents time when the job was completed. It is not guaranteed to be set in happens-before order across separate operations. It is represented in RFC3339 form and is in UTC. +optional
             */
            completionTime?: pulumi.Input<string>;
            /**
             * Optional. The latest available observations of a job's current state. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/ +optional
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.JobCondition>[]>;
            /**
             * Optional. The number of instances which reached phase Failed. +optional
             */
            failed?: pulumi.Input<number>;
            /**
             * Optional. ImageDigest holds the resolved digest for the image specified within .Spec.Template.Spec.Container.Image. The digest is resolved during the creation of the Job. This field holds the digest value regardless of whether a tag or digest was originally specified in the Container object.
             */
            imageDigest?: pulumi.Input<string>;
            /**
             * Optional. Status of completed, failed, and running instances. +optional
             */
            instances?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.InstanceStatus>[]>;
            /**
             * Optional. The 'generation' of the job that was last processed by the controller.
             */
            observedGeneration?: pulumi.Input<number>;
            /**
             * Optional. Represents time when the job was acknowledged by the job controller. It is not guaranteed to be set in happens-before order across separate operations. It is represented in RFC3339 form and is in UTC. +optional
             */
            startTime?: pulumi.Input<string>;
            /**
             * Optional. The number of instances which reached phase Succeeded. +optional
             */
            succeeded?: pulumi.Input<number>;
        }
        /**
         * Maps a string key to a path within a volume.
         */
        interface KeyToPath {
            /**
             * The key to project.
             */
            key?: pulumi.Input<string>;
            /**
             * Mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. +optional
             */
            mode?: pulumi.Input<number>;
            /**
             * The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.
         */
        interface Lifecycle {
            /**
             * PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks +optional
             */
            postStart?: pulumi.Input<inputs.run.v1alpha1.Handler>;
            /**
             * PreStop is called immediately before a container is terminated. The container is terminated after the handler completes. The reason for termination is passed to the handler. Regardless of the outcome of the handler, the container is eventually terminated. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks +optional
             */
            preStop?: pulumi.Input<inputs.run.v1alpha1.Handler>;
        }
        /**
         * LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
         */
        interface LocalObjectReference {
            /**
             * Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
             */
            name?: pulumi.Input<string>;
        }
        /**
         * ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
         */
        interface ObjectMeta {
            /**
             * Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +optional
             */
            annotations?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Not currently supported by Cloud Run. The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +optional
             */
            clusterName?: pulumi.Input<string>;
            /**
             * CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata +optional
             */
            creationTimestamp?: pulumi.Input<string>;
            /**
             * Not currently supported by Cloud Run. Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +optional
             */
            deletionGracePeriodSeconds?: pulumi.Input<number>;
            /**
             * DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata +optional
             */
            deletionTimestamp?: pulumi.Input<string>;
            /**
             * Not currently supported by Cloud Run. Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. +optional +patchStrategy=merge
             */
            finalizers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Not currently supported by Cloud Run. GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#idempotency +optional string generateName = 2;
             */
            generateName?: pulumi.Input<string>;
            /**
             * A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +optional
             */
            generation?: pulumi.Input<number>;
            /**
             * Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and routes. More info: http://kubernetes.io/docs/user-guide/labels +optional
             */
            labels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Name must be unique within a namespace, within a Cloud Run region. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +optional
             */
            name?: pulumi.Input<string>;
            /**
             * Namespace defines the space within each name must be unique, within a Cloud Run region. In Cloud Run the namespace must be equal to either the project ID or project number.
             */
            namespace?: pulumi.Input<string>;
            /**
             * List of objects that own this object. If ALL objects in the list have been deleted, this object will be garbage collected. +optional
             */
            ownerReferences?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.OwnerReference>[]>;
            /**
             * An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency +optional
             */
            resourceVersion?: pulumi.Input<string>;
            /**
             * SelfLink is a URL representing this object. Populated by the system. Read-only. +optional string selfLink = 4;
             */
            selfLink?: pulumi.Input<string>;
            /**
             * UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +optional
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * OwnerReference contains enough information to let you identify an owning object. Currently, an owning object must be in the same namespace, so there is no namespace field.
         */
        interface OwnerReference {
            /**
             * API version of the referent.
             */
            apiVersion?: pulumi.Input<string>;
            /**
             * If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned. +optional
             */
            blockOwnerDeletion?: pulumi.Input<boolean>;
            /**
             * If true, this reference points to the managing controller. +optional
             */
            controller?: pulumi.Input<boolean>;
            /**
             * Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             */
            kind?: pulumi.Input<string>;
            /**
             * Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
             */
            name?: pulumi.Input<string>;
            /**
             * UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
             */
            uid?: pulumi.Input<string>;
        }
        /**
         * Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.
         */
        interface Probe {
            /**
             * Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. +optional
             */
            failureThreshold?: pulumi.Input<number>;
            /**
             * The action taken to determine the health of a container
             */
            handler?: pulumi.Input<inputs.run.v1alpha1.Handler>;
            /**
             * Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes +optional
             */
            initialDelaySeconds?: pulumi.Input<number>;
            /**
             * How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. +optional
             */
            periodSeconds?: pulumi.Input<number>;
            /**
             * Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness. Minimum value is 1. +optional
             */
            successThreshold?: pulumi.Input<number>;
            /**
             * Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes +optional
             */
            timeoutSeconds?: pulumi.Input<number>;
        }
        /**
         * A DNS resource record.
         */
        interface ResourceRecord {
            /**
             * Relative name of the object affected by this record. Only applicable for `CNAME` records. Example: 'www'.
             */
            name?: pulumi.Input<string>;
            /**
             * Data for this record. Values vary by record type, as defined in RFC 1035 (section 5) and RFC 1034 (section 3.6.1).
             */
            rrdata?: pulumi.Input<string>;
            /**
             * Resource record type. Example: `AAAA`.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * ResourceRequirements describes the compute resource requirements.
         */
        interface ResourceRequirements {
            /**
             * Limits describes the maximum amount of compute resources allowed. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
             */
            limits?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Limits describes the maximum amount of compute resources allowed. This is a temporary field created to migrate away from the map limits field. This is done to become compliant with k8s style API. This field is deprecated in favor of limits field.
             */
            limitsInMap?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
             */
            requests?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. This is a temporary field created to migrate away from the map requests field. This is done to become compliant with k8s style API. This field is deprecated in favor of requests field.
             */
            requestsInMap?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * RevisionSpec holds the desired state of the Revision (from the client).
         */
        interface RevisionSpec {
            /**
             * ConcurrencyModel specifies the desired concurrency model (Single or Multi) for the Revision. Defaults to Multi. Deprecated in favor of ContainerConcurrency. +optional
             */
            concurrencyModel?: pulumi.Input<string>;
            /**
             * Container defines the unit of execution for this Revision. In the context of a Revision, we disallow a number of the fields of this Container, including: name, ports, and volumeMounts. The runtime contract is documented here: https://github.com/knative/serving/blob/master/docs/runtime-contract.md
             */
            container?: pulumi.Input<inputs.run.v1alpha1.Container>;
            /**
             * (Optional) ContainerConcurrency specifies the maximum allowed in-flight (concurrent) requests per container instance of the Revision. Cloud Run fully managed: supported, defaults to 80 Cloud Run on GKE: supported, defaults to 0, which means concurrency to the application is not limited, and the system decides the target concurrency for the autoscaler.
             */
            containerConcurrency?: pulumi.Input<number>;
            /**
             * Containers holds the single container that defines the unit of execution for this Revision. In the context of a Revision, we disallow a number of fields on this Container, including: name and lifecycle. In Cloud Run, only a single container may be provided.
             */
            containers?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.Container>[]>;
            /**
             * Deprecated and not currently populated by Cloud Run. See metadata.generation instead, which is the sequence number containing the latest generation of the desired state. Read-only.
             */
            generation?: pulumi.Input<number>;
            /**
             * Email address of the IAM service account associated with the revision of the service. The service account represents the identity of the running revision, and determines what permissions the revision has. If not provided, the revision will use the project's default service account.
             */
            serviceAccountName?: pulumi.Input<string>;
            /**
             * ServingState holds a value describing the state the resources are in for this Revision. Users must not specify this when creating a revision. It is expected that the system will manipulate this based on routability and load. Populated by the system. Read-only.
             */
            servingState?: pulumi.Input<string>;
            /**
             * TimeoutSeconds holds the max duration the instance is allowed for responding to a request. Not currently used by Cloud Run.
             */
            timeoutSeconds?: pulumi.Input<number>;
            volumes?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.Volume>[]>;
        }
        /**
         * RevisionTemplateSpec describes the data a revision should have when created from a template. Based on: https://github.com/kubernetes/api/blob/e771f807/core/v1/types.go#L3179-L3190
         */
        interface RevisionTemplate {
            /**
             * Optional metadata for this Revision, including labels and annotations. Name will be generated by the Configuration. To set minimum instances for this revision, use the "autoscaling.knative.dev/minScale" annotation key. (Cloud Run on GKE only). To set maximum instances for this revision, use the "autoscaling.knative.dev/maxScale" annotation key. To set Cloud SQL connections for the revision, use the "run.googleapis.com/cloudsql-instances" annotation key. Values should be comma separated.
             */
            metadata?: pulumi.Input<inputs.run.v1alpha1.ObjectMeta>;
            /**
             * RevisionSpec holds the desired state of the Revision (from the client).
             */
            spec?: pulumi.Input<inputs.run.v1alpha1.RevisionSpec>;
        }
        /**
         * SELinuxOptions are the labels to be applied to the container
         */
        interface SELinuxOptions {
            /**
             * Level is SELinux level label that applies to the container. +optional
             */
            level?: pulumi.Input<string>;
            /**
             * Role is a SELinux role label that applies to the container. +optional
             */
            role?: pulumi.Input<string>;
            /**
             * Type is a SELinux type label that applies to the container. +optional
             */
            type?: pulumi.Input<string>;
            /**
             * User is a SELinux user label that applies to the container. +optional
             */
            user?: pulumi.Input<string>;
        }
        /**
         * SecretEnvSource selects a Secret to populate the environment variables with. The contents of the target Secret's Data field will represent the key-value pairs as environment variables.
         */
        interface SecretEnvSource {
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1alpha1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported The Secret to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run for Anthos: supported Specify whether the Secret must be defined +optional
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * Cloud Run fully managed: not supported Cloud Run on GKE: supported SecretKeySelector selects a key of a Secret.
         */
        interface SecretKeySelector {
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported The key of the secret to select from. Must be a valid secret key.
             */
            key?: pulumi.Input<string>;
            /**
             * This field should not be used directly as it is meant to be inlined directly into the message. Use the "name" field instead.
             */
            localObjectReference?: pulumi.Input<inputs.run.v1alpha1.LocalObjectReference>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported The name of the secret in the pod's namespace to select from.
             */
            name?: pulumi.Input<string>;
            /**
             * Cloud Run fully managed: not supported Cloud Run on GKE: supported Specify whether the Secret or its key must be defined +optional
             */
            optional?: pulumi.Input<boolean>;
        }
        /**
         * The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names.
         */
        interface SecretVolumeSource {
            /**
             * Mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
             */
            defaultMode?: pulumi.Input<number>;
            /**
             * If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional.
             */
            items?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.KeyToPath>[]>;
            /**
             * Specify whether the Secret or its keys must be defined.
             */
            optional?: pulumi.Input<boolean>;
            /**
             * Name of the secret in the container's namespace to use.
             */
            secretName?: pulumi.Input<string>;
        }
        /**
         * SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.
         */
        interface SecurityContext {
            /**
             * AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN +optional
             */
            allowPrivilegeEscalation?: pulumi.Input<boolean>;
            /**
             * The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. +optional
             */
            capabilities?: pulumi.Input<inputs.run.v1alpha1.Capabilities>;
            /**
             * Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. +optional
             */
            privileged?: pulumi.Input<boolean>;
            /**
             * Whether this container has a read-only root filesystem. Default is false. +optional
             */
            readOnlyRootFilesystem?: pulumi.Input<boolean>;
            /**
             * The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. +optional
             */
            runAsGroup?: pulumi.Input<number>;
            /**
             * Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. +optional
             */
            runAsNonRoot?: pulumi.Input<boolean>;
            /**
             * The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. +optional
             */
            runAsUser?: pulumi.Input<number>;
            /**
             * The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. +optional
             */
            seLinuxOptions?: pulumi.Input<inputs.run.v1alpha1.SELinuxOptions>;
        }
        /**
         * ServiceCondition defines a readiness condition for a Service.
         */
        interface ServiceCondition {
            /**
             * Last time the condition transitioned from one status to another. +optional
             */
            lastTransitionTime?: pulumi.Input<string>;
            /**
             * Human-readable message indicating details about last transition. +optional
             */
            message?: pulumi.Input<string>;
            /**
             * One-word CamelCase reason for the condition's last transition. +optional
             */
            reason?: pulumi.Input<string>;
            /**
             * How to interpret failures of this condition, one of Error, Warning, Info +optional
             */
            severity?: pulumi.Input<string>;
            /**
             * Status of the condition, one of True, False, Unknown.
             */
            status?: pulumi.Input<string>;
            /**
             * ServiceConditionType is used to communicate the status of the reconciliation process. See also: https://github.com/knative/serving/blob/master/docs/spec/errors.md#error-conditions-and-reporting Types include: "Ready", "ConfigurationsReady", and "RoutesReady". "Ready" will be true when the underlying Route and Configuration are ready.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * ServiceSpec holds the desired state of the Route (from the client), which is used to manipulate the underlying Route and Configuration(s).
         */
        interface ServiceSpec {
            /**
             * Deprecated and not currently populated by Cloud Run. See metadata.generation instead, which is the sequence number containing the latest generation of the desired state. Read-only.
             */
            generation?: pulumi.Input<number>;
            /**
             * Manual contains the options for configuring a manual service. See ServiceSpec for more details. Not currently supported by Cloud Run.
             */
            manual?: pulumi.Input<inputs.run.v1alpha1.ServiceSpecManualType>;
            /**
             * Pins this service to a specific revision name. The revision must be owned by the configuration provided. Deprecated and not supported by Cloud Run. +optional
             */
            pinned?: pulumi.Input<inputs.run.v1alpha1.ServiceSpecPinnedType>;
            /**
             * Release enables gradual promotion of new revisions by allowing traffic to be split between two revisions. This type replaces the deprecated Pinned type. Not currently supported by Cloud Run.
             */
            release?: pulumi.Input<inputs.run.v1alpha1.ServiceSpecReleaseType>;
            /**
             * RunLatest defines a simple Service. It will automatically configure a route that keeps the latest ready revision from the supplied configuration running. +optional
             */
            runLatest?: pulumi.Input<inputs.run.v1alpha1.ServiceSpecRunLatest>;
            /**
             * Template holds the latest specification for the Revision to be stamped out.
             */
            template?: pulumi.Input<inputs.run.v1alpha1.RevisionTemplate>;
            /**
             * Traffic specifies how to distribute traffic over a collection of Knative Revisions and Configurations.
             */
            traffic?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.TrafficTarget>[]>;
        }
        /**
         * ServiceSpecManualType contains the options for configuring a manual service. See ServiceSpec for more details. Not currently supported by Cloud Run.
         */
        interface ServiceSpecManualType {
        }
        /**
         * ServiceSpecPinnedType Pins this service to a specific revision name. The revision must be owned by the configuration provided. Deprecated and not supported by Cloud Run.
         */
        interface ServiceSpecPinnedType {
            /**
             * The configuration for this service.
             */
            configuration?: pulumi.Input<inputs.run.v1alpha1.ConfigurationSpec>;
            /**
             * The revision name to pin this service to until changed to a different service type.
             */
            revisionName?: pulumi.Input<string>;
        }
        /**
         * ServiceSpecReleaseType contains the options for slowly releasing revisions. See ServiceSpec for more details. Not currently supported by Cloud Run.
         */
        interface ServiceSpecReleaseType {
            /**
             * The configuration for this service. All revisions from this service must come from a single configuration.
             */
            configuration?: pulumi.Input<inputs.run.v1alpha1.ConfigurationSpec>;
            /**
             * Revisions is an ordered list of 1 or 2 revisions. The first is the current revision, and the second is the candidate revision. If a single revision is provided, traffic will be pinned at that revision. "@latest" is a shortcut for usage that refers to the latest created revision by the configuration.
             */
            revisions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * RolloutPercent is the percent of traffic that should be sent to the candidate revision, i.e. the 2nd revision in the revisions list. Valid values are between 0 and 99 inclusive.
             */
            rolloutPercent?: pulumi.Input<number>;
        }
        /**
         * ServiceSpecRunLatest contains the options for always having a route to the latest configuration. See ServiceSpec for more details.
         */
        interface ServiceSpecRunLatest {
            /**
             * The configuration for this service.
             */
            configuration?: pulumi.Input<inputs.run.v1alpha1.ConfigurationSpec>;
        }
        /**
         * The current state of the Service. Output only.
         */
        interface ServiceStatus {
            /**
             * From RouteStatus. Similar to url, information on where the service is available on HTTP.
             */
            address?: pulumi.Input<inputs.run.v1alpha1.Addressable>;
            /**
             * Conditions communicates information about ongoing/complete reconciliation processes that bring the "spec" inline with the observed state of the world.
             */
            conditions?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.ServiceCondition>[]>;
            /**
             * From RouteStatus. Domain holds the top-level domain that will distribute traffic over the provided targets. It generally has the form https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app
             */
            domain?: pulumi.Input<string>;
            /**
             * From ConfigurationStatus. LatestCreatedRevisionName is the last revision that was created from this Service's Configuration. It might not be ready yet, for that use LatestReadyRevisionName.
             */
            latestCreatedRevisionName?: pulumi.Input<string>;
            /**
             * From ConfigurationStatus. LatestReadyRevisionName holds the name of the latest Revision stamped out from this Service's Configuration that has had its "Ready" condition become "True".
             */
            latestReadyRevisionName?: pulumi.Input<string>;
            /**
             * ObservedGeneration is the 'Generation' of the Route that was last processed by the controller. Clients polling for completed reconciliation should poll until observedGeneration = metadata.generation and the Ready condition's status is True or False.
             */
            observedGeneration?: pulumi.Input<number>;
            /**
             * From RouteStatus. Traffic holds the configured traffic distribution. These entries will always contain RevisionName references. When ConfigurationName appears in the spec, this will hold the LatestReadyRevisionName that we last observed.
             */
            traffic?: pulumi.Input<pulumi.Input<inputs.run.v1alpha1.TrafficTarget>[]>;
            /**
             * From RouteStatus. URL holds the url that will distribute traffic over the provided traffic targets. It generally has the form https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app
             */
            url?: pulumi.Input<string>;
        }
        /**
         * TCPSocketAction describes an action based on opening a socket
         */
        interface TCPSocketAction {
            /**
             * Optional: Host name to connect to, defaults to the pod IP. +optional
             */
            host?: pulumi.Input<string>;
            /**
             * Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
             */
            port?: pulumi.Input<inputs.run.v1alpha1.IntOrString>;
        }
        /**
         * TrafficTarget holds a single entry of the routing table for a Route.
         */
        interface TrafficTarget {
            /**
             * ConfigurationName of a configuration to whose latest revision we will send this portion of traffic. When the "status.latestReadyRevisionName" of the referenced configuration changes, we will automatically migrate traffic from the prior "latest ready" revision to the new one. This field is never set in Route's status, only its spec. This is mutually exclusive with RevisionName. Cloud Run currently supports a single ConfigurationName.
             */
            configurationName?: pulumi.Input<string>;
            /**
             * LatestRevision may be optionally provided to indicate that the latest ready Revision of the Configuration should be used for this traffic target. When provided LatestRevision must be true if RevisionName is empty; it must be false when RevisionName is non-empty. +optional
             */
            latestRevision?: pulumi.Input<boolean>;
            /**
             * Name is optionally used to expose a dedicated hostname for referencing this target exclusively. Not currently supported by Cloud Run. +optional
             */
            name?: pulumi.Input<string>;
            /**
             * Percent specifies percent of the traffic to this Revision or Configuration. This defaults to zero if unspecified. Cloud Run currently requires 100 percent for a single ConfigurationName TrafficTarget entry.
             */
            percent?: pulumi.Input<number>;
            /**
             * RevisionName of a specific revision to which to send this portion of traffic. This is mutually exclusive with ConfigurationName. Providing RevisionName in spec is not currently supported by Cloud Run.
             */
            revisionName?: pulumi.Input<string>;
            /**
             * Tag is optionally used to expose a dedicated url for referencing this target exclusively. Not currently supported in Cloud Run. +optional
             */
            tag?: pulumi.Input<string>;
            /**
             * URL displays the URL for accessing named traffic targets. URL is displayed in status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and a hostname, but may not contain anything else (e.g. basic auth, url path, etc. Not currently supported in Cloud Run.
             */
            url?: pulumi.Input<string>;
        }
        /**
         * Volume represents a named volume in a container.
         */
        interface Volume {
            configMap?: pulumi.Input<inputs.run.v1alpha1.ConfigMapVolumeSource>;
            /**
             * Volume's name.
             */
            name?: pulumi.Input<string>;
            secret?: pulumi.Input<inputs.run.v1alpha1.SecretVolumeSource>;
        }
        /**
         * volumeDevice describes a mapping of a raw block device within a container.
         */
        interface VolumeDevice {
            /**
             * devicePath is the path inside of the container that the device will be mapped to.
             */
            devicePath?: pulumi.Input<string>;
            /**
             * name must match the name of a persistentVolumeClaim in the pod
             */
            name?: pulumi.Input<string>;
        }
        /**
         * VolumeMount describes a mounting of a Volume within a container.
         */
        interface VolumeMount {
            /**
             * Path within the container at which the volume should be mounted. Must not contain ':'.
             */
            mountPath?: pulumi.Input<string>;
            /**
             * mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationHostToContainer is used. This field is beta in 1.10. +optional
             */
            mountPropagation?: pulumi.Input<string>;
            /**
             * This must match the Name of a Volume.
             */
            name?: pulumi.Input<string>;
            /**
             * Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false. +optional
             */
            readOnly?: pulumi.Input<boolean>;
            /**
             * Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). +optional
             */
            subPath?: pulumi.Input<string>;
        }
    }
}
export declare namespace runtimeconfig {
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.runtimeconfig.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * A Cardinality condition for the Waiter resource. A cardinality condition is met when the number of variables under a specified path prefix reaches a predefined number. For example, if you set a Cardinality condition where the `path` is set to `/foo` and the number of paths is set to `2`, the following variables would meet the condition in a RuntimeConfig resource: + `/foo/variable1 = "value1"` + `/foo/variable2 = "value2"` + `/bar/variable3 = "value3"` It would not satisfy the same condition with the `number` set to `3`, however, because there is only 2 paths that start with `/foo`. Cardinality conditions are recursive; all subtrees under the specific path prefix are counted.
         */
        interface Cardinality {
            /**
             * The number variables under the `path` that must exist to meet this condition. Defaults to 1 if not specified.
             */
            number?: pulumi.Input<number>;
            /**
             * The root of the variable subtree to monitor. For example, `/foo`.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * The condition that a Waiter resource is waiting for.
         */
        interface EndCondition {
            /**
             * The cardinality of the `EndCondition`.
             */
            cardinality?: pulumi.Input<inputs.runtimeconfig.v1beta1.Cardinality>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
         */
        interface Status {
            /**
             * The status code, which should be an enum value of google.rpc.Code.
             */
            code?: pulumi.Input<number>;
            /**
             * A list of messages that carry the error details. There is a common set of message types for APIs to use.
             */
            details?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
            /**
             * A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
             */
            message?: pulumi.Input<string>;
        }
    }
}
export declare namespace secretmanager {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.secretmanager.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * A replication policy that replicates the Secret payload without any restrictions.
         */
        interface Automatic {
            /**
             * Optional. The customer-managed encryption configuration of the Secret. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.
             */
            customerManagedEncryption?: pulumi.Input<inputs.secretmanager.v1.CustomerManagedEncryption>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.secretmanager.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK).
         */
        interface CustomerManagedEncryption {
            /**
             * Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in `global`. The expected format is `projects/*&#47;locations/*&#47;keyRings/*&#47;cryptoKeys/*`.
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Represents a Replica for this Secret.
         */
        interface Replica {
            /**
             * Optional. The customer-managed encryption configuration of the User-Managed Replica. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.
             */
            customerManagedEncryption?: pulumi.Input<inputs.secretmanager.v1.CustomerManagedEncryption>;
            /**
             * The canonical IDs of the location to replicate data. For example: `"us-east1"`.
             */
            location?: pulumi.Input<string>;
        }
        /**
         * A policy that defines the replication and encryption configuration of data.
         */
        interface Replication {
            /**
             * The Secret will automatically be replicated without any restrictions.
             */
            automatic?: pulumi.Input<inputs.secretmanager.v1.Automatic>;
            /**
             * The Secret will only be replicated into the locations specified.
             */
            userManaged?: pulumi.Input<inputs.secretmanager.v1.UserManaged>;
        }
        /**
         * The rotation time and period for a Secret. At next_rotation_time, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. Secret.topics must be set to configure rotation.
         */
        interface Rotation {
            /**
             * Optional. Timestamp in UTC at which the Secret is scheduled to rotate. next_rotation_time MUST be set if rotation_period is set.
             */
            nextRotationTime?: pulumi.Input<string>;
            /**
             * Input only. The Duration between rotation notifications. Must be in seconds and at least 3600s (1h) and at most 3153600000s (100 years). If rotation_period is set, next_rotation_time must be set. next_rotation_time will be advanced by this period when the service automatically sends rotation notifications.
             */
            rotationPeriod?: pulumi.Input<string>;
        }
        /**
         * A Pub/Sub topic which Secret Manager will publish to when control plane events occur on this secret.
         */
        interface Topic {
            /**
             * Required. The resource name of the Pub/Sub topic that will be published to, in the following format: `projects/*&#47;topics/*`. For publication to succeed, the Secret Manager P4SA must have `pubsub.publisher` permissions on the topic.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * A replication policy that replicates the Secret payload into the locations specified in Secret.replication.user_managed.replicas
         */
        interface UserManaged {
            /**
             * Required. The list of Replicas for this Secret. Cannot be empty.
             */
            replicas?: pulumi.Input<pulumi.Input<inputs.secretmanager.v1.Replica>[]>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.secretmanager.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * A replication policy that replicates the Secret payload without any restrictions.
         */
        interface Automatic {
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.secretmanager.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Represents a Replica for this Secret.
         */
        interface Replica {
            /**
             * The canonical IDs of the location to replicate data. For example: `"us-east1"`.
             */
            location?: pulumi.Input<string>;
        }
        /**
         * A policy that defines the replication configuration of data.
         */
        interface Replication {
            /**
             * The Secret will automatically be replicated without any restrictions.
             */
            automatic?: pulumi.Input<inputs.secretmanager.v1beta1.Automatic>;
            /**
             * The Secret will only be replicated into the locations specified.
             */
            userManaged?: pulumi.Input<inputs.secretmanager.v1beta1.UserManaged>;
        }
        /**
         * A replication policy that replicates the Secret payload into the locations specified in Secret.replication.user_managed.replicas
         */
        interface UserManaged {
            /**
             * Required. The list of Replicas for this Secret. Cannot be empty.
             */
            replicas?: pulumi.Input<pulumi.Input<inputs.secretmanager.v1beta1.Replica>[]>;
        }
    }
}
export declare namespace securitycenter {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.securitycenter.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.securitycenter.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * The config for streaming-based notifications, which send each event as soon as it is detected.
         */
        interface StreamingConfig {
            /**
             * Expression that defines the filter to apply across create/update events of assets or findings as specified by the event type. The expression is a list of zero or more restrictions combined via logical operators `AND` and `OR`. Parentheses are supported, and `OR` has higher precedence than `AND`. Restrictions have the form ` ` and may have a `-` character in front of them to indicate negation. The fields map to those defined in the corresponding resource. The supported operators are: * `=` for all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`, meaning substring matching, for strings. The supported value types are: * string literals in quotes. * integer literals without quotes. * boolean literals `true` and `false` without quotes.
             */
            filter?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.securitycenter.v1beta1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.securitycenter.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace servicedirectory {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.servicedirectory.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
    namespace v1beta1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.servicedirectory.v1beta1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace servicemanagement {
    namespace v1 {
        /**
         * Api is a light-weight descriptor for an API Interface. Interfaces are also described as "protocol buffer services" in some contexts, such as by the "service" keyword in a .proto file, but they are different from API Services, which represent a concrete implementation of an interface as opposed to simply a description of methods and bindings. They are also sometimes simply referred to as "APIs" in other contexts, such as the name of this message itself. See https://cloud.google.com/apis/design/glossary for detailed terminology.
         */
        interface Api {
            /**
             * The methods of this interface, in unspecified order.
             */
            methods?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Method>[]>;
            /**
             * Included interfaces. See Mixin.
             */
            mixins?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Mixin>[]>;
            /**
             * The fully qualified name of this interface, including package name followed by the interface's simple name.
             */
            name?: pulumi.Input<string>;
            /**
             * Any metadata attached to the interface.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
            /**
             * Source context for the protocol buffer service represented by this message.
             */
            sourceContext?: pulumi.Input<inputs.servicemanagement.v1.SourceContext>;
            /**
             * The source syntax of the service.
             */
            syntax?: pulumi.Input<string>;
            /**
             * A version string for this interface. If specified, must have the form `major-version.minor-version`, as in `1.10`. If the minor version is omitted, it defaults to zero. If the entire version field is empty, the major version is derived from the package name, as outlined below. If the field is not empty, the version in the package name will be verified to be consistent with what is provided here. The versioning schema uses [semantic versioning](http://semver.org) where the major version number indicates a breaking change and the minor version an additive, non-breaking change. Both version numbers are signals to users what to expect from different versions, and should be carefully chosen based on the product plan. The major version is also reflected in the package name of the interface, which must end in `v`, as in `google.feature.v1`. For major versions 0 and 1, the suffix can be omitted. Zero major versions must only be used for experimental, non-GA interfaces.
             */
            version?: pulumi.Input<string>;
        }
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Configuration for an authentication provider, including support for [JSON Web Token (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32).
         */
        interface AuthProvider {
            /**
             * The list of JWT [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3). that are allowed to access. A JWT containing any of these audiences will be accepted. When this setting is absent, JWTs with audiences: - "https://[service.name]/[google.protobuf.Api.name]" - "https://[service.name]/" will be accepted. For example, if no audiences are in the setting, LibraryService API will accept JWTs with the following audiences: - https://library-example.googleapis.com/google.example.library.v1.LibraryService - https://library-example.googleapis.com/ Example: audiences: bookstore_android.apps.googleusercontent.com, bookstore_web.apps.googleusercontent.com
             */
            audiences?: pulumi.Input<string>;
            /**
             * Redirect URL if JWT token is required but not present or is expired. Implement authorizationUrl of securityDefinitions in OpenAPI spec.
             */
            authorizationUrl?: pulumi.Input<string>;
            /**
             * The unique identifier of the auth provider. It will be referred to by `AuthRequirement.provider_id`. Example: "bookstore_auth".
             */
            id?: pulumi.Input<string>;
            /**
             * Identifies the principal that issued the JWT. See https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.1 Usually a URL or an email address. Example: https://securetoken.google.com Example: 1234567-compute@developer.gserviceaccount.com
             */
            issuer?: pulumi.Input<string>;
            /**
             * URL of the provider's public key set to validate signature of the JWT. See [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). Optional if the key set document: - can be retrieved from [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) of the issuer. - can be inferred from the email domain of the issuer (e.g. a Google service account). Example: https://www.googleapis.com/oauth2/v1/certs
             */
            jwksUri?: pulumi.Input<string>;
            /**
             * Defines the locations to extract the JWT. JWT locations can be either from HTTP headers or URL query parameters. The rule is that the first match wins. The checking order is: checking all headers first, then URL query parameters. If not specified, default to use following 3 locations: 1) Authorization: Bearer 2) x-goog-iap-jwt-assertion 3) access_token query parameter Default locations can be specified as followings: jwt_locations: - header: Authorization value_prefix: "Bearer " - header: x-goog-iap-jwt-assertion - query: access_token
             */
            jwtLocations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.JwtLocation>[]>;
        }
        /**
         * User-defined authentication requirements, including support for [JSON Web Token (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32).
         */
        interface AuthRequirement {
            /**
             * NOTE: This will be deprecated soon, once AuthProvider.audiences is implemented and accepted in all the runtime components. The list of JWT [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3). that are allowed to access. A JWT containing any of these audiences will be accepted. When this setting is absent, only JWTs with audience "https://Service_name/API_name" will be accepted. For example, if no audiences are in the setting, LibraryService API will only accept JWTs with the following audience "https://library-example.googleapis.com/google.example.library.v1.LibraryService". Example: audiences: bookstore_android.apps.googleusercontent.com, bookstore_web.apps.googleusercontent.com
             */
            audiences?: pulumi.Input<string>;
            /**
             * id from authentication provider. Example: provider_id: bookstore_auth
             */
            providerId?: pulumi.Input<string>;
        }
        /**
         * `Authentication` defines the authentication configuration for an API. Example for an API targeted for external use: name: calendar.googleapis.com authentication: providers: - id: google_calendar_auth jwks_uri: https://www.googleapis.com/oauth2/v1/certs issuer: https://securetoken.google.com rules: - selector: "*" requirements: provider_id: google_calendar_auth
         */
        interface Authentication {
            /**
             * Defines a set of authentication providers that a service supports.
             */
            providers?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.AuthProvider>[]>;
            /**
             * A list of authentication rules that apply to individual API methods. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.AuthenticationRule>[]>;
        }
        /**
         * Authentication rules for the service. By default, if a method has any authentication requirements, every request must include a valid credential matching one of the requirements. It's an error to include more than one kind of credential in a single request. If a method doesn't have any auth requirements, request credentials will be ignored.
         */
        interface AuthenticationRule {
            /**
             * If true, the service accepts API keys without any other credential. This flag only applies to HTTP and gRPC requests.
             */
            allowWithoutCredential?: pulumi.Input<boolean>;
            /**
             * The requirements for OAuth credentials.
             */
            oauth?: pulumi.Input<inputs.servicemanagement.v1.OAuthRequirements>;
            /**
             * Requirements for additional authentication providers.
             */
            requirements?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.AuthRequirement>[]>;
            /**
             * Selects the methods to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * `Backend` defines the backend configuration for a service.
         */
        interface Backend {
            /**
             * A list of API backend rules that apply to individual API methods. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.BackendRule>[]>;
        }
        /**
         * A backend rule provides configuration for an individual API element.
         */
        interface BackendRule {
            /**
             * The address of the API backend. The scheme is used to determine the backend protocol and security. The following schemes are accepted: SCHEME PROTOCOL SECURITY http:// HTTP None https:// HTTP TLS grpc:// gRPC None grpcs:// gRPC TLS It is recommended to explicitly include a scheme. Leaving out the scheme may cause constrasting behaviors across platforms. If the port is unspecified, the default is: - 80 for schemes without TLS - 443 for schemes with TLS For HTTP backends, use protocol to specify the protocol version.
             */
            address?: pulumi.Input<string>;
            /**
             * The number of seconds to wait for a response from a request. The default varies based on the request protocol and deployment environment.
             */
            deadline?: pulumi.Input<number>;
            /**
             * When disable_auth is true, a JWT ID token won't be generated and the original "Authorization" HTTP header will be preserved. If the header is used to carry the original token and is expected by the backend, this field must be set to true to preserve the header.
             */
            disableAuth?: pulumi.Input<boolean>;
            /**
             * The JWT audience is used when generating a JWT ID token for the backend. This ID token will be added in the HTTP "authorization" header, and sent to the backend.
             */
            jwtAudience?: pulumi.Input<string>;
            /**
             * Minimum deadline in seconds needed for this method. Calls having deadline value lower than this will be rejected.
             */
            minDeadline?: pulumi.Input<number>;
            /**
             * The number of seconds to wait for the completion of a long running operation. The default is no deadline.
             */
            operationDeadline?: pulumi.Input<number>;
            pathTranslation?: pulumi.Input<string>;
            /**
             * The protocol used for sending a request to the backend. The supported values are "http/1.1" and "h2". The default value is inferred from the scheme in the address field: SCHEME PROTOCOL http:// http/1.1 https:// http/1.1 grpc:// h2 grpcs:// h2 For secure HTTP backends (https://) that support HTTP/2, set this field to "h2" for improved performance. Configuring this field to non-default values is only supported for secure HTTP backends. This field will be ignored for all other backends. See https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids for more details on the supported values.
             */
            protocol?: pulumi.Input<string>;
            /**
             * Selects the methods to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * Billing related configuration of the service. The following example shows how to configure monitored resources and metrics for billing, `consumer_destinations` is the only supported destination and the monitored resources need at least one label key `cloud.googleapis.com/location` to indicate the location of the billing usage, using different monitored resources between monitoring and billing is recommended so they can be evolved independently: monitored_resources: - type: library.googleapis.com/billing_branch labels: - key: cloud.googleapis.com/location description: | Predefined label to support billing location restriction. - key: city description: | Custom label to define the city where the library branch is located in. - key: name description: Custom label to define the name of the library branch. metrics: - name: library.googleapis.com/book/borrowed_count metric_kind: DELTA value_type: INT64 unit: "1" billing: consumer_destinations: - monitored_resource: library.googleapis.com/billing_branch metrics: - library.googleapis.com/book/borrowed_count
         */
        interface Billing {
            /**
             * Billing configurations for sending metrics to the consumer project. There can be multiple consumer destinations per service, each one must have a different monitored resource type. A metric can be used in at most one consumer destination.
             */
            consumerDestinations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.BillingDestination>[]>;
        }
        /**
         * Configuration of a specific billing destination (Currently only support bill against consumer project).
         */
        interface BillingDestination {
            /**
             * Names of the metrics to report to this billing destination. Each name must be defined in Service.metrics section.
             */
            metrics?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The monitored resource type. The type must be defined in Service.monitored_resources section.
             */
            monitoredResource?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.servicemanagement.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * `Context` defines which contexts an API requests. Example: context: rules: - selector: "*" requested: - google.rpc.context.ProjectContext - google.rpc.context.OriginContext The above specifies that all methods in the API request `google.rpc.context.ProjectContext` and `google.rpc.context.OriginContext`. Available context types are defined in package `google.rpc.context`. This also provides mechanism to allowlist any protobuf message extension that can be sent in grpc metadata using “x-goog-ext--bin” and “x-goog-ext--jspb” format. For example, list any service specific protobuf types that can appear in grpc metadata as follows in your yaml file: Example: context: rules: - selector: "google.example.library.v1.LibraryService.CreateBook" allowed_request_extensions: - google.foo.v1.NewExtension allowed_response_extensions: - google.foo.v1.NewExtension You can also specify extension ID instead of fully qualified extension name here.
         */
        interface Context {
            /**
             * A list of RPC context rules that apply to individual API methods. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.ContextRule>[]>;
        }
        /**
         * A context rule provides information about the context for an individual API element.
         */
        interface ContextRule {
            /**
             * A list of full type names or extension IDs of extensions allowed in grpc side channel from client to backend.
             */
            allowedRequestExtensions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of full type names or extension IDs of extensions allowed in grpc side channel from backend to client.
             */
            allowedResponseExtensions?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of full type names of provided contexts.
             */
            provided?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of full type names of requested contexts.
             */
            requested?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Selects the methods to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * Selects and configures the service controller used by the service. The service controller handles features like abuse, quota, billing, logging, monitoring, etc.
         */
        interface Control {
            /**
             * The service control environment to use. If empty, no control plane feature (like quota and billing) will be enabled.
             */
            environment?: pulumi.Input<string>;
        }
        /**
         * Customize service error responses. For example, list any service specific protobuf types that can appear in error detail lists of error responses. Example: custom_error: types: - google.foo.v1.CustomError - google.foo.v1.AnotherError
         */
        interface CustomError {
            /**
             * The list of custom error rules that apply to individual API messages. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.CustomErrorRule>[]>;
            /**
             * The list of custom error detail types, e.g. 'google.foo.v1.CustomError'.
             */
            types?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A custom error rule.
         */
        interface CustomErrorRule {
            /**
             * Mark this message as possible payload in error response. Otherwise, objects of this type will be filtered when they appear in error payload.
             */
            isErrorType?: pulumi.Input<boolean>;
            /**
             * Selects messages to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * A custom pattern is used for defining custom HTTP verb.
         */
        interface CustomHttpPattern {
            /**
             * The name of this custom HTTP verb.
             */
            kind?: pulumi.Input<string>;
            /**
             * The path matched by this custom verb.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * Strategy used to delete a service. This strategy is a placeholder only used by the system generated rollout to delete a service.
         */
        interface DeleteServiceStrategy {
        }
        /**
         * `Documentation` provides the information for describing a service. Example: documentation: summary: > The Google Calendar API gives access to most calendar features. pages: - name: Overview content: (== include google/foo/overview.md ==) - name: Tutorial content: (== include google/foo/tutorial.md ==) subpages; - name: Java content: (== include google/foo/tutorial_java.md ==) rules: - selector: google.calendar.Calendar.Get description: > ... - selector: google.calendar.Calendar.Put description: > ... Documentation is provided in markdown syntax. In addition to standard markdown features, definition lists, tables and fenced code blocks are supported. Section headers can be provided and are interpreted relative to the section nesting of the context where a documentation fragment is embedded. Documentation from the IDL is merged with documentation defined via the config at normalization time, where documentation provided by config rules overrides IDL provided. A number of constructs specific to the API platform are supported in documentation text. In order to reference a proto element, the following notation can be used: [fully.qualified.proto.name][] To override the display text used for the link, this can be used: [display text][fully.qualified.proto.name] Text can be excluded from doc using the following notation: (-- internal comment --) A few directives are available in documentation. Note that directives must appear on a single line to be properly identified. The `include` directive includes a markdown file from an external source: (== include path/to/file ==) The `resource_for` directive marks a message to be the resource of a collection in REST view. If it is not specified, tools attempt to infer the resource from the operations in a collection: (== resource_for v1.shelves.books ==) The directive `suppress_warning` does not directly affect documentation and is documented together with service config validation.
         */
        interface Documentation {
            /**
             * The URL to the root of documentation.
             */
            documentationRootUrl?: pulumi.Input<string>;
            /**
             * Declares a single overview page. For example: documentation: summary: ... overview: (== include overview.md ==) This is a shortcut for the following declaration (using pages style): documentation: summary: ... pages: - name: Overview content: (== include overview.md ==) Note: you cannot specify both `overview` field and `pages` field.
             */
            overview?: pulumi.Input<string>;
            /**
             * The top level pages for the documentation set.
             */
            pages?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Page>[]>;
            /**
             * A list of documentation rules that apply to individual API elements. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.DocumentationRule>[]>;
            /**
             * Specifies the service root url if the default one (the service name from the yaml file) is not suitable. This can be seen in any fully specified service urls as well as sections that show a base that other urls are relative to.
             */
            serviceRootUrl?: pulumi.Input<string>;
            /**
             * A short summary of what the service does. Can only be provided by plain text.
             */
            summary?: pulumi.Input<string>;
        }
        /**
         * A documentation rule provides information about individual API elements.
         */
        interface DocumentationRule {
            /**
             * Deprecation description of the selected element(s). It can be provided if an element is marked as `deprecated`.
             */
            deprecationDescription?: pulumi.Input<string>;
            /**
             * Description of the selected API(s).
             */
            description?: pulumi.Input<string>;
            /**
             * The selector is a comma-separated list of patterns. Each pattern is a qualified name of the element which may end in "*", indicating a wildcard. Wildcards are only allowed at the end and for a whole component of the qualified name, i.e. "foo.*" is ok, but not "foo.b*" or "foo.*.bar". A wildcard will match one or more components. To specify a default for all applicable elements, the whole pattern "*" is used.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * `Endpoint` describes a network endpoint of a service that serves a set of APIs. It is commonly known as a service endpoint. A service may expose any number of service endpoints, and all service endpoints share the same service definition, such as quota limits and monitoring metrics. Example service configuration: name: library-example.googleapis.com endpoints: # Below entry makes 'google.example.library.v1.Library' # API be served from endpoint address library-example.googleapis.com. # It also allows HTTP OPTIONS calls to be passed to the backend, for # it to decide whether the subsequent cross-origin request is # allowed to proceed. - name: library-example.googleapis.com allow_cors: true
         */
        interface Endpoint {
            /**
             * DEPRECATED: This field is no longer supported. Instead of using aliases, please specify multiple google.api.Endpoint for each of the intended aliases. Additional names that this endpoint will be hosted on.
             */
            aliases?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Allowing [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing), aka cross-domain traffic, would allow the backends served from this endpoint to receive and respond to HTTP OPTIONS requests. The response will be used by the browser to determine whether the subsequent cross-origin request is allowed to proceed.
             */
            allowCors?: pulumi.Input<boolean>;
            /**
             * The canonical name of this endpoint.
             */
            name?: pulumi.Input<string>;
            /**
             * The specification of an Internet routable address of API frontend that will handle requests to this [API Endpoint](https://cloud.google.com/apis/design/glossary). It should be either a valid IPv4 address or a fully-qualified domain name. For example, "8.8.8.8" or "myservice.appspot.com".
             */
            target?: pulumi.Input<string>;
        }
        /**
         * Enum type definition.
         */
        interface Enum {
            /**
             * Enum value definitions.
             */
            enumvalue?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.EnumValue>[]>;
            /**
             * Enum type name.
             */
            name?: pulumi.Input<string>;
            /**
             * Protocol buffer options.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
            /**
             * The source context.
             */
            sourceContext?: pulumi.Input<inputs.servicemanagement.v1.SourceContext>;
            /**
             * The source syntax.
             */
            syntax?: pulumi.Input<string>;
        }
        /**
         * Enum value definition.
         */
        interface EnumValue {
            /**
             * Enum value name.
             */
            name?: pulumi.Input<string>;
            /**
             * Enum value number.
             */
            number?: pulumi.Input<number>;
            /**
             * Protocol buffer options.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * A single field of a message type.
         */
        interface Field {
            /**
             * The field cardinality.
             */
            cardinality?: pulumi.Input<string>;
            /**
             * The string value of the default value of this field. Proto2 syntax only.
             */
            defaultValue?: pulumi.Input<string>;
            /**
             * The field JSON name.
             */
            jsonName?: pulumi.Input<string>;
            /**
             * The field type.
             */
            kind?: pulumi.Input<string>;
            /**
             * The field name.
             */
            name?: pulumi.Input<string>;
            /**
             * The field number.
             */
            number?: pulumi.Input<number>;
            /**
             * The index of the field type in `Type.oneofs`, for message or enumeration types. The first type has index 1; zero means the type is not in the list.
             */
            oneofIndex?: pulumi.Input<number>;
            /**
             * The protocol buffer options.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
            /**
             * Whether to use alternative packed wire representation.
             */
            packed?: pulumi.Input<boolean>;
            /**
             * The field type URL, without the scheme, for message or enumeration types. Example: `"type.googleapis.com/google.protobuf.Timestamp"`.
             */
            typeUrl?: pulumi.Input<string>;
        }
        /**
         * Defines the HTTP configuration for an API service. It contains a list of HttpRule, each specifying the mapping of an RPC method to one or more HTTP REST API methods.
         */
        interface Http {
            /**
             * When set to true, URL path parameters will be fully URI-decoded except in cases of single segment matches in reserved expansion, where "%2F" will be left encoded. The default behavior is to not decode RFC 6570 reserved characters in multi segment matches.
             */
            fullyDecodeReservedExpansion?: pulumi.Input<boolean>;
            /**
             * A list of HTTP configuration rules that apply to individual API methods. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.HttpRule>[]>;
        }
        /**
         * # gRPC Transcoding gRPC Transcoding is a feature for mapping between a gRPC method and one or more HTTP REST endpoints. It allows developers to build a single API service that supports both gRPC APIs and REST APIs. Many systems, including [Google APIs](https://github.com/googleapis/googleapis), [Cloud Endpoints](https://cloud.google.com/endpoints), [gRPC Gateway](https://github.com/grpc-ecosystem/grpc-gateway), and [Envoy](https://github.com/envoyproxy/envoy) proxy support this feature and use it for large scale production services. `HttpRule` defines the schema of the gRPC/REST mapping. The mapping specifies how different portions of the gRPC request message are mapped to the URL path, URL query parameters, and HTTP request body. It also controls how the gRPC response message is mapped to the HTTP response body. `HttpRule` is typically specified as an `google.api.http` annotation on the gRPC method. Each mapping specifies a URL path template and an HTTP method. The path template may refer to one or more fields in the gRPC request message, as long as each field is a non-repeated field with a primitive (non-message) type. The path template controls how fields of the request message are mapped to the URL path. Example: service Messaging { rpc GetMessage(GetMessageRequest) returns (Message) { option (google.api.http) = { get: "/v1/{name=messages/*}" }; } } message GetMessageRequest { string name = 1; // Mapped to URL path. } message Message { string text = 1; // The resource content. } This enables an HTTP REST to gRPC mapping as below: HTTP | gRPC -----|----- `GET /v1/messages/123456` | `GetMessage(name: "messages/123456")` Any fields in the request message which are not bound by the path template automatically become HTTP query parameters if there is no HTTP request body. For example: service Messaging { rpc GetMessage(GetMessageRequest) returns (Message) { option (google.api.http) = { get:"/v1/messages/{message_id}" }; } } message GetMessageRequest { message SubMessage { string subfield = 1; } string message_id = 1; // Mapped to URL path. int64 revision = 2; // Mapped to URL query parameter `revision`. SubMessage sub = 3; // Mapped to URL query parameter `sub.subfield`. } This enables a HTTP JSON to RPC mapping as below: HTTP | gRPC -----|----- `GET /v1/messages/123456?revision=2&sub.subfield=foo` | `GetMessage(message_id: "123456" revision: 2 sub: SubMessage(subfield: "foo"))` Note that fields which are mapped to URL query parameters must have a primitive type or a repeated primitive type or a non-repeated message type. In the case of a repeated type, the parameter can be repeated in the URL as `...?param=A&param=B`. In the case of a message type, each field of the message is mapped to a separate parameter, such as `...?foo.a=A&foo.b=B&foo.c=C`. For HTTP methods that allow a request body, the `body` field specifies the mapping. Consider a REST update method on the message resource collection: service Messaging { rpc UpdateMessage(UpdateMessageRequest) returns (Message) { option (google.api.http) = { patch: "/v1/messages/{message_id}" body: "message" }; } } message UpdateMessageRequest { string message_id = 1; // mapped to the URL Message message = 2; // mapped to the body } The following HTTP JSON to RPC mapping is enabled, where the representation of the JSON in the request body is determined by protos JSON encoding: HTTP | gRPC -----|----- `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id: "123456" message { text: "Hi!" })` The special name `*` can be used in the body mapping to define that every field not bound by the path template should be mapped to the request body. This enables the following alternative definition of the update method: service Messaging { rpc UpdateMessage(Message) returns (Message) { option (google.api.http) = { patch: "/v1/messages/{message_id}" body: "*" }; } } message Message { string message_id = 1; string text = 2; } The following HTTP JSON to RPC mapping is enabled: HTTP | gRPC -----|----- `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id: "123456" text: "Hi!")` Note that when using `*` in the body mapping, it is not possible to have HTTP parameters, as all fields not bound by the path end in the body. This makes this option more rarely used in practice when defining REST APIs. The common usage of `*` is in custom methods which don't use the URL at all for transferring data. It is possible to define multiple HTTP methods for one RPC by using the `additional_bindings` option. Example: service Messaging { rpc GetMessage(GetMessageRequest) returns (Message) { option (google.api.http) = { get: "/v1/messages/{message_id}" additional_bindings { get: "/v1/users/{user_id}/messages/{message_id}" } }; } } message GetMessageRequest { string message_id = 1; string user_id = 2; } This enables the following two alternative HTTP JSON to RPC mappings: HTTP | gRPC -----|----- `GET /v1/messages/123456` | `GetMessage(message_id: "123456")` `GET /v1/users/me/messages/123456` | `GetMessage(user_id: "me" message_id: "123456")` ## Rules for HTTP mapping 1. Leaf request fields (recursive expansion nested messages in the request message) are classified into three categories: - Fields referred by the path template. They are passed via the URL path. - Fields referred by the HttpRule.body. They are passed via the HTTP request body. - All other fields are passed via the URL query parameters, and the parameter name is the field path in the request message. A repeated field can be represented as multiple query parameters under the same name. 2. If HttpRule.body is "*", there is no URL query parameter, all fields are passed via URL path and HTTP request body. 3. If HttpRule.body is omitted, there is no HTTP request body, all fields are passed via URL path and URL query parameters. ### Path template syntax Template = "/" Segments [ Verb ] ; Segments = Segment { "/" Segment } ; Segment = "*" | "**" | LITERAL | Variable ; Variable = "{" FieldPath [ "=" Segments ] "}" ; FieldPath = IDENT { "." IDENT } ; Verb = ":" LITERAL ; The syntax `*` matches a single URL path segment. The syntax `**` matches zero or more URL path segments, which must be the last part of the URL path except the `Verb`. The syntax `Variable` matches part of the URL path as specified by its template. A variable template must not contain other variables. If a variable matches a single path segment, its template may be omitted, e.g. `{var}` is equivalent to `{var=*}`. The syntax `LITERAL` matches literal text in the URL path. If the `LITERAL` contains any reserved character, such characters should be percent-encoded before the matching. If a variable contains exactly one path segment, such as `"{var}"` or `"{var=*}"`, when such a variable is expanded into a URL path on the client side, all characters except `[-_.~0-9a-zA-Z]` are percent-encoded. The server side does the reverse decoding. Such variables show up in the [Discovery Document](https://developers.google.com/discovery/v1/reference/apis) as `{var}`. If a variable contains multiple path segments, such as `"{var=foo/*}"` or `"{var=**}"`, when such a variable is expanded into a URL path on the client side, all characters except `[-_.~/0-9a-zA-Z]` are percent-encoded. The server side does the reverse decoding, except "%2F" and "%2f" are left unchanged. Such variables show up in the [Discovery Document](https://developers.google.com/discovery/v1/reference/apis) as `{+var}`. ## Using gRPC API Service Configuration gRPC API Service Configuration (service config) is a configuration language for configuring a gRPC service to become a user-facing product. The service config is simply the YAML representation of the `google.api.Service` proto message. As an alternative to annotating your proto file, you can configure gRPC transcoding in your service config YAML files. You do this by specifying a `HttpRule` that maps the gRPC method to a REST endpoint, achieving the same effect as the proto annotation. This can be particularly useful if you have a proto that is reused in multiple services. Note that any transcoding specified in the service config will override any matching transcoding configuration in the proto. Example: http: rules: # Selects a gRPC method and applies HttpRule to it. - selector: example.v1.Messaging.GetMessage get: /v1/messages/{message_id}/{sub.subfield} ## Special notes When gRPC Transcoding is used to map a gRPC to JSON REST endpoints, the proto to JSON conversion must follow the [proto3 specification](https://developers.google.com/protocol-buffers/docs/proto3#json). While the single segment variable follows the semantics of [RFC 6570](https://tools.ietf.org/html/rfc6570) Section 3.2.2 Simple String Expansion, the multi segment variable **does not** follow RFC 6570 Section 3.2.3 Reserved Expansion. The reason is that the Reserved Expansion does not expand special characters like `?` and `#`, which would lead to invalid URLs. As the result, gRPC Transcoding uses a custom encoding for multi segment variables. The path variables **must not** refer to any repeated or mapped field, because client libraries are not capable of handling such variable expansion. The path variables **must not** capture the leading "/" character. The reason is that the most common use case "{var}" does not capture the leading "/" character. For consistency, all path variables must share the same behavior. Repeated message fields must not be mapped to URL query parameters, because no client library can support such complicated mapping. If an API needs to use a JSON array for request or response body, it can map the request or response body to a repeated field. However, some gRPC Transcoding implementations may not support this feature.
         */
        interface HttpRule {
            /**
             * Additional HTTP bindings for the selector. Nested bindings must not contain an `additional_bindings` field themselves (that is, the nesting may only be one level deep).
             */
            additionalBindings?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.HttpRule>[]>;
            /**
             * The name of the request field whose value is mapped to the HTTP request body, or `*` for mapping all request fields not captured by the path pattern to the HTTP body, or omitted for not having any HTTP request body. NOTE: the referred field must be present at the top-level of the request message type.
             */
            body?: pulumi.Input<string>;
            /**
             * The custom pattern is used for specifying an HTTP method that is not included in the `pattern` field, such as HEAD, or "*" to leave the HTTP method unspecified for this rule. The wild-card rule is useful for services that provide content to Web (HTML) clients.
             */
            custom?: pulumi.Input<inputs.servicemanagement.v1.CustomHttpPattern>;
            /**
             * Maps to HTTP DELETE. Used for deleting a resource.
             */
            delete?: pulumi.Input<string>;
            /**
             * Maps to HTTP GET. Used for listing and getting information about resources.
             */
            get?: pulumi.Input<string>;
            /**
             * Maps to HTTP PATCH. Used for updating a resource.
             */
            patch?: pulumi.Input<string>;
            /**
             * Maps to HTTP POST. Used for creating a resource or performing an action.
             */
            post?: pulumi.Input<string>;
            /**
             * Maps to HTTP PUT. Used for replacing a resource.
             */
            put?: pulumi.Input<string>;
            /**
             * Optional. The name of the response field whose value is mapped to the HTTP response body. When omitted, the entire response message will be used as the HTTP response body. NOTE: The referred field must be present at the top-level of the response message type.
             */
            responseBody?: pulumi.Input<string>;
            /**
             * Selects a method to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * Specifies a location to extract JWT from an API request.
         */
        interface JwtLocation {
            /**
             * Specifies HTTP header name to extract JWT token.
             */
            header?: pulumi.Input<string>;
            /**
             * Specifies URL query parameter name to extract JWT token.
             */
            query?: pulumi.Input<string>;
            /**
             * The value prefix. The value format is "value_prefix{token}" Only applies to "in" header type. Must be empty for "in" query type. If not empty, the header value has to match (case sensitive) this prefix. If not matched, JWT will not be extracted. If matched, JWT will be extracted after the prefix is removed. For example, for "Authorization: Bearer {JWT}", value_prefix="Bearer " with a space at the end.
             */
            valuePrefix?: pulumi.Input<string>;
        }
        /**
         * A description of a label.
         */
        interface LabelDescriptor {
            /**
             * A human-readable description for the label.
             */
            description?: pulumi.Input<string>;
            /**
             * The label key.
             */
            key?: pulumi.Input<string>;
            /**
             * The type of data that can be assigned to the label.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * A description of a log type. Example in YAML format: - name: library.googleapis.com/activity_history description: The history of borrowing and returning library items. display_name: Activity labels: - key: /customer_id description: Identifier of a library customer
         */
        interface LogDescriptor {
            /**
             * A human-readable description of this log. This information appears in the documentation and can contain details.
             */
            description?: pulumi.Input<string>;
            /**
             * The human-readable name for this log. This information appears on the user interface and should be concise.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The set of labels that are available to describe a specific log entry. Runtime requests that contain labels not specified here are considered invalid.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.LabelDescriptor>[]>;
            /**
             * The name of the log. It must be less than 512 characters long and can include the following characters: upper- and lower-case alphanumeric characters [A-Za-z0-9], and punctuation characters including slash, underscore, hyphen, period [/_-.].
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Logging configuration of the service. The following example shows how to configure logs to be sent to the producer and consumer projects. In the example, the `activity_history` log is sent to both the producer and consumer projects, whereas the `purchase_history` log is only sent to the producer project. monitored_resources: - type: library.googleapis.com/branch labels: - key: /city description: The city where the library branch is located in. - key: /name description: The name of the branch. logs: - name: activity_history labels: - key: /customer_id - name: purchase_history logging: producer_destinations: - monitored_resource: library.googleapis.com/branch logs: - activity_history - purchase_history consumer_destinations: - monitored_resource: library.googleapis.com/branch logs: - activity_history
         */
        interface Logging {
            /**
             * Logging configurations for sending logs to the consumer project. There can be multiple consumer destinations, each one must have a different monitored resource type. A log can be used in at most one consumer destination.
             */
            consumerDestinations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.LoggingDestination>[]>;
            /**
             * Logging configurations for sending logs to the producer project. There can be multiple producer destinations, each one must have a different monitored resource type. A log can be used in at most one producer destination.
             */
            producerDestinations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.LoggingDestination>[]>;
        }
        /**
         * Configuration of a specific logging destination (the producer project or the consumer project).
         */
        interface LoggingDestination {
            /**
             * Names of the logs to be sent to this destination. Each name must be defined in the Service.logs section. If the log name is not a domain scoped name, it will be automatically prefixed with the service name followed by "/".
             */
            logs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The monitored resource type. The type must be defined in the Service.monitored_resources section.
             */
            monitoredResource?: pulumi.Input<string>;
        }
        /**
         * Method represents a method of an API interface.
         */
        interface Method {
            /**
             * The simple name of this method.
             */
            name?: pulumi.Input<string>;
            /**
             * Any metadata attached to the method.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
            /**
             * If true, the request is streamed.
             */
            requestStreaming?: pulumi.Input<boolean>;
            /**
             * A URL of the input message type.
             */
            requestTypeUrl?: pulumi.Input<string>;
            /**
             * If true, the response is streamed.
             */
            responseStreaming?: pulumi.Input<boolean>;
            /**
             * The URL of the output message type.
             */
            responseTypeUrl?: pulumi.Input<string>;
            /**
             * The source syntax of this method.
             */
            syntax?: pulumi.Input<string>;
        }
        /**
         * Defines a metric type and its schema. Once a metric descriptor is created, deleting or altering it stops data collection and makes the metric type's existing data unusable.
         */
        interface MetricDescriptor {
            /**
             * A detailed description of the metric, which can be used in documentation.
             */
            description?: pulumi.Input<string>;
            /**
             * A concise name for the metric, which can be displayed in user interfaces. Use sentence case without an ending period, for example "Request count". This field is optional but it is recommended to be set for any metrics associated with user-visible concepts, such as Quota.
             */
            displayName?: pulumi.Input<string>;
            /**
             * The set of labels that can be used to describe a specific instance of this metric type. For example, the `appengine.googleapis.com/http/server/response_latencies` metric type has a label for the HTTP response code, `response_code`, so you can look at latencies for successful responses or just for responses that failed.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.LabelDescriptor>[]>;
            /**
             * Optional. The launch stage of the metric definition.
             */
            launchStage?: pulumi.Input<string>;
            /**
             * Optional. Metadata which can be used to guide usage of the metric.
             */
            metadata?: pulumi.Input<inputs.servicemanagement.v1.MetricDescriptorMetadata>;
            /**
             * Whether the metric records instantaneous values, changes to a value, etc. Some combinations of `metric_kind` and `value_type` might not be supported.
             */
            metricKind?: pulumi.Input<string>;
            /**
             * Read-only. If present, then a time series, which is identified partially by a metric type and a MonitoredResourceDescriptor, that is associated with this metric type can only be associated with one of the monitored resource types listed here.
             */
            monitoredResourceTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The resource name of the metric descriptor.
             */
            name?: pulumi.Input<string>;
            /**
             * The metric type, including its DNS name prefix. The type is not URL-encoded. All user-defined metric types have the DNS name `custom.googleapis.com` or `external.googleapis.com`. Metric types should use a natural hierarchical grouping. For example: "custom.googleapis.com/invoice/paid/amount" "external.googleapis.com/prometheus/up" "appengine.googleapis.com/http/server/response_latencies"
             */
            type?: pulumi.Input<string>;
            /**
             * The units in which the metric value is reported. It is only applicable if the `value_type` is `INT64`, `DOUBLE`, or `DISTRIBUTION`. The `unit` defines the representation of the stored metric values. Different systems might scale the values to be more easily displayed (so a value of `0.02kBy` _might_ be displayed as `20By`, and a value of `3523kBy` _might_ be displayed as `3.5MBy`). However, if the `unit` is `kBy`, then the value of the metric is always in thousands of bytes, no matter how it might be displayed. If you want a custom metric to record the exact number of CPU-seconds used by a job, you can create an `INT64 CUMULATIVE` metric whose `unit` is `s{CPU}` (or equivalently `1s{CPU}` or just `s`). If the job uses 12,005 CPU-seconds, then the value is written as `12005`. Alternatively, if you want a custom metric to record data in a more granular way, you can create a `DOUBLE CUMULATIVE` metric whose `unit` is `ks{CPU}`, and then write the value `12.005` (which is `12005/1000`), or use `Kis{CPU}` and write `11.723` (which is `12005/1024`). The supported units are a subset of [The Unified Code for Units of Measure](https://unitsofmeasure.org/ucum.html) standard: **Basic units (UNIT)** * `bit` bit * `By` byte * `s` second * `min` minute * `h` hour * `d` day * `1` dimensionless **Prefixes (PREFIX)** * `k` kilo (10^3) * `M` mega (10^6) * `G` giga (10^9) * `T` tera (10^12) * `P` peta (10^15) * `E` exa (10^18) * `Z` zetta (10^21) * `Y` yotta (10^24) * `m` milli (10^-3) * `u` micro (10^-6) * `n` nano (10^-9) * `p` pico (10^-12) * `f` femto (10^-15) * `a` atto (10^-18) * `z` zepto (10^-21) * `y` yocto (10^-24) * `Ki` kibi (2^10) * `Mi` mebi (2^20) * `Gi` gibi (2^30) * `Ti` tebi (2^40) * `Pi` pebi (2^50) **Grammar** The grammar also includes these connectors: * `/` division or ratio (as an infix operator). For examples, `kBy/{email}` or `MiBy/10ms` (although you should almost never have `/s` in a metric `unit`; rates should always be computed at query time from the underlying cumulative or delta value). * `.` multiplication or composition (as an infix operator). For examples, `GBy.d` or `k{watt}.h`. The grammar for a unit is as follows: Expression = Component { "." Component } { "/" Component } ; Component = ( [ PREFIX ] UNIT | "%" ) [ Annotation ] | Annotation | "1" ; Annotation = "{" NAME "}" ; Notes: * `Annotation` is just a comment if it follows a `UNIT`. If the annotation is used alone, then the unit is equivalent to `1`. For examples, `{request}/s == 1/s`, `By{transmitted}/s == By/s`. * `NAME` is a sequence of non-blank printable ASCII characters not containing `{` or `}`. * `1` represents a unitary [dimensionless unit](https://en.wikipedia.org/wiki/Dimensionless_quantity) of 1, such as in `1/s`. It is typically used when none of the basic units are appropriate. For example, "new users per day" can be represented as `1/d` or `{new-users}/d` (and a metric value `5` would mean "5 new users). Alternatively, "thousands of page views per day" would be represented as `1000/d` or `k1/d` or `k{page_views}/d` (and a metric value of `5.3` would mean "5300 page views per day"). * `%` represents dimensionless value of 1/100, and annotates values giving a percentage (so the metric values are typically in the range of 0..100, and a metric value `3` means "3 percent"). * `10^2.%` indicates a metric contains a ratio, typically in the range 0..1, that will be multiplied by 100 and displayed as a percentage (so a metric value `0.03` means "3 percent").
             */
            unit?: pulumi.Input<string>;
            /**
             * Whether the measurement is an integer, a floating-point number, etc. Some combinations of `metric_kind` and `value_type` might not be supported.
             */
            valueType?: pulumi.Input<string>;
        }
        /**
         * Additional annotations that can be used to guide the usage of a metric.
         */
        interface MetricDescriptorMetadata {
            /**
             * The delay of data points caused by ingestion. Data points older than this age are guaranteed to be ingested and available to be read, excluding data loss due to errors.
             */
            ingestDelay?: pulumi.Input<string>;
            /**
             * The sampling period of metric data points. For metrics which are written periodically, consecutive data points are stored at this time interval, excluding data loss due to errors. Metrics with a higher granularity have a smaller sampling period.
             */
            samplePeriod?: pulumi.Input<string>;
        }
        /**
         * Bind API methods to metrics. Binding a method to a metric causes that metric's configured quota behaviors to apply to the method call.
         */
        interface MetricRule {
            /**
             * Metrics to update when the selected methods are called, and the associated cost applied to each metric. The key of the map is the metric name, and the values are the amount increased for the metric against which the quota limits are defined. The value must not be negative.
             */
            metricCosts?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * Selects the methods to which this rule applies. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * Declares an API Interface to be included in this interface. The including interface must redeclare all the methods from the included interface, but documentation and options are inherited as follows: - If after comment and whitespace stripping, the documentation string of the redeclared method is empty, it will be inherited from the original method. - Each annotation belonging to the service config (http, visibility) which is not set in the redeclared method will be inherited. - If an http annotation is inherited, the path pattern will be modified as follows. Any version prefix will be replaced by the version of the including interface plus the root path if specified. Example of a simple mixin: package google.acl.v1; service AccessControl { // Get the underlying ACL object. rpc GetAcl(GetAclRequest) returns (Acl) { option (google.api.http).get = "/v1/{resource=**}:getAcl"; } } package google.storage.v2; service Storage { // rpc GetAcl(GetAclRequest) returns (Acl); // Get a data record. rpc GetData(GetDataRequest) returns (Data) { option (google.api.http).get = "/v2/{resource=**}"; } } Example of a mixin configuration: apis: - name: google.storage.v2.Storage mixins: - name: google.acl.v1.AccessControl The mixin construct implies that all methods in `AccessControl` are also declared with same name and request/response types in `Storage`. A documentation generator or annotation processor will see the effective `Storage.GetAcl` method after inheriting documentation and annotations as follows: service Storage { // Get the underlying ACL object. rpc GetAcl(GetAclRequest) returns (Acl) { option (google.api.http).get = "/v2/{resource=**}:getAcl"; } ... } Note how the version in the path pattern changed from `v1` to `v2`. If the `root` field in the mixin is specified, it should be a relative path under which inherited HTTP paths are placed. Example: apis: - name: google.storage.v2.Storage mixins: - name: google.acl.v1.AccessControl root: acls This implies the following inherited HTTP annotation: service Storage { // Get the underlying ACL object. rpc GetAcl(GetAclRequest) returns (Acl) { option (google.api.http).get = "/v2/acls/{resource=**}:getAcl"; } ... }
         */
        interface Mixin {
            /**
             * The fully qualified name of the interface which is included.
             */
            name?: pulumi.Input<string>;
            /**
             * If non-empty specifies a path under which inherited HTTP paths are rooted.
             */
            root?: pulumi.Input<string>;
        }
        /**
         * An object that describes the schema of a MonitoredResource object using a type name and a set of labels. For example, the monitored resource descriptor for Google Compute Engine VM instances has a type of `"gce_instance"` and specifies the use of the labels `"instance_id"` and `"zone"` to identify particular VM instances. Different APIs can support different monitored resource types. APIs generally provide a `list` method that returns the monitored resource descriptors used by the API.
         */
        interface MonitoredResourceDescriptor {
            /**
             * Optional. A detailed description of the monitored resource type that might be used in documentation.
             */
            description?: pulumi.Input<string>;
            /**
             * Optional. A concise name for the monitored resource type that might be displayed in user interfaces. It should be a Title Cased Noun Phrase, without any article or other determiners. For example, `"Google Cloud SQL Database"`.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Required. A set of labels used to describe instances of this monitored resource type. For example, an individual Google Cloud SQL database is identified by values for the labels `"database_id"` and `"zone"`.
             */
            labels?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.LabelDescriptor>[]>;
            /**
             * Optional. The launch stage of the monitored resource definition.
             */
            launchStage?: pulumi.Input<string>;
            /**
             * Optional. The resource name of the monitored resource descriptor: `"projects/{project_id}/monitoredResourceDescriptors/{type}"` where {type} is the value of the `type` field in this object and {project_id} is a project ID that provides API-specific context for accessing the type. APIs that do not use project information can use the resource name format `"monitoredResourceDescriptors/{type}"`.
             */
            name?: pulumi.Input<string>;
            /**
             * Required. The monitored resource type. For example, the type `"cloudsql_database"` represents databases in Google Cloud SQL.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Monitoring configuration of the service. The example below shows how to configure monitored resources and metrics for monitoring. In the example, a monitored resource and two metrics are defined. The `library.googleapis.com/book/returned_count` metric is sent to both producer and consumer projects, whereas the `library.googleapis.com/book/num_overdue` metric is only sent to the consumer project. monitored_resources: - type: library.googleapis.com/Branch display_name: "Library Branch" description: "A branch of a library." launch_stage: GA labels: - key: resource_container description: "The Cloud container (ie. project id) for the Branch." - key: location description: "The location of the library branch." - key: branch_id description: "The id of the branch." metrics: - name: library.googleapis.com/book/returned_count display_name: "Books Returned" description: "The count of books that have been returned." launch_stage: GA metric_kind: DELTA value_type: INT64 unit: "1" labels: - key: customer_id description: "The id of the customer." - name: library.googleapis.com/book/num_overdue display_name: "Books Overdue" description: "The current number of overdue books." launch_stage: GA metric_kind: GAUGE value_type: INT64 unit: "1" labels: - key: customer_id description: "The id of the customer." monitoring: producer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count consumer_destinations: - monitored_resource: library.googleapis.com/Branch metrics: - library.googleapis.com/book/returned_count - library.googleapis.com/book/num_overdue
         */
        interface Monitoring {
            /**
             * Monitoring configurations for sending metrics to the consumer project. There can be multiple consumer destinations. A monitored resource type may appear in multiple monitoring destinations if different aggregations are needed for different sets of metrics associated with that monitored resource type. A monitored resource and metric pair may only be used once in the Monitoring configuration.
             */
            consumerDestinations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.MonitoringDestination>[]>;
            /**
             * Monitoring configurations for sending metrics to the producer project. There can be multiple producer destinations. A monitored resource type may appear in multiple monitoring destinations if different aggregations are needed for different sets of metrics associated with that monitored resource type. A monitored resource and metric pair may only be used once in the Monitoring configuration.
             */
            producerDestinations?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.MonitoringDestination>[]>;
        }
        /**
         * Configuration of a specific monitoring destination (the producer project or the consumer project).
         */
        interface MonitoringDestination {
            /**
             * Types of the metrics to report to this monitoring destination. Each type must be defined in Service.metrics section.
             */
            metrics?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The monitored resource type. The type must be defined in Service.monitored_resources section.
             */
            monitoredResource?: pulumi.Input<string>;
        }
        /**
         * OAuth scopes are a way to define data and permissions on data. For example, there are scopes defined for "Read-only access to Google Calendar" and "Access to Cloud Platform". Users can consent to a scope for an application, giving it permission to access that data on their behalf. OAuth scope specifications should be fairly coarse grained; a user will need to see and understand the text description of what your scope means. In most cases: use one or at most two OAuth scopes for an entire family of products. If your product has multiple APIs, you should probably be sharing the OAuth scope across all of those APIs. When you need finer grained OAuth consent screens: talk with your product management about how developers will use them in practice. Please note that even though each of the canonical scopes is enough for a request to be accepted and passed to the backend, a request can still fail due to the backend requiring additional scopes or permissions.
         */
        interface OAuthRequirements {
            /**
             * The list of publicly documented OAuth scopes that are allowed access. An OAuth token containing any of these scopes will be accepted. Example: canonical_scopes: https://www.googleapis.com/auth/calendar, https://www.googleapis.com/auth/calendar.read
             */
            canonicalScopes?: pulumi.Input<string>;
        }
        /**
         * A protocol buffer option, which can be attached to a message, field, enumeration, etc.
         */
        interface Option {
            /**
             * The option's name. For protobuf built-in options (options defined in descriptor.proto), this is the short name. For example, `"map_entry"`. For custom options, it should be the fully-qualified name. For example, `"google.api.http"`.
             */
            name?: pulumi.Input<string>;
            /**
             * The option's value packed in an Any message. If the value is a primitive, the corresponding wrapper type defined in google/protobuf/wrappers.proto should be used. If the value is an enum, it should be stored as an int32 value using the google.protobuf.Int32Value type.
             */
            value?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Represents a documentation page. A page can contain subpages to represent nested documentation set structure.
         */
        interface Page {
            /**
             * The Markdown content of the page. You can use (== include {path} ==) to include content from a Markdown file.
             */
            content?: pulumi.Input<string>;
            /**
             * The name of the page. It will be used as an identity of the page to generate URI of the page, text of the link to this page in navigation, etc. The full page name (start from the root page name to this page concatenated with `.`) can be used as reference to the page in your documentation. For example: pages: - name: Tutorial content: (== include tutorial.md ==) subpages: - name: Java content: (== include tutorial_java.md ==) You can reference `Java` page using Markdown reference link syntax: `Java`.
             */
            name?: pulumi.Input<string>;
            /**
             * Subpages of this page. The order of subpages specified here will be honored in the generated docset.
             */
            subpages?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Page>[]>;
        }
        /**
         * Quota configuration helps to achieve fairness and budgeting in service usage. The metric based quota configuration works this way: - The service configuration defines a set of metrics. - For API calls, the quota.metric_rules maps methods to metrics with corresponding costs. - The quota.limits defines limits on the metrics, which will be used for quota checks at runtime. An example quota configuration in yaml format: quota: limits: - name: apiWriteQpsPerProject metric: library.googleapis.com/write_calls unit: "1/min/{project}" # rate limit for consumer projects values: STANDARD: 10000 # The metric rules bind all methods to the read_calls metric, # except for the UpdateBook and DeleteBook methods. These two methods # are mapped to the write_calls metric, with the UpdateBook method # consuming at twice rate as the DeleteBook method. metric_rules: - selector: "*" metric_costs: library.googleapis.com/read_calls: 1 - selector: google.example.library.v1.LibraryService.UpdateBook metric_costs: library.googleapis.com/write_calls: 2 - selector: google.example.library.v1.LibraryService.DeleteBook metric_costs: library.googleapis.com/write_calls: 1 Corresponding Metric definition: metrics: - name: library.googleapis.com/read_calls display_name: Read requests metric_kind: DELTA value_type: INT64 - name: library.googleapis.com/write_calls display_name: Write requests metric_kind: DELTA value_type: INT64
         */
        interface Quota {
            /**
             * List of `QuotaLimit` definitions for the service.
             */
            limits?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.QuotaLimit>[]>;
            /**
             * List of `MetricRule` definitions, each one mapping a selected method to one or more metrics.
             */
            metricRules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.MetricRule>[]>;
        }
        /**
         * `QuotaLimit` defines a specific limit that applies over a specified duration for a limit type. There can be at most one limit for a duration and limit type combination defined within a `QuotaGroup`.
         */
        interface QuotaLimit {
            /**
             * Default number of tokens that can be consumed during the specified duration. This is the number of tokens assigned when a client application developer activates the service for his/her project. Specifying a value of 0 will block all requests. This can be used if you are provisioning quota to selected consumers and blocking others. Similarly, a value of -1 will indicate an unlimited quota. No other negative values are allowed. Used by group-based quotas only.
             */
            defaultLimit?: pulumi.Input<string>;
            /**
             * Optional. User-visible, extended description for this quota limit. Should be used only when more context is needed to understand this limit than provided by the limit's display name (see: `display_name`).
             */
            description?: pulumi.Input<string>;
            /**
             * User-visible display name for this limit. Optional. If not set, the UI will provide a default display name based on the quota configuration. This field can be used to override the default display name generated from the configuration.
             */
            displayName?: pulumi.Input<string>;
            /**
             * Duration of this limit in textual notation. Must be "100s" or "1d". Used by group-based quotas only.
             */
            duration?: pulumi.Input<string>;
            /**
             * Free tier value displayed in the Developers Console for this limit. The free tier is the number of tokens that will be subtracted from the billed amount when billing is enabled. This field can only be set on a limit with duration "1d", in a billable group; it is invalid on any other limit. If this field is not set, it defaults to 0, indicating that there is no free tier for this service. Used by group-based quotas only.
             */
            freeTier?: pulumi.Input<string>;
            /**
             * Maximum number of tokens that can be consumed during the specified duration. Client application developers can override the default limit up to this maximum. If specified, this value cannot be set to a value less than the default limit. If not specified, it is set to the default limit. To allow clients to apply overrides with no upper bound, set this to -1, indicating unlimited maximum quota. Used by group-based quotas only.
             */
            maxLimit?: pulumi.Input<string>;
            /**
             * The name of the metric this quota limit applies to. The quota limits with the same metric will be checked together during runtime. The metric must be defined within the service config.
             */
            metric?: pulumi.Input<string>;
            /**
             * Name of the quota limit. The name must be provided, and it must be unique within the service. The name can only include alphanumeric characters as well as '-'. The maximum length of the limit name is 64 characters.
             */
            name?: pulumi.Input<string>;
            /**
             * Specify the unit of the quota limit. It uses the same syntax as Metric.unit. The supported unit kinds are determined by the quota backend system. Here are some examples: * "1/min/{project}" for quota per minute per project. Note: the order of unit components is insignificant. The "1" at the beginning is required to follow the metric unit syntax.
             */
            unit?: pulumi.Input<string>;
            /**
             * Tiered limit values. You must specify this as a key:value pair, with an integer value that is the maximum number of requests allowed for the specified unit. Currently only STANDARD is supported.
             */
            values?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * `SourceContext` represents information about the source of a protobuf element, like the file in which it is defined.
         */
        interface SourceContext {
            /**
             * The path-qualified name of the .proto file that contained the associated protobuf element. For example: `"google/protobuf/source_context.proto"`.
             */
            fileName?: pulumi.Input<string>;
        }
        /**
         * Source information used to create a Service Config
         */
        interface SourceInfo {
            /**
             * All files used during config generation.
             */
            sourceFiles?: pulumi.Input<pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>[]>;
        }
        /**
         * Define a parameter's name and location. The parameter may be passed as either an HTTP header or a URL query parameter, and if both are passed the behavior is implementation-dependent.
         */
        interface SystemParameter {
            /**
             * Define the HTTP header name to use for the parameter. It is case insensitive.
             */
            httpHeader?: pulumi.Input<string>;
            /**
             * Define the name of the parameter, such as "api_key" . It is case sensitive.
             */
            name?: pulumi.Input<string>;
            /**
             * Define the URL query parameter name to use for the parameter. It is case sensitive.
             */
            urlQueryParameter?: pulumi.Input<string>;
        }
        /**
         * Define a system parameter rule mapping system parameter definitions to methods.
         */
        interface SystemParameterRule {
            /**
             * Define parameters. Multiple names may be defined for a parameter. For a given method call, only one of them should be used. If multiple names are used the behavior is implementation-dependent. If none of the specified names are present the behavior is parameter-dependent.
             */
            parameters?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.SystemParameter>[]>;
            /**
             * Selects the methods to which this rule applies. Use '*' to indicate all methods in all APIs. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
        }
        /**
         * ### System parameter configuration A system parameter is a special kind of parameter defined by the API system, not by an individual API. It is typically mapped to an HTTP header and/or a URL query parameter. This configuration specifies which methods change the names of the system parameters.
         */
        interface SystemParameters {
            /**
             * Define system parameters. The parameters defined here will override the default parameters implemented by the system. If this field is missing from the service config, default system parameters will be used. Default system parameters and names is implementation-dependent. Example: define api key for all methods system_parameters rules: - selector: "*" parameters: - name: api_key url_query_parameter: api_key Example: define 2 api key names for a specific method. system_parameters rules: - selector: "/ListShelves" parameters: - name: api_key http_header: Api-Key1 - name: api_key http_header: Api-Key2 **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.SystemParameterRule>[]>;
        }
        /**
         * Strategy that specifies how clients of Google Service Controller want to send traffic to use different config versions. This is generally used by API proxy to split traffic based on your configured percentage for each config version. One example of how to gradually rollout a new service configuration using this strategy: Day 1 Rollout { id: "example.googleapis.com/rollout_20160206" traffic_percent_strategy { percentages: { "example.googleapis.com/20160201": 70.00 "example.googleapis.com/20160206": 30.00 } } } Day 2 Rollout { id: "example.googleapis.com/rollout_20160207" traffic_percent_strategy: { percentages: { "example.googleapis.com/20160206": 100.00 } } }
         */
        interface TrafficPercentStrategy {
            /**
             * Maps service configuration IDs to their corresponding traffic percentage. Key is the service configuration ID, Value is the traffic percentage which must be greater than 0.0 and the sum must equal to 100.0.
             */
            percentages?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * A protocol buffer message type.
         */
        interface Type {
            /**
             * The list of fields.
             */
            fields?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Field>[]>;
            /**
             * The fully qualified message name.
             */
            name?: pulumi.Input<string>;
            /**
             * The list of types appearing in `oneof` definitions in this type.
             */
            oneofs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The protocol buffer options.
             */
            options?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.Option>[]>;
            /**
             * The source context.
             */
            sourceContext?: pulumi.Input<inputs.servicemanagement.v1.SourceContext>;
            /**
             * The source syntax.
             */
            syntax?: pulumi.Input<string>;
        }
        /**
         * Configuration controlling usage of a service.
         */
        interface Usage {
            /**
             * The full resource name of a channel used for sending notifications to the service producer. Google Service Management currently only supports [Google Cloud Pub/Sub](https://cloud.google.com/pubsub) as a notification channel. To use Google Cloud Pub/Sub as the channel, this must be the name of a Cloud Pub/Sub topic that uses the Cloud Pub/Sub topic name format documented in https://cloud.google.com/pubsub/docs/overview.
             */
            producerNotificationChannel?: pulumi.Input<string>;
            /**
             * Requirements that must be satisfied before a consumer project can use the service. Each requirement is of the form /; for example 'serviceusage.googleapis.com/billing-enabled'. For Google APIs, a Terms of Service requirement must be included here. Google Cloud APIs must include "serviceusage.googleapis.com/tos/cloud". Other Google APIs should include "serviceusage.googleapis.com/tos/universal". Additional ToS can be included based on the business needs.
             */
            requirements?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A list of usage rules that apply to individual API methods. **NOTE:** All service configuration rules follow "last one wins" order.
             */
            rules?: pulumi.Input<pulumi.Input<inputs.servicemanagement.v1.UsageRule>[]>;
        }
        /**
         * Usage configuration rules for the service. NOTE: Under development. Use this rule to configure unregistered calls for the service. Unregistered calls are calls that do not contain consumer project identity. (Example: calls that do not contain an API key). By default, API methods do not allow unregistered calls, and each method call must be identified by a consumer project identity. Use this rule to allow/disallow unregistered calls. Example of an API that wants to allow unregistered calls for entire service. usage: rules: - selector: "*" allow_unregistered_calls: true Example of a method that wants to allow unregistered calls. usage: rules: - selector: "google.example.library.v1.LibraryService.CreateBook" allow_unregistered_calls: true
         */
        interface UsageRule {
            /**
             * If true, the selected method allows unregistered calls, e.g. calls that don't identify any user or application.
             */
            allowUnregisteredCalls?: pulumi.Input<boolean>;
            /**
             * Selects the methods to which this rule applies. Use '*' to indicate all methods in all APIs. Refer to selector for syntax details.
             */
            selector?: pulumi.Input<string>;
            /**
             * If true, the selected method should skip service control and the control plane features, such as quota and billing, will not be available. This flag is used by Google Cloud Endpoints to bypass checks for internal methods, such as service health check methods.
             */
            skipServiceControl?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace sourcerepo {
    namespace v1 {
        /**
         * Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         */
        interface AuditConfig {
            /**
             * The configuration for logging of each type of permission.
             */
            auditLogConfigs?: pulumi.Input<pulumi.Input<inputs.sourcerepo.v1.AuditLogConfig>[]>;
            /**
             * Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
             */
            service?: pulumi.Input<string>;
        }
        /**
         * Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
         */
        interface AuditLogConfig {
            /**
             * Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
             */
            exemptedMembers?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The log type that this config enables.
             */
            logType?: pulumi.Input<string>;
        }
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.sourcerepo.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
        /**
         * Configuration to automatically mirror a repository from another hosting service, for example GitHub or Bitbucket.
         */
        interface MirrorConfig {
            /**
             * ID of the SSH deploy key at the other hosting service. Removing this key from the other service would deauthorize Google Cloud Source Repositories from mirroring.
             */
            deployKeyId?: pulumi.Input<string>;
            /**
             * URL of the main repository at the other hosting service.
             */
            url?: pulumi.Input<string>;
            /**
             * ID of the webhook listening to updates to trigger mirroring. Removing this webhook from the other hosting service will stop Google Cloud Source Repositories from receiving notifications, and thereby disabling mirroring.
             */
            webhookId?: pulumi.Input<string>;
        }
    }
}
export declare namespace spanner {
    namespace v1 {
        /**
         * Associates `members` with a `role`.
         */
        interface Binding {
            /**
             * The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
             */
            condition?: pulumi.Input<inputs.spanner.v1.Expr>;
            /**
             * Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
             */
            members?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
             */
            role?: pulumi.Input<string>;
        }
        /**
         * Encryption configuration for a Cloud Spanner database.
         */
        interface EncryptionConfig {
            /**
             * The Cloud KMS key to be used for encrypting and decrypting the database. Values are of the form `projects//locations//keyRings//cryptoKeys/`.
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
         */
        interface Expr {
            /**
             * Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             */
            description?: pulumi.Input<string>;
            /**
             * Textual representation of an expression in Common Expression Language syntax.
             */
            expression?: pulumi.Input<string>;
            /**
             * Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             */
            location?: pulumi.Input<string>;
            /**
             * Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
             */
            title?: pulumi.Input<string>;
        }
    }
}
export declare namespace sqladmin {
    namespace v1beta4 {
        /**
         * An entry for an Access Control list.
         */
        interface AclEntry {
            /**
             * The time when this access control entry expires in RFC 3339 format, for example *2012-11-15T16:19:00.094Z*.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * This is always *sql#aclEntry*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Optional. A label to identify this entry.
             */
            name?: pulumi.Input<string>;
            /**
             * The allowlisted value for the access control list.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Database instance backup configuration.
         */
        interface BackupConfiguration {
            /**
             * Backup retention settings.
             */
            backupRetentionSettings?: pulumi.Input<inputs.sqladmin.v1beta4.BackupRetentionSettings>;
            /**
             * (MySQL only) Whether binary log is enabled. If backup configuration is disabled, binarylog must be disabled as well.
             */
            binaryLogEnabled?: pulumi.Input<boolean>;
            /**
             * Whether this configuration is enabled.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * This is always *sql#backupConfiguration*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Location of the backup
             */
            location?: pulumi.Input<string>;
            /**
             * Reserved for future use.
             */
            pointInTimeRecoveryEnabled?: pulumi.Input<boolean>;
            /**
             * Reserved for future use.
             */
            replicationLogArchivingEnabled?: pulumi.Input<boolean>;
            /**
             * Start time for the daily backup configuration in UTC timezone in the 24 hour format - *HH:MM*.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The number of days of transaction logs we retain for point in time restore, from 1-7.
             */
            transactionLogRetentionDays?: pulumi.Input<number>;
        }
        /**
         * We currently only support backup retention by specifying the number of backups we will retain.
         */
        interface BackupRetentionSettings {
            /**
             * Depending on the value of retention_unit, this is used to determine if a backup needs to be deleted. If retention_unit is 'COUNT', we will retain this many backups.
             */
            retainedBackups?: pulumi.Input<number>;
            /**
             * The unit that 'retained_backups' represents.
             */
            retentionUnit?: pulumi.Input<string>;
        }
        /**
         * Database flags for Cloud SQL instances.
         */
        interface DatabaseFlags {
            /**
             * The name of the flag. These flags are passed at instance startup, so include both server options and system variables for MySQL. Flags are specified with underscores, not hyphens. For more information, see Configuring Database Flags in the Cloud SQL documentation.
             */
            name?: pulumi.Input<string>;
            /**
             * The value of the flag. Booleans are set to *on* for true and *off* for false. This field must be omitted if the flag doesn't take a value.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * Deny Maintenance Periods. This specifies a date range during when all CSA rollout will be denied.
         */
        interface DenyMaintenancePeriod {
            /**
             * "deny maintenance period" end date. If the year of the end date is empty, the year of the start date also must be empty. In this case, it means the deny maintenance period recurs every year. The date is in format yyyy-mm-dd i.e., 2020-11-01, or mm-dd, i.e., 11-01
             */
            endDate?: pulumi.Input<string>;
            /**
             * "deny maintenance period" start date. If the year of the start date is empty, the year of the end date also must be empty. In this case, it means the deny maintenance period recurs every year. The date is in format yyyy-mm-dd i.e., 2020-11-01, or mm-dd, i.e., 11-01
             */
            startDate?: pulumi.Input<string>;
            /**
             * Time in UTC when the "deny maintenance period" starts on start_date and ends on end_date. The time is in format: HH:mm:SS, i.e., 00:00:00
             */
            time?: pulumi.Input<string>;
        }
        /**
         * Disk encryption configuration for an instance.
         */
        interface DiskEncryptionConfiguration {
            /**
             * This is always *sql#diskEncryptionConfiguration*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Resource name of KMS key for disk encryption
             */
            kmsKeyName?: pulumi.Input<string>;
        }
        /**
         * Disk encryption status for an instance.
         */
        interface DiskEncryptionStatus {
            /**
             * This is always *sql#diskEncryptionStatus*.
             */
            kind?: pulumi.Input<string>;
            /**
             * KMS key version used to encrypt the Cloud SQL instance resource
             */
            kmsKeyVersionName?: pulumi.Input<string>;
        }
        /**
         * Insights configuration. This specifies when Cloud SQL Insights feature is enabled and optional configuration.
         */
        interface InsightsConfig {
            /**
             * Whether Query Insights feature is enabled.
             */
            queryInsightsEnabled?: pulumi.Input<boolean>;
            /**
             * Maximum query length stored in bytes. Default value: 1024 bytes. Range: 256-4500 bytes. Query length more than this field value will be truncated to this value. When unset, query length will be the default value. Changing query length will restart the database.
             */
            queryStringLength?: pulumi.Input<number>;
            /**
             * Whether Query Insights will record application tags from query when enabled.
             */
            recordApplicationTags?: pulumi.Input<boolean>;
            /**
             * Whether Query Insights will record client address when enabled.
             */
            recordClientAddress?: pulumi.Input<boolean>;
        }
        /**
         * IP Management configuration.
         */
        interface IpConfiguration {
            /**
             * The list of external networks that are allowed to connect to the instance using the IP. In 'CIDR' notation, also known as 'slash' notation (for example: *192.168.100.0/24*).
             */
            authorizedNetworks?: pulumi.Input<pulumi.Input<inputs.sqladmin.v1beta4.AclEntry>[]>;
            /**
             * Whether the instance is assigned a public IP address or not.
             */
            ipv4Enabled?: pulumi.Input<boolean>;
            /**
             * The resource link for the VPC network from which the Cloud SQL instance is accessible for private IP. For example, *&#47;projects/myProject/global/networks/default*. This setting can be updated, but it cannot be removed after it is set.
             */
            privateNetwork?: pulumi.Input<string>;
            /**
             * Whether SSL connections over IP are enforced or not.
             */
            requireSsl?: pulumi.Input<boolean>;
        }
        /**
         * Database instance IP Mapping.
         */
        interface IpMapping {
            /**
             * The IP address assigned.
             */
            ipAddress?: pulumi.Input<string>;
            /**
             * The due time for this IP to be retired in RFC 3339 format, for example *2012-11-15T16:19:00.094Z*. This field is only available when the IP is scheduled to be retired.
             */
            timeToRetire?: pulumi.Input<string>;
            /**
             * The type of this IP address. A *PRIMARY* address is a public address that can accept incoming connections. A *PRIVATE* address is a private address that can accept incoming connections. An *OUTGOING* address is the source address of connections originating from the instance, if supported.
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Preferred location. This specifies where a Cloud SQL instance is located, either in a specific Compute Engine zone, or co-located with an App Engine application. Note that if the preferred location is not available, the instance will be located as close as possible within the region. Only one location may be specified.
         */
        interface LocationPreference {
            /**
             * The App Engine application to follow, it must be in the same region as the Cloud SQL instance.
             */
            followGaeApplication?: pulumi.Input<string>;
            /**
             * This is always *sql#locationPreference*.
             */
            kind?: pulumi.Input<string>;
            /**
             * The preferred Compute Engine zone for the secondary/failover (for example: us-central1-a, us-central1-b, etc.). Reserved for future use.
             */
            secondaryZone?: pulumi.Input<string>;
            /**
             * The preferred Compute Engine zone (for example: us-central1-a, us-central1-b, etc.).
             */
            zone?: pulumi.Input<string>;
        }
        /**
         * Maintenance window. This specifies when a Cloud SQL instance is restarted for system maintenance purposes.
         */
        interface MaintenanceWindow {
            /**
             * day of week (1-7), starting on Monday.
             */
            day?: pulumi.Input<number>;
            /**
             * hour of day - 0 to 23.
             */
            hour?: pulumi.Input<number>;
            /**
             * This is always *sql#maintenanceWindow*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Maintenance timing setting: *canary* (Earlier) or *stable* (Later). Learn more.
             */
            updateTrack?: pulumi.Input<string>;
        }
        /**
         * Read-replica configuration specific to MySQL databases.
         */
        interface MySqlReplicaConfiguration {
            /**
             * PEM representation of the trusted CA's x509 certificate.
             */
            caCertificate?: pulumi.Input<string>;
            /**
             * PEM representation of the replica's x509 certificate.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * PEM representation of the replica's private key. The corresponsing public key is encoded in the client's certificate.
             */
            clientKey?: pulumi.Input<string>;
            /**
             * Seconds to wait between connect retries. MySQL's default is 60 seconds.
             */
            connectRetryInterval?: pulumi.Input<number>;
            /**
             * Path to a SQL dump file in Google Cloud Storage from which the replica instance is to be created. The URI is in the form gs://bucketName/fileName. Compressed gzip files (.gz) are also supported. Dumps have the binlog co-ordinates from which replication begins. This can be accomplished by setting --master-data to 1 when using mysqldump.
             */
            dumpFilePath?: pulumi.Input<string>;
            /**
             * This is always *sql#mysqlReplicaConfiguration*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Interval in milliseconds between replication heartbeats.
             */
            masterHeartbeatPeriod?: pulumi.Input<string>;
            /**
             * The password for the replication connection.
             */
            password?: pulumi.Input<string>;
            /**
             * A list of permissible ciphers to use for SSL encryption.
             */
            sslCipher?: pulumi.Input<string>;
            /**
             * The username for the replication connection.
             */
            username?: pulumi.Input<string>;
            /**
             * Whether or not to check the primary instance's Common Name value in the certificate that it sends during the SSL handshake.
             */
            verifyServerCertificate?: pulumi.Input<boolean>;
        }
        /**
         * On-premises instance configuration.
         */
        interface OnPremisesConfiguration {
            /**
             * PEM representation of the trusted CA's x509 certificate.
             */
            caCertificate?: pulumi.Input<string>;
            /**
             * PEM representation of the replica's x509 certificate.
             */
            clientCertificate?: pulumi.Input<string>;
            /**
             * PEM representation of the replica's private key. The corresponsing public key is encoded in the client's certificate.
             */
            clientKey?: pulumi.Input<string>;
            /**
             * The dump file to create the Cloud SQL replica.
             */
            dumpFilePath?: pulumi.Input<string>;
            /**
             * The host and port of the on-premises instance in host:port format
             */
            hostPort?: pulumi.Input<string>;
            /**
             * This is always *sql#onPremisesConfiguration*.
             */
            kind?: pulumi.Input<string>;
            /**
             * The password for connecting to on-premises instance.
             */
            password?: pulumi.Input<string>;
            /**
             * The username for connecting to on-premises instance.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Database instance operation error.
         */
        interface OperationError {
            /**
             * Identifies the specific error that occurred.
             */
            code?: pulumi.Input<string>;
            /**
             * This is always *sql#operationError*.
             */
            kind?: pulumi.Input<string>;
            /**
             * Additional information about the error encountered.
             */
            message?: pulumi.Input<string>;
        }
        /**
         * Read-replica configuration for connecting to the primary instance.
         */
        interface ReplicaConfiguration {
            /**
             * Specifies if the replica is the failover target. If the field is set to *true* the replica will be designated as a failover replica. In case the primary instance fails, the replica instance will be promoted as the new primary instance. Only one replica can be specified as failover target, and the replica has to be in different zone with the primary instance.
             */
            failoverTarget?: pulumi.Input<boolean>;
            /**
             * This is always *sql#replicaConfiguration*.
             */
            kind?: pulumi.Input<string>;
            /**
             * MySQL specific configuration when replicating from a MySQL on-premises primary instance. Replication configuration information such as the username, password, certificates, and keys are not stored in the instance metadata. The configuration information is used only to set up the replication connection and is stored by MySQL in a file named *master.info* in the data directory.
             */
            mysqlReplicaConfiguration?: pulumi.Input<inputs.sqladmin.v1beta4.MySqlReplicaConfiguration>;
        }
        /**
         * Database instance settings.
         */
        interface Settings {
            /**
             * The activation policy specifies when the instance is activated; it is applicable only when the instance state is RUNNABLE. Valid values: *ALWAYS*: The instance is on, and remains so even in the absence of connection requests. *NEVER*: The instance is off; it is not activated, even if a connection request arrives.
             */
            activationPolicy?: pulumi.Input<string>;
            /**
             * Active Directory configuration, relevant only for Cloud SQL for SQL Server.
             */
            activeDirectoryConfig?: pulumi.Input<inputs.sqladmin.v1beta4.SqlActiveDirectoryConfig>;
            /**
             * The App Engine app IDs that can access this instance. (Deprecated) Applied to First Generation instances only.
             */
            authorizedGaeApplications?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Availability type. Potential values: *ZONAL*: The instance serves data from only one zone. Outages in that zone affect data accessibility. *REGIONAL*: The instance can serve data from more than one zone in a region (it is highly available). For more information, see Overview of the High Availability Configuration.
             */
            availabilityType?: pulumi.Input<string>;
            /**
             * The daily backup configuration for the instance.
             */
            backupConfiguration?: pulumi.Input<inputs.sqladmin.v1beta4.BackupConfiguration>;
            /**
             * The name of server Instance collation.
             */
            collation?: pulumi.Input<string>;
            /**
             * Configuration specific to read replica instances. Indicates whether database flags for crash-safe replication are enabled. This property was only applicable to First Generation instances.
             */
            crashSafeReplicationEnabled?: pulumi.Input<boolean>;
            /**
             * The size of data disk, in GB. The data disk size minimum is 10GB.
             */
            dataDiskSizeGb?: pulumi.Input<string>;
            /**
             * The type of data disk: PD_SSD (default) or PD_HDD. Not used for First Generation instances.
             */
            dataDiskType?: pulumi.Input<string>;
            /**
             * The database flags passed to the instance at startup.
             */
            databaseFlags?: pulumi.Input<pulumi.Input<inputs.sqladmin.v1beta4.DatabaseFlags>[]>;
            /**
             * Configuration specific to read replica instances. Indicates whether replication is enabled or not.
             */
            databaseReplicationEnabled?: pulumi.Input<boolean>;
            /**
             * Deny maintenance periods
             */
            denyMaintenancePeriods?: pulumi.Input<pulumi.Input<inputs.sqladmin.v1beta4.DenyMaintenancePeriod>[]>;
            /**
             * Insights configuration, for now relevant only for Postgres.
             */
            insightsConfig?: pulumi.Input<inputs.sqladmin.v1beta4.InsightsConfig>;
            /**
             * The settings for IP Management. This allows to enable or disable the instance IP and manage which external networks can connect to the instance. The IPv4 address cannot be disabled for Second Generation instances.
             */
            ipConfiguration?: pulumi.Input<inputs.sqladmin.v1beta4.IpConfiguration>;
            /**
             * This is always *sql#settings*.
             */
            kind?: pulumi.Input<string>;
            /**
             * The location preference settings. This allows the instance to be located as near as possible to either an App Engine app or Compute Engine zone for better performance. App Engine co-location was only applicable to First Generation instances.
             */
            locationPreference?: pulumi.Input<inputs.sqladmin.v1beta4.LocationPreference>;
            /**
             * The maintenance window for this instance. This specifies when the instance can be restarted for maintenance purposes.
             */
            maintenanceWindow?: pulumi.Input<inputs.sqladmin.v1beta4.MaintenanceWindow>;
            /**
             * The pricing plan for this instance. This can be either *PER_USE* or *PACKAGE*. Only *PER_USE* is supported for Second Generation instances.
             */
            pricingPlan?: pulumi.Input<string>;
            /**
             * The type of replication this instance uses. This can be either *ASYNCHRONOUS* or *SYNCHRONOUS*. (Deprecated_ This property was only applicable to First Generation instances.
             */
            replicationType?: pulumi.Input<string>;
            /**
             * The version of instance settings. This is a required field for update method to make sure concurrent updates are handled properly. During update, use the most recent settingsVersion value for this instance and do not try to update this value.
             */
            settingsVersion?: pulumi.Input<string>;
            /**
             * Configuration to increase storage size automatically. The default value is true.
             */
            storageAutoResize?: pulumi.Input<boolean>;
            /**
             * The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit.
             */
            storageAutoResizeLimit?: pulumi.Input<string>;
            /**
             * The tier (or machine type) for this instance, for example *db-custom-1-3840* .
             */
            tier?: pulumi.Input<string>;
            /**
             * User-provided labels, represented as a dictionary where each label is a single key value pair.
             */
            userLabels?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
        }
        /**
         * Active Directory configuration, relevant only for Cloud SQL for SQL Server.
         */
        interface SqlActiveDirectoryConfig {
            /**
             * The name of the domain (e.g., mydomain.com).
             */
            domain?: pulumi.Input<string>;
            /**
             * This is always sql#activeDirectoryConfig.
             */
            kind?: pulumi.Input<string>;
        }
        /**
         * Any scheduled maintenancce for this instance.
         */
        interface SqlScheduledMaintenance {
            canDefer?: pulumi.Input<boolean>;
            /**
             * If the scheduled maintenance can be rescheduled.
             */
            canReschedule?: pulumi.Input<boolean>;
            /**
             * The start time of any upcoming scheduled maintenance for this instance.
             */
            startTime?: pulumi.Input<string>;
        }
        /**
         * Represents a Sql Server database on the Cloud SQL instance.
         */
        interface SqlServerDatabaseDetails {
            /**
             * The version of SQL Server with which the database is to be made compatible
             */
            compatibilityLevel?: pulumi.Input<number>;
            /**
             * The recovery model of a SQL Server database
             */
            recoveryModel?: pulumi.Input<string>;
        }
        /**
         * Represents a Sql Server user on the Cloud SQL instance.
         */
        interface SqlServerUserDetails {
            /**
             * If the user has been disabled
             */
            disabled?: pulumi.Input<boolean>;
            /**
             * The server roles for this user
             */
            serverRoles?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * SslCerts Resource
         */
        interface SslCert {
            /**
             * PEM representation.
             */
            cert?: pulumi.Input<string>;
            /**
             * Serial number, as extracted from the certificate.
             */
            certSerialNumber?: pulumi.Input<string>;
            /**
             * User supplied name. Constrained to [a-zA-Z.-_ ]+.
             */
            commonName?: pulumi.Input<string>;
            /**
             * The time when the certificate was created in RFC 3339 format, for example *2012-11-15T16:19:00.094Z*
             */
            createTime?: pulumi.Input<string>;
            /**
             * The time when the certificate expires in RFC 3339 format, for example *2012-11-15T16:19:00.094Z*.
             */
            expirationTime?: pulumi.Input<string>;
            /**
             * Name of the database instance.
             */
            instance?: pulumi.Input<string>;
            /**
             * This is always *sql#sslCert*.
             */
            kind?: pulumi.Input<string>;
            /**
             * The URI of this resource.
             */
            selfLink?: pulumi.Input<string>;
            /**
             * Sha1 Fingerprint.
             */
            sha1Fingerprint?: pulumi.Input<string>;
        }
    }
}
export declare namespace storage {
    namespace v1 {
        /**
         * An access-control entry.
         */
        interface BucketAccessControl {
            /**
             * The name of the bucket.
             */
            bucket?: pulumi.Input<string>;
            /**
             * The domain associated with the entity, if any.
             */
            domain?: pulumi.Input<string>;
            /**
             * The email address associated with the entity, if any.
             */
            email?: pulumi.Input<string>;
            /**
             * The entity holding the permission, in one of the following forms:
             * - user-userId
             * - user-email
             * - group-groupId
             * - group-email
             * - domain-domain
             * - project-team-projectId
             * - allUsers
             * - allAuthenticatedUsers Examples:
             * - The user liz@example.com would be user-liz@example.com.
             * - The group example@googlegroups.com would be group-example@googlegroups.com.
             * - To refer to all members of the Google Apps for Business domain example.com, the entity would be domain-example.com.
             */
            entity?: pulumi.Input<string>;
            /**
             * The ID for the entity, if any.
             */
            entityId?: pulumi.Input<string>;
            /**
             * HTTP 1.1 Entity tag for the access-control entry.
             */
            etag?: pulumi.Input<string>;
            /**
             * The ID of the access-control entry.
             */
            id?: pulumi.Input<string>;
            /**
             * The kind of item this is. For bucket access control entries, this is always storage#bucketAccessControl.
             */
            kind?: pulumi.Input<string>;
            /**
             * The project team associated with the entity, if any.
             */
            projectTeam?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The access permission for the entity.
             */
            role?: pulumi.Input<string>;
            /**
             * The link to this access-control entry.
             */
            selfLink?: pulumi.Input<string>;
        }
        /**
         * An access-control entry.
         */
        interface ObjectAccessControl {
            /**
             * The name of the bucket.
             */
            bucket?: pulumi.Input<string>;
            /**
             * The domain associated with the entity, if any.
             */
            domain?: pulumi.Input<string>;
            /**
             * The email address associated with the entity, if any.
             */
            email?: pulumi.Input<string>;
            /**
             * The entity holding the permission, in one of the following forms:
             * - user-userId
             * - user-email
             * - group-groupId
             * - group-email
             * - domain-domain
             * - project-team-projectId
             * - allUsers
             * - allAuthenticatedUsers Examples:
             * - The user liz@example.com would be user-liz@example.com.
             * - The group example@googlegroups.com would be group-example@googlegroups.com.
             * - To refer to all members of the Google Apps for Business domain example.com, the entity would be domain-example.com.
             */
            entity?: pulumi.Input<string>;
            /**
             * The ID for the entity, if any.
             */
            entityId?: pulumi.Input<string>;
            /**
             * HTTP 1.1 Entity tag for the access-control entry.
             */
            etag?: pulumi.Input<string>;
            /**
             * The content generation of the object, if applied to an object.
             */
            generation?: pulumi.Input<string>;
            /**
             * The ID of the access-control entry.
             */
            id?: pulumi.Input<string>;
            /**
             * The kind of item this is. For object access control entries, this is always storage#objectAccessControl.
             */
            kind?: pulumi.Input<string>;
            /**
             * The name of the object, if applied to an object.
             */
            object?: pulumi.Input<string>;
            /**
             * The project team associated with the entity, if any.
             */
            projectTeam?: pulumi.Input<{
                [key: string]: pulumi.Input<string>;
            }>;
            /**
             * The access permission for the entity.
             */
            role?: pulumi.Input<string>;
            /**
             * The link to this access-control entry.
             */
            selfLink?: pulumi.Input<string>;
        }
    }
}
export declare namespace storagetransfer {
    namespace v1 {
        /**
         * AWS access key (see [AWS Security Credentials](https://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html)). For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
         */
        interface AwsAccessKey {
            /**
             * Required. AWS access key ID.
             */
            accessKeyId?: pulumi.Input<string>;
            /**
             * Required. AWS secret access key. This field is not returned in RPC responses.
             */
            secretAccessKey?: pulumi.Input<string>;
        }
        /**
         * An AwsS3Data resource can be a data source, but not a data sink. In an AwsS3Data resource, an object's name is the S3 object's key name.
         */
        interface AwsS3Data {
            /**
             * Required. Input only. AWS access key used to sign the API requests to the AWS S3 bucket. Permissions on the bucket must be granted to the access ID of the AWS access key. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
             */
            awsAccessKey?: pulumi.Input<inputs.storagetransfer.v1.AwsAccessKey>;
            /**
             * Required. S3 Bucket name (see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/create-bucket-get-location-example.html)).
             */
            bucketName?: pulumi.Input<string>;
            /**
             * Root path to transfer objects. Must be an empty string or full path name that ends with a '/'. This field is treated as an object prefix. As such, it should generally not begin with a '/'.
             */
            path?: pulumi.Input<string>;
        }
        /**
         * An AzureBlobStorageData resource can be a data source, but not a data sink. An AzureBlobStorageData resource represents one Azure container. The storage account determines the [Azure endpoint](https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#storage-account-endpoints). In an AzureBlobStorageData resource, a blobs's name is the [Azure Blob Storage blob's key name](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names).
         */
        interface AzureBlobStorageData {
            /**
             * Required. Input only. Credentials used to authenticate API requests to Azure. For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
             */
            azureCredentials?: pulumi.Input<inputs.storagetransfer.v1.AzureCredentials>;
            /**
             * Required. The container to transfer from the Azure Storage account.
             */
            container?: pulumi.Input<string>;
            /**
             * Root path to transfer objects. Must be an empty string or full path name that ends with a '/'. This field is treated as an object prefix. As such, it should generally not begin with a '/'.
             */
            path?: pulumi.Input<string>;
            /**
             * Required. The name of the Azure Storage account.
             */
            storageAccount?: pulumi.Input<string>;
        }
        /**
         * Azure credentials For information on our data retention policy for user credentials, see [User credentials](/storage-transfer/docs/data-retention#user-credentials).
         */
        interface AzureCredentials {
            /**
             * Required. Azure shared access signature. (see [Grant limited access to Azure Storage resources using shared access signatures (SAS)](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)).
             */
            sasToken?: pulumi.Input<string>;
        }
        /**
         * Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.
         */
        interface Date {
            /**
             * Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
             */
            day?: pulumi.Input<number>;
            /**
             * Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
             */
            month?: pulumi.Input<number>;
            /**
             * Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
             */
            year?: pulumi.Input<number>;
        }
        /**
         * In a GcsData resource, an object's name is the Cloud Storage object's name and its "last modification time" refers to the object's `updated` property of Cloud Storage objects, which changes when the content or the metadata of the object is updated.
         */
        interface GcsData {
            /**
             * Required. Cloud Storage bucket name (see [Bucket Name Requirements](https://cloud.google.com/storage/docs/naming#requirements)).
             */
            bucketName?: pulumi.Input<string>;
            /**
             * Root path to transfer objects. Must be an empty string or full path name that ends with a '/'. This field is treated as an object prefix. As such, it should generally not begin with a '/'. (must meet Object Name Requirements](https://cloud.google.com/storage/docs/naming#objectnames)).
             */
            path?: pulumi.Input<string>;
        }
        /**
         * An HttpData resource specifies a list of objects on the web to be transferred over HTTP. The information of the objects to be transferred is contained in a file referenced by a URL. The first line in the file must be `"TsvHttpData-1.0"`, which specifies the format of the file. Subsequent lines specify the information of the list of objects, one object per list entry. Each entry has the following tab-delimited fields: * **HTTP URL** — The location of the object. * **Length** — The size of the object in bytes. * **MD5** — The base64-encoded MD5 hash of the object. For an example of a valid TSV file, see [Transferring data from URLs](https://cloud.google.com/storage-transfer/docs/create-url-list). When transferring data based on a URL list, keep the following in mind: * When an object located at `http(s)://hostname:port/` is transferred to a data sink, the name of the object at the data sink is `/`. * If the specified size of an object does not match the actual size of the object fetched, the object will not be transferred. * If the specified MD5 does not match the MD5 computed from the transferred bytes, the object transfer will fail. * Ensure that each URL you specify is publicly accessible. For example, in Cloud Storage you can [share an object publicly] (https://cloud.google.com/storage/docs/cloud-console#_sharingdata) and get a link to it. * Storage Transfer Service obeys `robots.txt` rules and requires the source HTTP server to support `Range` requests and to return a `Content-Length` header in each response. * ObjectConditions have no effect when filtering objects to transfer.
         */
        interface HttpData {
            /**
             * Required. The URL that points to the file that stores the object list entries. This file must allow public access. Currently, only URLs with HTTP and HTTPS schemes are supported.
             */
            listUrl?: pulumi.Input<string>;
        }
        /**
         * Specification to configure notifications published to Cloud Pub/Sub. Notifications will be published to the customer-provided topic using the following `PubsubMessage.attributes`: * `"eventType"`: one of the EventType values * `"payloadFormat"`: one of the PayloadFormat values * `"projectId"`: the project_id of the `TransferOperation` * `"transferJobName"`: the transfer_job_name of the `TransferOperation` * `"transferOperationName"`: the name of the `TransferOperation` The `PubsubMessage.data` will contain a TransferOperation resource formatted according to the specified `PayloadFormat`.
         */
        interface NotificationConfig {
            /**
             * Event types for which a notification is desired. If empty, send notifications for all event types.
             */
            eventTypes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The desired format of the notification message payloads.
             */
            payloadFormat?: pulumi.Input<string>;
            /**
             * Required. The `Topic.name` of the Cloud Pub/Sub topic to which to publish notifications. Must be of the format: `projects/{project}/topics/{topic}`. Not matching this format will result in an INVALID_ARGUMENT error.
             */
            pubsubTopic?: pulumi.Input<string>;
        }
        /**
         * Conditions that determine which objects will be transferred. Applies only to Cloud Data Sources such as S3, Azure, and Cloud Storage. The "last modification time" refers to the time of the last change to the object's content or metadata — specifically, this is the `updated` property of Cloud Storage objects, the `LastModified` field of S3 objects, and the `Last-Modified` header of Azure blobs.
         */
        interface ObjectConditions {
            /**
             * If you specify `exclude_prefixes`, Storage Transfer Service uses the items in the `exclude_prefixes` array to determine which objects to exclude from a transfer. Objects must not start with one of the matching `exclude_prefixes` for inclusion in a transfer. The following are requirements of `exclude_prefixes`: * Each exclude-prefix can contain any sequence of Unicode characters, to a max length of 1024 bytes when UTF8-encoded, and must not contain Carriage Return or Line Feed characters. Wildcard matching and regular expression matching are not supported. * Each exclude-prefix must omit the leading slash. For example, to exclude the object `s3://my-aws-bucket/logs/y=2015/requests.gz`, specify the exclude-prefix as `logs/y=2015/requests.gz`. * None of the exclude-prefix values can be empty, if specified. * Each exclude-prefix must exclude a distinct portion of the object namespace. No exclude-prefix may be a prefix of another exclude-prefix. * If include_prefixes is specified, then each exclude-prefix must start with the value of a path explicitly included by `include_prefixes`. The max size of `exclude_prefixes` is 1000. For more information, see [Filtering objects from transfers](/storage-transfer/docs/filtering-objects-from-transfers).
             */
            excludePrefixes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If you specify `include_prefixes`, Storage Transfer Service uses the items in the `include_prefixes` array to determine which objects to include in a transfer. Objects must start with one of the matching `include_prefixes` for inclusion in the transfer. If exclude_prefixes is specified, objects must not start with any of the `exclude_prefixes` specified for inclusion in the transfer. The following are requirements of `include_prefixes`: * Each include-prefix can contain any sequence of Unicode characters, to a max length of 1024 bytes when UTF8-encoded, and must not contain Carriage Return or Line Feed characters. Wildcard matching and regular expression matching are not supported. * Each include-prefix must omit the leading slash. For example, to include the object `s3://my-aws-bucket/logs/y=2015/requests.gz`, specify the include-prefix as `logs/y=2015/requests.gz`. * None of the include-prefix values can be empty, if specified. * Each include-prefix must include a distinct portion of the object namespace. No include-prefix may be a prefix of another include-prefix. The max size of `include_prefixes` is 1000. For more information, see [Filtering objects from transfers](/storage-transfer/docs/filtering-objects-from-transfers).
             */
            includePrefixes?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * If specified, only objects with a "last modification time" before this timestamp and objects that don't have a "last modification time" will be transferred.
             */
            lastModifiedBefore?: pulumi.Input<string>;
            /**
             * If specified, only objects with a "last modification time" on or after this timestamp and objects that don't have a "last modification time" are transferred. The `last_modified_since` and `last_modified_before` fields can be used together for chunked data processing. For example, consider a script that processes each day's worth of data at a time. For that you'd set each of the fields as follows: * `last_modified_since` to the start of the day * `last_modified_before` to the end of the day
             */
            lastModifiedSince?: pulumi.Input<string>;
            /**
             * If specified, only objects with a "last modification time" on or after `NOW` - `max_time_elapsed_since_last_modification` and objects that don't have a "last modification time" are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
             */
            maxTimeElapsedSinceLastModification?: pulumi.Input<string>;
            /**
             * If specified, only objects with a "last modification time" before `NOW` - `min_time_elapsed_since_last_modification` and objects that don't have a "last modification time" are transferred. For each TransferOperation started by this TransferJob, `NOW` refers to the start_time of the `TransferOperation`.
             */
            minTimeElapsedSinceLastModification?: pulumi.Input<string>;
        }
        /**
         * Transfers can be scheduled to recur or to run just once.
         */
        interface Schedule {
            /**
             * The time in UTC that no further transfer operations are scheduled. Combined with schedule_end_date, `end_time_of_day` specifies the end date and time for starting new transfer operations. This field must be greater than or equal to the timestamp corresponding to the combintation of schedule_start_date and start_time_of_day, and is subject to the following: * If `end_time_of_day` is not set and `schedule_end_date` is set, then a default value of `23:59:59` is used for `end_time_of_day`. * If `end_time_of_day` is set and `schedule_end_date` is not set, then INVALID_ARGUMENT is returned.
             */
            endTimeOfDay?: pulumi.Input<inputs.storagetransfer.v1.TimeOfDay>;
            /**
             * Interval between the start of each scheduled TransferOperation. If unspecified, the default value is 24 hours. This value may not be less than 1 hour.
             */
            repeatInterval?: pulumi.Input<string>;
            /**
             * The last day a transfer runs. Date boundaries are determined relative to UTC time. A job will run once per 24 hours within the following guidelines: * If `schedule_end_date` and schedule_start_date are the same and in the future relative to UTC, the transfer is executed only one time. * If `schedule_end_date` is later than `schedule_start_date` and `schedule_end_date` is in the future relative to UTC, the job will run each day at start_time_of_day through `schedule_end_date`.
             */
            scheduleEndDate?: pulumi.Input<inputs.storagetransfer.v1.Date>;
            /**
             * Required. The start date of a transfer. Date boundaries are determined relative to UTC time. If `schedule_start_date` and start_time_of_day are in the past relative to the job's creation time, the transfer starts the day after you schedule the transfer request. **Note:** When starting jobs at or near midnight UTC it is possible that a job will start later than expected. For example, if you send an outbound request on June 1 one millisecond prior to midnight UTC and the Storage Transfer Service server receives the request on June 2, then it will create a TransferJob with `schedule_start_date` set to June 2 and a `start_time_of_day` set to midnight UTC. The first scheduled TransferOperation will take place on June 3 at midnight UTC.
             */
            scheduleStartDate?: pulumi.Input<inputs.storagetransfer.v1.Date>;
            /**
             * The time in UTC that a transfer job is scheduled to run. Transfers may start later than this time. If `start_time_of_day` is not specified: * One-time transfers run immediately. * Recurring transfers run immediately, and each day at midnight UTC, through schedule_end_date. If `start_time_of_day` is specified: * One-time transfers run at the specified time. * Recurring transfers run at the specified time each day, through `schedule_end_date`.
             */
            startTimeOfDay?: pulumi.Input<inputs.storagetransfer.v1.TimeOfDay>;
        }
        /**
         * Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`.
         */
        interface TimeOfDay {
            /**
             * Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
             */
            hours?: pulumi.Input<number>;
            /**
             * Minutes of hour of day. Must be from 0 to 59.
             */
            minutes?: pulumi.Input<number>;
            /**
             * Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
             */
            seconds?: pulumi.Input<number>;
        }
        /**
         * TransferOptions define the actions to be performed on objects in a transfer.
         */
        interface TransferOptions {
            /**
             * Whether objects should be deleted from the source after they are transferred to the sink. **Note:** This option and delete_objects_unique_in_sink are mutually exclusive.
             */
            deleteObjectsFromSourceAfterTransfer?: pulumi.Input<boolean>;
            /**
             * Whether objects that exist only in the sink should be deleted. **Note:** This option and delete_objects_from_source_after_transfer are mutually exclusive.
             */
            deleteObjectsUniqueInSink?: pulumi.Input<boolean>;
            /**
             * When to overwrite objects that already exist in the sink. The default is that only objects that are different from the source are ovewritten. If true, all objects in the sink whose name matches an object in the source will be overwritten with the source object.
             */
            overwriteObjectsAlreadyExistingInSink?: pulumi.Input<boolean>;
        }
        /**
         * Configuration for running a transfer.
         */
        interface TransferSpec {
            /**
             * An AWS S3 data source.
             */
            awsS3DataSource?: pulumi.Input<inputs.storagetransfer.v1.AwsS3Data>;
            /**
             * An Azure Blob Storage data source.
             */
            azureBlobStorageDataSource?: pulumi.Input<inputs.storagetransfer.v1.AzureBlobStorageData>;
            /**
             * A Cloud Storage data sink.
             */
            gcsDataSink?: pulumi.Input<inputs.storagetransfer.v1.GcsData>;
            /**
             * A Cloud Storage data source.
             */
            gcsDataSource?: pulumi.Input<inputs.storagetransfer.v1.GcsData>;
            /**
             * An HTTP URL data source.
             */
            httpDataSource?: pulumi.Input<inputs.storagetransfer.v1.HttpData>;
            /**
             * Only objects that satisfy these object conditions are included in the set of data source and data sink objects. Object conditions based on objects' "last modification time" do not exclude objects in a data sink.
             */
            objectConditions?: pulumi.Input<inputs.storagetransfer.v1.ObjectConditions>;
            /**
             * If the option delete_objects_unique_in_sink is `true` and time-based object conditions such as 'last modification time' are specified, the request fails with an INVALID_ARGUMENT error.
             */
            transferOptions?: pulumi.Input<inputs.storagetransfer.v1.TransferOptions>;
        }
    }
}
export declare namespace testing {
    namespace v1 {
        /**
         * Identifies an account and how to log into it.
         */
        interface Account {
            /**
             * An automatic google login account.
             */
            googleAuto?: pulumi.Input<inputs.testing.v1.GoogleAuto>;
        }
        /**
         * A single Android device.
         */
        interface AndroidDevice {
            /**
             * Required. The id of the Android device to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            androidModelId?: pulumi.Input<string>;
            /**
             * Required. The id of the Android OS version to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            androidVersionId?: pulumi.Input<string>;
            /**
             * Required. The locale the test device used for testing. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            locale?: pulumi.Input<string>;
            /**
             * Required. How the device is oriented during the test. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            orientation?: pulumi.Input<string>;
        }
        /**
         * A list of Android device configurations in which the test is to be executed.
         */
        interface AndroidDeviceList {
            /**
             * Required. A list of Android devices.
             */
            androidDevices?: pulumi.Input<pulumi.Input<inputs.testing.v1.AndroidDevice>[]>;
        }
        /**
         * A test of an Android application that can control an Android component independently of its normal lifecycle. Android instrumentation tests run an application APK and test APK inside the same process on a virtual or physical AndroidDevice. They also specify a test runner class, such as com.google.GoogleTestRunner, which can vary on the specific instrumentation framework chosen. See for more information on types of Android tests.
         */
        interface AndroidInstrumentationTest {
            /**
             * The APK for the application under test.
             */
            appApk?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * A multi-apk app bundle for the application under test.
             */
            appBundle?: pulumi.Input<inputs.testing.v1.AppBundle>;
            /**
             * The java package for the application under test. The default value is determined by examining the application's manifest.
             */
            appPackageId?: pulumi.Input<string>;
            /**
             * The option of whether running each test within its own invocation of instrumentation with Android Test Orchestrator or not. ** Orchestrator is only compatible with AndroidJUnitRunner version 1.0 or higher! ** Orchestrator offers the following benefits: - No shared state - Crashes are isolated - Logs are scoped per test See for more information about Android Test Orchestrator. If not set, the test will be run without the orchestrator.
             */
            orchestratorOption?: pulumi.Input<string>;
            /**
             * The option to run tests in multiple shards in parallel.
             */
            shardingOption?: pulumi.Input<inputs.testing.v1.ShardingOption>;
            /**
             * Required. The APK containing the test code to be executed.
             */
            testApk?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * The java package for the test to be executed. The default value is determined by examining the application's manifest.
             */
            testPackageId?: pulumi.Input<string>;
            /**
             * The InstrumentationTestRunner class. The default value is determined by examining the application's manifest.
             */
            testRunnerClass?: pulumi.Input<string>;
            /**
             * Each target must be fully qualified with the package name or class name, in one of these formats: - "package package_name" - "class package_name.class_name" - "class package_name.class_name#method_name" If empty, all targets in the module will be run.
             */
            testTargets?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A set of Android device configuration permutations is defined by the the cross-product of the given axes. Internally, the given AndroidMatrix will be expanded into a set of AndroidDevices. Only supported permutations will be instantiated. Invalid permutations (e.g., incompatible models/versions) are ignored.
         */
        interface AndroidMatrix {
            /**
             * Required. The ids of the set of Android device to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            androidModelIds?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The ids of the set of Android OS version to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            androidVersionIds?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The set of locales the test device will enable for testing. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            locales?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. The set of orientations to test with. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            orientations?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A test of an android application that explores the application on a virtual or physical Android Device, finding culprits and crashes as it goes. Next tag: 30
         */
        interface AndroidRoboTest {
            /**
             * The APK for the application under test.
             */
            appApk?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * A multi-apk app bundle for the application under test.
             */
            appBundle?: pulumi.Input<inputs.testing.v1.AppBundle>;
            /**
             * The initial activity that should be used to start the app.
             */
            appInitialActivity?: pulumi.Input<string>;
            /**
             * The java package for the application under test. The default value is determined by examining the application's manifest.
             */
            appPackageId?: pulumi.Input<string>;
            /**
             * The max depth of the traversal stack Robo can explore. Needs to be at least 2 to make Robo explore the app beyond the first activity. Default is 50.
             */
            maxDepth?: pulumi.Input<number>;
            /**
             * The max number of steps Robo can execute. Default is no limit.
             */
            maxSteps?: pulumi.Input<number>;
            /**
             * A set of directives Robo should apply during the crawl. This allows users to customize the crawl. For example, the username and password for a test account can be provided.
             */
            roboDirectives?: pulumi.Input<pulumi.Input<inputs.testing.v1.RoboDirective>[]>;
            /**
             * A JSON file with a sequence of actions Robo should perform as a prologue for the crawl.
             */
            roboScript?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * The intents used to launch the app for the crawl. If none are provided, then the main launcher activity is launched. If some are provided, then only those provided are launched (the main launcher activity must be provided explicitly).
             */
            startingIntents?: pulumi.Input<pulumi.Input<inputs.testing.v1.RoboStartingIntent>[]>;
        }
        /**
         * A test of an Android Application with a Test Loop. The intent \ will be implicitly added, since Games is the only user of this api, for the time being.
         */
        interface AndroidTestLoop {
            /**
             * The APK for the application under test.
             */
            appApk?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * A multi-apk app bundle for the application under test.
             */
            appBundle?: pulumi.Input<inputs.testing.v1.AppBundle>;
            /**
             * The java package for the application under test. The default is determined by examining the application's manifest.
             */
            appPackageId?: pulumi.Input<string>;
            /**
             * The list of scenario labels that should be run during the test. The scenario labels should map to labels defined in the application's manifest. For example, player_experience and com.google.test.loops.player_experience add all of the loops labeled in the manifest with the com.google.test.loops.player_experience name to the execution. Scenarios can also be specified in the scenarios field.
             */
            scenarioLabels?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The list of scenarios that should be run during the test. The default is all test loops, derived from the application's manifest.
             */
            scenarios?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * An Android package file to install.
         */
        interface Apk {
            /**
             * The path to an APK to be installed on the device before the test begins.
             */
            location?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * The java package for the APK to be installed. Value is determined by examining the application's manifest.
             */
            packageName?: pulumi.Input<string>;
        }
        /**
         * An Android App Bundle file format, containing a BundleConfig.pb file, a base module directory, zero or more dynamic feature module directories. See https://developer.android.com/guide/app-bundle/build for guidance on building App Bundles.
         */
        interface AppBundle {
            /**
             * .aab file representing the app bundle under test.
             */
            bundleLocation?: pulumi.Input<inputs.testing.v1.FileReference>;
        }
        /**
         * Information about the client which invoked the test.
         */
        interface ClientInfo {
            /**
             * The list of detailed information about client.
             */
            clientInfoDetails?: pulumi.Input<pulumi.Input<inputs.testing.v1.ClientInfoDetail>[]>;
            /**
             * Required. Client name, such as gcloud.
             */
            name?: pulumi.Input<string>;
        }
        /**
         * Key-value pair of detailed information about the client which invoked the test. Examples: {'Version', '1.0'}, {'Release Track', 'BETA'}.
         */
        interface ClientInfoDetail {
            /**
             * Required. The key of detailed client information.
             */
            key?: pulumi.Input<string>;
            /**
             * Required. The value of detailed client information.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * A single device file description.
         */
        interface DeviceFile {
            /**
             * A reference to an opaque binary blob file.
             */
            obbFile?: pulumi.Input<inputs.testing.v1.ObbFile>;
            /**
             * A reference to a regular file.
             */
            regularFile?: pulumi.Input<inputs.testing.v1.RegularFile>;
        }
        /**
         * The environment in which the test is run.
         */
        interface Environment {
            /**
             * An Android device which must be used with an Android test.
             */
            androidDevice?: pulumi.Input<inputs.testing.v1.AndroidDevice>;
            /**
             * An iOS device which must be used with an iOS test.
             */
            iosDevice?: pulumi.Input<inputs.testing.v1.IosDevice>;
        }
        /**
         * The matrix of environments in which the test is to be executed.
         */
        interface EnvironmentMatrix {
            /**
             * A list of Android devices; the test will be run only on the specified devices.
             */
            androidDeviceList?: pulumi.Input<inputs.testing.v1.AndroidDeviceList>;
            /**
             * A matrix of Android devices.
             */
            androidMatrix?: pulumi.Input<inputs.testing.v1.AndroidMatrix>;
            /**
             * A list of iOS devices.
             */
            iosDeviceList?: pulumi.Input<inputs.testing.v1.IosDeviceList>;
        }
        /**
         * A key-value pair passed as an environment variable to the test.
         */
        interface EnvironmentVariable {
            /**
             * Key for the environment variable.
             */
            key?: pulumi.Input<string>;
            /**
             * Value for the environment variable.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * A reference to a file, used for user inputs.
         */
        interface FileReference {
            /**
             * A path to a file in Google Cloud Storage. Example: gs://build-app-1414623860166/app%40debug-unaligned.apk These paths are expected to be url encoded (percent encoding)
             */
            gcsPath?: pulumi.Input<string>;
        }
        /**
         * Enables automatic Google account login. If set, the service automatically generates a Google test account and adds it to the device, before executing the test. Note that test accounts might be reused. Many applications show their full set of functionalities when an account is present on the device. Logging into the device with these generated accounts allows testing more functionalities.
         */
        interface GoogleAuto {
        }
        /**
         * A storage location within Google cloud storage (GCS).
         */
        interface GoogleCloudStorage {
            /**
             * Required. The path to a directory in GCS that will eventually contain the results for this test. The requesting user must have write access on the bucket in the supplied path.
             */
            gcsPath?: pulumi.Input<string>;
        }
        /**
         * A single iOS device.
         */
        interface IosDevice {
            /**
             * Required. The id of the iOS device to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            iosModelId?: pulumi.Input<string>;
            /**
             * Required. The id of the iOS major software version to be used. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            iosVersionId?: pulumi.Input<string>;
            /**
             * Required. The locale the test device used for testing. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            locale?: pulumi.Input<string>;
            /**
             * Required. How the device is oriented during the test. Use the TestEnvironmentDiscoveryService to get supported options.
             */
            orientation?: pulumi.Input<string>;
        }
        /**
         * A file or directory to install on the device before the test starts.
         */
        interface IosDeviceFile {
            /**
             * The bundle id of the app where this file lives. iOS apps sandbox their own filesystem, so app files must specify which app installed on the device.
             */
            bundleId?: pulumi.Input<string>;
            /**
             * The source file
             */
            content?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * Location of the file on the device, inside the app's sandboxed filesystem
             */
            devicePath?: pulumi.Input<string>;
        }
        /**
         * A list of iOS device configurations in which the test is to be executed.
         */
        interface IosDeviceList {
            /**
             * Required. A list of iOS devices.
             */
            iosDevices?: pulumi.Input<pulumi.Input<inputs.testing.v1.IosDevice>[]>;
        }
        /**
         * A test of an iOS application that implements one or more game loop scenarios. This test type accepts an archived application (.ipa file) and a list of integer scenarios that will be executed on the app sequentially.
         */
        interface IosTestLoop {
            /**
             * The bundle id for the application under test.
             */
            appBundleId?: pulumi.Input<string>;
            /**
             * Required. The .ipa of the application to test.
             */
            appIpa?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * The list of scenarios that should be run during the test. Defaults to the single scenario 0 if unspecified.
             */
            scenarios?: pulumi.Input<pulumi.Input<number>[]>;
        }
        /**
         * A description of how to set up an iOS device prior to running the test.
         */
        interface IosTestSetup {
            /**
             * iOS apps to install in addition to those being directly tested.
             */
            additionalIpas?: pulumi.Input<pulumi.Input<inputs.testing.v1.FileReference>[]>;
            /**
             * The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
             */
            networkProfile?: pulumi.Input<string>;
            /**
             * List of directories on the device to upload to Cloud Storage at the end of the test. Directories should either be in a shared directory (e.g. /private/var/mobile/Media) or within an accessible directory inside the app's filesystem (e.g. /Documents) by specifying the bundle id.
             */
            pullDirectories?: pulumi.Input<pulumi.Input<inputs.testing.v1.IosDeviceFile>[]>;
            /**
             * List of files to push to the device before starting the test.
             */
            pushFiles?: pulumi.Input<pulumi.Input<inputs.testing.v1.IosDeviceFile>[]>;
        }
        /**
         * A test of an iOS application that uses the XCTest framework. Xcode supports the option to "build for testing", which generates an .xctestrun file that contains a test specification (arguments, test methods, etc). This test type accepts a zip file containing the .xctestrun file and the corresponding contents of the Build/Products directory that contains all the binaries needed to run the tests.
         */
        interface IosXcTest {
            /**
             * The bundle id for the application under test.
             */
            appBundleId?: pulumi.Input<string>;
            /**
             * The option to test special app entitlements. Setting this would re-sign the app having special entitlements with an explicit application-identifier. Currently supports testing aps-environment entitlement.
             */
            testSpecialEntitlements?: pulumi.Input<boolean>;
            /**
             * Required. The .zip containing the .xctestrun file and the contents of the DerivedData/Build/Products directory. The .xctestrun file in this zip is ignored if the xctestrun field is specified.
             */
            testsZip?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * The Xcode version that should be used for the test. Use the TestEnvironmentDiscoveryService to get supported options. Defaults to the latest Xcode version Firebase Test Lab supports.
             */
            xcodeVersion?: pulumi.Input<string>;
            /**
             * An .xctestrun file that will override the .xctestrun file in the tests zip. Because the .xctestrun file contains environment variables along with test methods to run and/or ignore, this can be useful for sharding tests. Default is taken from the tests zip.
             */
            xctestrun?: pulumi.Input<inputs.testing.v1.FileReference>;
        }
        /**
         * Specifies an intent that starts the main launcher activity.
         */
        interface LauncherActivityIntent {
        }
        /**
         * Shards test cases into the specified groups of packages, classes, and/or methods. With manual sharding enabled, specifying test targets via environment_variables or in InstrumentationTest is invalid.
         */
        interface ManualSharding {
            /**
             * Required. Group of packages, classes, and/or test methods to be run for each shard. When any physical devices are selected, the number of test_targets_for_shard must be >= 1 and <= 50. When no physical devices are selected, the number must be >= 1 and <= 500.
             */
            testTargetsForShard?: pulumi.Input<pulumi.Input<inputs.testing.v1.TestTargetsForShard>[]>;
        }
        /**
         * An opaque binary blob file to install on the device before the test starts.
         */
        interface ObbFile {
            /**
             * Required. Opaque Binary Blob (OBB) file(s) to install on the device.
             */
            obb?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * Required. OBB file name which must conform to the format as specified by Android e.g. [main|patch].0300110.com.example.android.obb which will be installed into \/Android/obb/\/ on the device.
             */
            obbFileName?: pulumi.Input<string>;
        }
        /**
         * A file or directory to install on the device before the test starts.
         */
        interface RegularFile {
            /**
             * Required. The source file.
             */
            content?: pulumi.Input<inputs.testing.v1.FileReference>;
            /**
             * Required. Where to put the content on the device. Must be an absolute, allowlisted path. If the file exists, it will be replaced. The following device-side directories and any of their subdirectories are allowlisted: ${EXTERNAL_STORAGE}, /sdcard, or /storage ${ANDROID_DATA}/local/tmp, or /data/local/tmp Specifying a path outside of these directory trees is invalid. The paths /sdcard and /data will be made available and treated as implicit path substitutions. E.g. if /sdcard on a particular device does not map to external storage, the system will replace it with the external storage path prefix for that device and copy the file there. It is strongly advised to use the Environment API in app and test code to access files on the device in a portable way.
             */
            devicePath?: pulumi.Input<string>;
        }
        /**
         * Locations where the results of running the test are stored.
         */
        interface ResultStorage {
            /**
             * Required.
             */
            googleCloudStorage?: pulumi.Input<inputs.testing.v1.GoogleCloudStorage>;
            /**
             * URL to the results in the Firebase Web Console.
             */
            resultsUrl?: pulumi.Input<string>;
            /**
             * The tool results execution that results are written to.
             */
            toolResultsExecution?: pulumi.Input<inputs.testing.v1.ToolResultsExecution>;
            /**
             * The tool results history that contains the tool results execution that results are written to. If not provided, the service will choose an appropriate value.
             */
            toolResultsHistory?: pulumi.Input<inputs.testing.v1.ToolResultsHistory>;
        }
        /**
         * Directs Robo to interact with a specific UI element if it is encountered during the crawl. Currently, Robo can perform text entry or element click.
         */
        interface RoboDirective {
            /**
             * Required. The type of action that Robo should perform on the specified element.
             */
            actionType?: pulumi.Input<string>;
            /**
             * The text that Robo is directed to set. If left empty, the directive will be treated as a CLICK on the element matching the resource_name.
             */
            inputText?: pulumi.Input<string>;
            /**
             * Required. The android resource name of the target UI element. For example, in Java: R.string.foo in xml: @string/foo Only the "foo" part is needed. Reference doc: https://developer.android.com/guide/topics/resources/accessing-resources.html
             */
            resourceName?: pulumi.Input<string>;
        }
        /**
         * Message for specifying the start activities to crawl.
         */
        interface RoboStartingIntent {
            /**
             * An intent that starts the main launcher activity.
             */
            launcherActivity?: pulumi.Input<inputs.testing.v1.LauncherActivityIntent>;
            /**
             * An intent that starts an activity with specific details.
             */
            startActivity?: pulumi.Input<inputs.testing.v1.StartActivityIntent>;
            /**
             * Timeout in seconds for each intent.
             */
            timeout?: pulumi.Input<string>;
        }
        /**
         * Output only. Details about the shard.
         */
        interface Shard {
            /**
             * The total number of shards.
             */
            numShards?: pulumi.Input<number>;
            /**
             * The index of the shard among all the shards.
             */
            shardIndex?: pulumi.Input<number>;
            /**
             * Test targets for each shard.
             */
            testTargetsForShard?: pulumi.Input<inputs.testing.v1.TestTargetsForShard>;
        }
        /**
         * Options for enabling sharding.
         */
        interface ShardingOption {
            /**
             * Shards test cases into the specified groups of packages, classes, and/or methods.
             */
            manualSharding?: pulumi.Input<inputs.testing.v1.ManualSharding>;
            /**
             * Uniformly shards test cases given a total number of shards.
             */
            uniformSharding?: pulumi.Input<inputs.testing.v1.UniformSharding>;
        }
        /**
         * A starting intent specified by an action, uri, and categories.
         */
        interface StartActivityIntent {
            /**
             * Action name. Required for START_ACTIVITY.
             */
            action?: pulumi.Input<string>;
            /**
             * Intent categories to set on the intent.
             */
            categories?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * URI for the action.
             */
            uri?: pulumi.Input<string>;
        }
        interface SystraceSetup {
            /**
             * Systrace duration in seconds. Should be between 1 and 30 seconds. 0 disables systrace.
             */
            durationSeconds?: pulumi.Input<number>;
        }
        /**
         * Additional details about the progress of the running test.
         */
        interface TestDetails {
            /**
             * If the TestState is ERROR, then this string will contain human-readable details about the error.
             */
            errorMessage?: pulumi.Input<string>;
            /**
             * Human-readable, detailed descriptions of the test's progress. For example: "Provisioning a device", "Starting Test". During the course of execution new data may be appended to the end of progress_messages.
             */
            progressMessages?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * A single test executed in a single environment.
         */
        interface TestExecution {
            /**
             * How the host machine(s) are configured.
             */
            environment?: pulumi.Input<inputs.testing.v1.Environment>;
            /**
             * Unique id set by the service.
             */
            id?: pulumi.Input<string>;
            /**
             * Id of the containing TestMatrix.
             */
            matrixId?: pulumi.Input<string>;
            /**
             * The cloud project that owns the test execution.
             */
            projectId?: pulumi.Input<string>;
            /**
             * Details about the shard.
             */
            shard?: pulumi.Input<inputs.testing.v1.Shard>;
            /**
             * Indicates the current progress of the test execution (e.g., FINISHED).
             */
            state?: pulumi.Input<string>;
            /**
             * Additional details about the running test.
             */
            testDetails?: pulumi.Input<inputs.testing.v1.TestDetails>;
            /**
             * How to run the test.
             */
            testSpecification?: pulumi.Input<inputs.testing.v1.TestSpecification>;
            /**
             * The time this test execution was initially created.
             */
            timestamp?: pulumi.Input<string>;
            /**
             * Where the results for this execution are written.
             */
            toolResultsStep?: pulumi.Input<inputs.testing.v1.ToolResultsStep>;
        }
        /**
         * A description of how to set up the Android device prior to running the test.
         */
        interface TestSetup {
            /**
             * The device will be logged in on this account for the duration of the test.
             */
            account?: pulumi.Input<inputs.testing.v1.Account>;
            /**
             * APKs to install in addition to those being directly tested. Currently capped at 100.
             */
            additionalApks?: pulumi.Input<pulumi.Input<inputs.testing.v1.Apk>[]>;
            /**
             * List of directories on the device to upload to GCS at the end of the test; they must be absolute paths under /sdcard, /storage or /data/local/tmp. Path names are restricted to characters a-z A-Z 0-9 _ - . + and / Note: The paths /sdcard and /data will be made available and treated as implicit path substitutions. E.g. if /sdcard on a particular device does not map to external storage, the system will replace it with the external storage path prefix for that device.
             */
            directoriesToPull?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Whether to prevent all runtime permissions to be granted at app install
             */
            dontAutograntPermissions?: pulumi.Input<boolean>;
            /**
             * Environment variables to set for the test (only applicable for instrumentation tests).
             */
            environmentVariables?: pulumi.Input<pulumi.Input<inputs.testing.v1.EnvironmentVariable>[]>;
            /**
             * List of files to push to the device before starting the test.
             */
            filesToPush?: pulumi.Input<pulumi.Input<inputs.testing.v1.DeviceFile>[]>;
            /**
             * The network traffic profile used for running the test. Available network profiles can be queried by using the NETWORK_CONFIGURATION environment type when calling TestEnvironmentDiscoveryService.GetTestEnvironmentCatalog.
             */
            networkProfile?: pulumi.Input<string>;
            /**
             * Systrace configuration for the run. If set a systrace will be taken, starting on test start and lasting for the configured duration. The systrace file thus obtained is put in the results bucket together with the other artifacts from the run.
             */
            systrace?: pulumi.Input<inputs.testing.v1.SystraceSetup>;
        }
        /**
         * A description of how to run the test.
         */
        interface TestSpecification {
            /**
             * An Android instrumentation test.
             */
            androidInstrumentationTest?: pulumi.Input<inputs.testing.v1.AndroidInstrumentationTest>;
            /**
             * An Android robo test.
             */
            androidRoboTest?: pulumi.Input<inputs.testing.v1.AndroidRoboTest>;
            /**
             * An Android Application with a Test Loop.
             */
            androidTestLoop?: pulumi.Input<inputs.testing.v1.AndroidTestLoop>;
            /**
             * Disables performance metrics recording. May reduce test latency.
             */
            disablePerformanceMetrics?: pulumi.Input<boolean>;
            /**
             * Disables video recording. May reduce test latency.
             */
            disableVideoRecording?: pulumi.Input<boolean>;
            /**
             * An iOS application with a test loop.
             */
            iosTestLoop?: pulumi.Input<inputs.testing.v1.IosTestLoop>;
            /**
             * Test setup requirements for iOS.
             */
            iosTestSetup?: pulumi.Input<inputs.testing.v1.IosTestSetup>;
            /**
             * An iOS XCTest, via an .xctestrun file.
             */
            iosXcTest?: pulumi.Input<inputs.testing.v1.IosXcTest>;
            /**
             * Test setup requirements for Android e.g. files to install, bootstrap scripts.
             */
            testSetup?: pulumi.Input<inputs.testing.v1.TestSetup>;
            /**
             * Max time a test execution is allowed to run before it is automatically cancelled. The default value is 5 min.
             */
            testTimeout?: pulumi.Input<string>;
        }
        /**
         * Test targets for a shard.
         */
        interface TestTargetsForShard {
            /**
             * Group of packages, classes, and/or test methods to be run for each shard. The targets need to be specified in AndroidJUnitRunner argument format. For example, "package com.my.packages" "class com.my.package.MyClass". The number of shard_test_targets must be greater than 0.
             */
            testTargets?: pulumi.Input<pulumi.Input<string>[]>;
        }
        /**
         * Represents a tool results execution resource. This has the results of a TestMatrix.
         */
        interface ToolResultsExecution {
            /**
             * A tool results execution ID.
             */
            executionId?: pulumi.Input<string>;
            /**
             * A tool results history ID.
             */
            historyId?: pulumi.Input<string>;
            /**
             * The cloud project that owns the tool results execution.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Represents a tool results history resource.
         */
        interface ToolResultsHistory {
            /**
             * Required. A tool results history ID.
             */
            historyId?: pulumi.Input<string>;
            /**
             * Required. The cloud project that owns the tool results history.
             */
            projectId?: pulumi.Input<string>;
        }
        /**
         * Represents a tool results step resource. This has the results of a TestExecution.
         */
        interface ToolResultsStep {
            /**
             * A tool results execution ID.
             */
            executionId?: pulumi.Input<string>;
            /**
             * A tool results history ID.
             */
            historyId?: pulumi.Input<string>;
            /**
             * The cloud project that owns the tool results step.
             */
            projectId?: pulumi.Input<string>;
            /**
             * A tool results step ID.
             */
            stepId?: pulumi.Input<string>;
        }
        /**
         * Uniformly shards test cases given a total number of shards. For Instrumentation test, it will be translated to "-e numShard" "-e shardIndex" AndroidJUnitRunner arguments. With uniform sharding enabled, specifying these sharding arguments via environment_variables is invalid.
         */
        interface UniformSharding {
            /**
             * Required. Total number of shards. When any physical devices are selected, the number must be >= 1 and <= 50. When no physical devices are selected, the number must be >= 1 and <= 500.
             */
            numShards?: pulumi.Input<number>;
        }
    }
}
export declare namespace toolresults {
    namespace v1beta3 {
        /**
         * Android app information.
         */
        interface AndroidAppInfo {
            /**
             * The name of the app. Optional
             */
            name?: pulumi.Input<string>;
            /**
             * The package name of the app. Required.
             */
            packageName?: pulumi.Input<string>;
            /**
             * The internal version code of the app. Optional.
             */
            versionCode?: pulumi.Input<string>;
            /**
             * The version name of the app. Optional.
             */
            versionName?: pulumi.Input<string>;
        }
        /**
         * A test of an Android application that can control an Android component independently of its normal lifecycle. See for more information on types of Android tests.
         */
        interface AndroidInstrumentationTest {
            /**
             * The java package for the test to be executed. Required
             */
            testPackageId?: pulumi.Input<string>;
            /**
             * The InstrumentationTestRunner class. Required
             */
            testRunnerClass?: pulumi.Input<string>;
            /**
             * Each target must be fully qualified with the package name or class name, in one of these formats: - "package package_name" - "class package_name.class_name" - "class package_name.class_name#method_name" If empty, all targets in the module will be run.
             */
            testTargets?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The flag indicates whether Android Test Orchestrator will be used to run test or not.
             */
            useOrchestrator?: pulumi.Input<boolean>;
        }
        /**
         * A test of an android application that explores the application on a virtual or physical Android device, finding culprits and crashes as it goes.
         */
        interface AndroidRoboTest {
            /**
             * The initial activity that should be used to start the app. Optional
             */
            appInitialActivity?: pulumi.Input<string>;
            /**
             * The java package for the bootstrap. Optional
             */
            bootstrapPackageId?: pulumi.Input<string>;
            /**
             * The runner class for the bootstrap. Optional
             */
            bootstrapRunnerClass?: pulumi.Input<string>;
            /**
             * The max depth of the traversal stack Robo can explore. Optional
             */
            maxDepth?: pulumi.Input<number>;
            /**
             * The max number of steps/actions Robo can execute. Default is no limit (0). Optional
             */
            maxSteps?: pulumi.Input<number>;
        }
        /**
         * An Android mobile test specification.
         */
        interface AndroidTest {
            /**
             * Information about the application under test.
             */
            androidAppInfo?: pulumi.Input<inputs.toolresults.v1beta3.AndroidAppInfo>;
            /**
             * An Android instrumentation test.
             */
            androidInstrumentationTest?: pulumi.Input<inputs.toolresults.v1beta3.AndroidInstrumentationTest>;
            /**
             * An Android robo test.
             */
            androidRoboTest?: pulumi.Input<inputs.toolresults.v1beta3.AndroidRoboTest>;
            /**
             * An Android test loop.
             */
            androidTestLoop?: pulumi.Input<inputs.toolresults.v1beta3.AndroidTestLoop>;
            /**
             * Max time a test is allowed to run before it is automatically cancelled.
             */
            testTimeout?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
        }
        /**
         * Test Loops are tests that can be launched by the app itself, determining when to run by listening for an intent.
         */
        interface AndroidTestLoop {
        }
        /**
         *  `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := ptypes.MarshalAny(foo) ... foo := &pb.Foo{} if err := ptypes.UnmarshalAny(any, foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". # JSON The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message google.protobuf.Duration): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" }
         */
        interface Any {
            /**
             * A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a google.protobuf.Type value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics.
             */
            typeUrl?: pulumi.Input<string>;
            /**
             * Must be a valid serialized protocol buffer of the above specified type.
             */
            value?: pulumi.Input<string>;
        }
        interface AppStartTime {
            /**
             * Optional. The time from app start to reaching the developer-reported "fully drawn" time. This is only stored if the app includes a call to Activity.reportFullyDrawn(). See https://developer.android.com/topic/performance/launch-time.html#time-full
             */
            fullyDrawnTime?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
            /**
             * The time from app start to the first displayed activity being drawn, as reported in Logcat. See https://developer.android.com/topic/performance/launch-time.html#time-initial
             */
            initialDisplayTime?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
        }
        /**
         * Encapsulates the metadata for basic sample series represented by a line chart
         */
        interface BasicPerfSampleSeries {
            perfMetricType?: pulumi.Input<string>;
            perfUnit?: pulumi.Input<string>;
            sampleSeriesLabel?: pulumi.Input<string>;
        }
        interface CPUInfo {
            /**
             * description of the device processor ie '1.8 GHz hexa core 64-bit ARMv8-A'
             */
            cpuProcessor?: pulumi.Input<string>;
            /**
             * the CPU clock speed in GHz
             */
            cpuSpeedInGhz?: pulumi.Input<number>;
            /**
             * the number of CPU cores
             */
            numberOfCores?: pulumi.Input<number>;
        }
        /**
         *  A Duration represents a signed, fixed-length span of time represented as a count of seconds and fractions of seconds at nanosecond resolution. It is independent of any calendar and concepts like "day" or "month". It is related to Timestamp in that the difference between two Timestamp values is a Duration and it can be added or subtracted from a Timestamp. Range is approximately +-10,000 years.
         */
        interface Duration {
            /**
             * Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
             */
            seconds?: pulumi.Input<string>;
        }
        /**
         * Details for an outcome with a FAILURE outcome summary.
         */
        interface FailureDetail {
            /**
             * If the failure was severe because the system (app) under test crashed.
             */
            crashed?: pulumi.Input<boolean>;
            /**
             * If the device ran out of memory during a test, causing the test to crash.
             */
            deviceOutOfMemory?: pulumi.Input<boolean>;
            /**
             * If the Roboscript failed to complete successfully, e.g., because a Roboscript action or assertion failed or a Roboscript action could not be matched during the entire crawl.
             */
            failedRoboscript?: pulumi.Input<boolean>;
            /**
             * If an app is not installed and thus no test can be run with the app. This might be caused by trying to run a test on an unsupported platform.
             */
            notInstalled?: pulumi.Input<boolean>;
            /**
             * If a native process (including any other than the app) crashed.
             */
            otherNativeCrash?: pulumi.Input<boolean>;
            /**
             * If the test overran some time limit, and that is why it failed.
             */
            timedOut?: pulumi.Input<boolean>;
            /**
             * If the robo was unable to crawl the app; perhaps because the app did not start.
             */
            unableToCrawl?: pulumi.Input<boolean>;
        }
        /**
         * A reference to a file.
         */
        interface FileReference {
            /**
             * The URI of a file stored in Google Cloud Storage. For example: http://storage.googleapis.com/mybucket/path/to/test.xml or in gsutil format: gs://mybucket/path/to/test.xml with version-specific info, gs://mybucket/path/to/test.xml#1360383693690000 An INVALID_ARGUMENT error will be returned if the URI format is not supported. - In response: always set - In create/update request: always set
             */
            fileUri?: pulumi.Input<string>;
        }
        /**
         * Graphics statistics for the App. The information is collected from 'adb shell dumpsys graphicsstats'. For more info see: https://developer.android.com/training/testing/performance.html Statistics will only be present for API 23+.
         */
        interface GraphicsStats {
            /**
             * Histogram of frame render times. There should be 154 buckets ranging from [5ms, 6ms) to [4950ms, infinity)
             */
            buckets?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.GraphicsStatsBucket>[]>;
            /**
             * Total "high input latency" events.
             */
            highInputLatencyCount?: pulumi.Input<string>;
            /**
             * Total frames with slow render time. Should be <= total_frames.
             */
            jankyFrames?: pulumi.Input<string>;
            /**
             * Total "missed vsync" events.
             */
            missedVsyncCount?: pulumi.Input<string>;
            /**
             * 50th percentile frame render time in milliseconds.
             */
            p50Millis?: pulumi.Input<string>;
            /**
             * 90th percentile frame render time in milliseconds.
             */
            p90Millis?: pulumi.Input<string>;
            /**
             * 95th percentile frame render time in milliseconds.
             */
            p95Millis?: pulumi.Input<string>;
            /**
             * 99th percentile frame render time in milliseconds.
             */
            p99Millis?: pulumi.Input<string>;
            /**
             * Total "slow bitmap upload" events.
             */
            slowBitmapUploadCount?: pulumi.Input<string>;
            /**
             * Total "slow draw" events.
             */
            slowDrawCount?: pulumi.Input<string>;
            /**
             * Total "slow UI thread" events.
             */
            slowUiThreadCount?: pulumi.Input<string>;
            /**
             * Total frames rendered by package.
             */
            totalFrames?: pulumi.Input<string>;
        }
        interface GraphicsStatsBucket {
            /**
             * Number of frames in the bucket.
             */
            frameCount?: pulumi.Input<string>;
            /**
             * Lower bound of render time in milliseconds.
             */
            renderMillis?: pulumi.Input<string>;
        }
        /**
         * Details for an outcome with an INCONCLUSIVE outcome summary.
         */
        interface InconclusiveDetail {
            /**
             * If the end user aborted the test execution before a pass or fail could be determined. For example, the user pressed ctrl-c which sent a kill signal to the test runner while the test was running.
             */
            abortedByUser?: pulumi.Input<boolean>;
            /**
             * If results are being provided to the user in certain cases of infrastructure failures
             */
            hasErrorLogs?: pulumi.Input<boolean>;
            /**
             * If the test runner could not determine success or failure because the test depends on a component other than the system under test which failed. For example, a mobile test requires provisioning a device where the test executes, and that provisioning can fail.
             */
            infrastructureFailure?: pulumi.Input<boolean>;
        }
        /**
         * Step Id and outcome of each individual step that was run as a group with other steps with the same configuration.
         */
        interface IndividualOutcome {
            /**
             * Unique int given to each step. Ranges from 0(inclusive) to total number of steps(exclusive). The primary step is 0.
             */
            multistepNumber?: pulumi.Input<number>;
            outcomeSummary?: pulumi.Input<string>;
            /**
             * How long it took for this step to run.
             */
            runDuration?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
            stepId?: pulumi.Input<string>;
        }
        /**
         * iOS app information
         */
        interface IosAppInfo {
            /**
             * The name of the app. Required
             */
            name?: pulumi.Input<string>;
        }
        /**
         * A Robo test for an iOS application.
         */
        interface IosRoboTest {
        }
        /**
         * A iOS mobile test specification
         */
        interface IosTest {
            /**
             * Information about the application under test.
             */
            iosAppInfo?: pulumi.Input<inputs.toolresults.v1beta3.IosAppInfo>;
            /**
             * An iOS Robo test.
             */
            iosRoboTest?: pulumi.Input<inputs.toolresults.v1beta3.IosRoboTest>;
            /**
             * An iOS test loop.
             */
            iosTestLoop?: pulumi.Input<inputs.toolresults.v1beta3.IosTestLoop>;
            /**
             * An iOS XCTest.
             */
            iosXcTest?: pulumi.Input<inputs.toolresults.v1beta3.IosXcTest>;
            /**
             * Max time a test is allowed to run before it is automatically cancelled.
             */
            testTimeout?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
        }
        /**
         * A game loop test of an iOS application.
         */
        interface IosTestLoop {
            /**
             * Bundle ID of the app.
             */
            bundleId?: pulumi.Input<string>;
        }
        /**
         * A test of an iOS application that uses the XCTest framework.
         */
        interface IosXcTest {
            /**
             * Bundle ID of the app.
             */
            bundleId?: pulumi.Input<string>;
            /**
             * Xcode version that the test was run with.
             */
            xcodeVersion?: pulumi.Input<string>;
        }
        /**
         * One dimension of the matrix of different runs of a step.
         */
        interface MatrixDimensionDefinition {
        }
        interface MemoryInfo {
            /**
             * Maximum memory that can be allocated to the process in KiB
             */
            memoryCapInKibibyte?: pulumi.Input<string>;
            /**
             * Total memory available on the device in KiB
             */
            memoryTotalInKibibyte?: pulumi.Input<string>;
        }
        /**
         * Details when multiple steps are run with the same configuration as a group.
         */
        interface MultiStep {
            /**
             * Unique int given to each step. Ranges from 0(inclusive) to total number of steps(exclusive). The primary step is 0.
             */
            multistepNumber?: pulumi.Input<number>;
            /**
             * Present if it is a primary (original) step.
             */
            primaryStep?: pulumi.Input<inputs.toolresults.v1beta3.PrimaryStep>;
            /**
             * Step Id of the primary (original) step, which might be this step.
             */
            primaryStepId?: pulumi.Input<string>;
        }
        /**
         * Interprets a result so that humans and machines can act on it.
         */
        interface Outcome {
            /**
             * More information about a FAILURE outcome. Returns INVALID_ARGUMENT if this field is set but the summary is not FAILURE. Optional
             */
            failureDetail?: pulumi.Input<inputs.toolresults.v1beta3.FailureDetail>;
            /**
             * More information about an INCONCLUSIVE outcome. Returns INVALID_ARGUMENT if this field is set but the summary is not INCONCLUSIVE. Optional
             */
            inconclusiveDetail?: pulumi.Input<inputs.toolresults.v1beta3.InconclusiveDetail>;
            /**
             * More information about a SKIPPED outcome. Returns INVALID_ARGUMENT if this field is set but the summary is not SKIPPED. Optional
             */
            skippedDetail?: pulumi.Input<inputs.toolresults.v1beta3.SkippedDetail>;
            /**
             * More information about a SUCCESS outcome. Returns INVALID_ARGUMENT if this field is set but the summary is not SUCCESS. Optional
             */
            successDetail?: pulumi.Input<inputs.toolresults.v1beta3.SuccessDetail>;
            /**
             * The simplest way to interpret a result. Required
             */
            summary?: pulumi.Input<string>;
        }
        /**
         * Encapsulates performance environment info
         */
        interface PerfEnvironment {
            /**
             * CPU related environment info
             */
            cpuInfo?: pulumi.Input<inputs.toolresults.v1beta3.CPUInfo>;
            /**
             * Memory related environment info
             */
            memoryInfo?: pulumi.Input<inputs.toolresults.v1beta3.MemoryInfo>;
        }
        /**
         * Stores rollup test status of multiple steps that were run as a group and outcome of each individual step.
         */
        interface PrimaryStep {
            /**
             * Step Id and outcome of each individual step.
             */
            individualOutcome?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.IndividualOutcome>[]>;
            /**
             * Rollup test status of multiple steps that were run with the same configuration as a group.
             */
            rollUp?: pulumi.Input<string>;
        }
        /**
         * Details for an outcome with a SKIPPED outcome summary.
         */
        interface SkippedDetail {
            /**
             * If the App doesn't support the specific API level.
             */
            incompatibleAppVersion?: pulumi.Input<boolean>;
            /**
             * If the App doesn't run on the specific architecture, for example, x86.
             */
            incompatibleArchitecture?: pulumi.Input<boolean>;
            /**
             * If the requested OS version doesn't run on the specific device model.
             */
            incompatibleDevice?: pulumi.Input<boolean>;
        }
        /**
         * The details about how to run the execution.
         */
        interface Specification {
            /**
             * An Android mobile test execution specification.
             */
            androidTest?: pulumi.Input<inputs.toolresults.v1beta3.AndroidTest>;
            /**
             * An iOS mobile test execution specification.
             */
            iosTest?: pulumi.Input<inputs.toolresults.v1beta3.IosTest>;
        }
        /**
         * A stacktrace.
         */
        interface StackTrace {
            /**
             * The stack trace message. Required
             */
            exception?: pulumi.Input<string>;
        }
        interface StepDimensionValueEntry {
            key?: pulumi.Input<string>;
            value?: pulumi.Input<string>;
        }
        interface StepLabelsEntry {
            key?: pulumi.Input<string>;
            value?: pulumi.Input<string>;
        }
        /**
         * Details for an outcome with a SUCCESS outcome summary. LINT.IfChange
         */
        interface SuccessDetail {
            /**
             * If a native process other than the app crashed.
             */
            otherNativeCrash?: pulumi.Input<boolean>;
        }
        /**
         * A reference to a test case. Test case references are canonically ordered lexicographically by these three factors: * First, by test_suite_name. * Second, by class_name. * Third, by name.
         */
        interface TestCaseReference {
            /**
             * The name of the class.
             */
            className?: pulumi.Input<string>;
            /**
             * The name of the test case. Required.
             */
            name?: pulumi.Input<string>;
            /**
             * The name of the test suite to which this test case belongs.
             */
            testSuiteName?: pulumi.Input<string>;
        }
        /**
         * A step that represents running tests. It accepts ant-junit xml files which will be parsed into structured test results by the service. Xml file paths are updated in order to append more files, however they can't be deleted. Users can also add test results manually by using the test_result field.
         */
        interface TestExecutionStep {
            /**
             * Issues observed during the test execution. For example, if the mobile app under test crashed during the test, the error message and the stack trace content can be recorded here to assist debugging. - In response: present if set by create or update - In create/update request: optional
             */
            testIssues?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.TestIssue>[]>;
            /**
             * List of test suite overview contents. This could be parsed from xUnit XML log by server, or uploaded directly by user. This references should only be called when test suites are fully parsed or uploaded. The maximum allowed number of test suite overviews per step is 1000. - In response: always set - In create request: optional - In update request: never (use publishXunitXmlFiles custom method instead)
             */
            testSuiteOverviews?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.TestSuiteOverview>[]>;
            /**
             * The timing break down of the test execution. - In response: present if set by create or update - In create/update request: optional
             */
            testTiming?: pulumi.Input<inputs.toolresults.v1beta3.TestTiming>;
            /**
             * Represents the execution of the test runner. The exit code of this tool will be used to determine if the test passed. - In response: always set - In create/update request: optional
             */
            toolExecution?: pulumi.Input<inputs.toolresults.v1beta3.ToolExecution>;
        }
        /**
         * An issue detected occurring during a test execution.
         */
        interface TestIssue {
            /**
             * Category of issue. Required.
             */
            category?: pulumi.Input<string>;
            /**
             * A brief human-readable message describing the issue. Required.
             */
            errorMessage?: pulumi.Input<string>;
            /**
             * Severity of issue. Required.
             */
            severity?: pulumi.Input<string>;
            /**
             * Deprecated in favor of stack trace fields inside specific warnings.
             */
            stackTrace?: pulumi.Input<inputs.toolresults.v1beta3.StackTrace>;
            /**
             * Type of issue. Required.
             */
            type?: pulumi.Input<string>;
            /**
             * Warning message with additional details of the issue. Should always be a message from com.google.devtools.toolresults.v1.warnings
             */
            warning?: pulumi.Input<inputs.toolresults.v1beta3.Any>;
        }
        /**
         * A summary of a test suite result either parsed from XML or uploaded directly by a user. Note: the API related comments are for StepService only. This message is also being used in ExecutionService in a read only mode for the corresponding step.
         */
        interface TestSuiteOverview {
            /**
             * Elapsed time of test suite.
             */
            elapsedTime?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
            /**
             * Number of test cases in error, typically set by the service by parsing the xml_source. - In create/response: always set - In update request: never
             */
            errorCount?: pulumi.Input<number>;
            /**
             * Number of failed test cases, typically set by the service by parsing the xml_source. May also be set by the user. - In create/response: always set - In update request: never
             */
            failureCount?: pulumi.Input<number>;
            /**
             * Number of flaky test cases, set by the service by rolling up flaky test attempts. Present only for rollup test suite overview at environment level. A step cannot have flaky test cases.
             */
            flakyCount?: pulumi.Input<number>;
            /**
             * The name of the test suite. - In create/response: always set - In update request: never
             */
            name?: pulumi.Input<string>;
            /**
             * Number of test cases not run, typically set by the service by parsing the xml_source. - In create/response: always set - In update request: never
             */
            skippedCount?: pulumi.Input<number>;
            /**
             * Number of test cases, typically set by the service by parsing the xml_source. - In create/response: always set - In update request: never
             */
            totalCount?: pulumi.Input<number>;
            /**
             * If this test suite was parsed from XML, this is the URI where the original XML file is stored. Note: Multiple test suites can share the same xml_source Returns INVALID_ARGUMENT if the uri format is not supported. - In create/response: optional - In update request: never
             */
            xmlSource?: pulumi.Input<inputs.toolresults.v1beta3.FileReference>;
        }
        /**
         * Testing timing break down to know phases.
         */
        interface TestTiming {
            /**
             * How long it took to run the test process. - In response: present if previously set. - In create/update request: optional
             */
            testProcessDuration?: pulumi.Input<inputs.toolresults.v1beta3.Duration>;
        }
        /**
         * A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
         */
        interface Timestamp {
            /**
             * Non-negative fractions of a second at nanosecond resolution. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be from 0 to 999,999,999 inclusive.
             */
            nanos?: pulumi.Input<number>;
            /**
             * Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.
             */
            seconds?: pulumi.Input<string>;
        }
        /**
         * An execution of an arbitrary tool. It could be a test runner or a tool copying artifacts or deploying code.
         */
        interface ToolExecution {
            /**
             * The full tokenized command line including the program name (equivalent to argv in a C program). - In response: present if set by create request - In create request: optional - In update request: never set
             */
            commandLineArguments?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Tool execution exit code. This field will be set once the tool has exited. - In response: present if set by create/update request - In create request: optional - In update request: optional, a FAILED_PRECONDITION error will be returned if an exit_code is already set.
             */
            exitCode?: pulumi.Input<inputs.toolresults.v1beta3.ToolExitCode>;
            /**
             * References to any plain text logs output the tool execution. This field can be set before the tool has exited in order to be able to have access to a live view of the logs while the tool is running. The maximum allowed number of tool logs per step is 1000. - In response: present if set by create/update request - In create request: optional - In update request: optional, any value provided will be appended to the existing list
             */
            toolLogs?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.FileReference>[]>;
            /**
             * References to opaque files of any format output by the tool execution. The maximum allowed number of tool outputs per step is 1000. - In response: present if set by create/update request - In create request: optional - In update request: optional, any value provided will be appended to the existing list
             */
            toolOutputs?: pulumi.Input<pulumi.Input<inputs.toolresults.v1beta3.ToolOutputReference>[]>;
        }
        /**
         * Generic tool step to be used for binaries we do not explicitly support. For example: running cp to copy artifacts from one location to another.
         */
        interface ToolExecutionStep {
            /**
             * A Tool execution. - In response: present if set by create/update request - In create/update request: optional
             */
            toolExecution?: pulumi.Input<inputs.toolresults.v1beta3.ToolExecution>;
        }
        /**
         * Exit code from a tool execution.
         */
        interface ToolExitCode {
            /**
             * Tool execution exit code. A value of 0 means that the execution was successful. - In response: always set - In create/update request: always set
             */
            number?: pulumi.Input<number>;
        }
        /**
         * A reference to a ToolExecution output file.
         */
        interface ToolOutputReference {
            /**
             * The creation time of the file. - In response: present if set by create/update request - In create/update request: optional
             */
            creationTime?: pulumi.Input<inputs.toolresults.v1beta3.Timestamp>;
            /**
             * A FileReference to an output file. - In response: always set - In create/update request: always set
             */
            output?: pulumi.Input<inputs.toolresults.v1beta3.FileReference>;
            /**
             * The test case to which this output file belongs. - In response: present if set by create/update request - In create/update request: optional
             */
            testCase?: pulumi.Input<inputs.toolresults.v1beta3.TestCaseReference>;
        }
    }
}
export declare namespace tpu {
    namespace v1 {
        /**
         * Sets the scheduling options for this node.
         */
        interface SchedulingConfig {
            /**
             * Defines whether the node is preemptible.
             */
            preemptible?: pulumi.Input<boolean>;
            /**
             * Whether the node is created under a reservation.
             */
            reserved?: pulumi.Input<boolean>;
        }
    }
    namespace v1alpha1 {
        /**
         * Sets the scheduling options for this node.
         */
        interface SchedulingConfig {
            /**
             * Defines whether the node is preemptible.
             */
            preemptible?: pulumi.Input<boolean>;
            /**
             * Whether the node is created under a reservation.
             */
            reserved?: pulumi.Input<boolean>;
        }
    }
}
export declare namespace transcoder {
    namespace v1beta1 {
        /**
         * Ad break.
         */
        interface AdBreak {
            /**
             * Start time in seconds for the ad break, relative to the output file timeline. The default is `0s`.
             */
            startTimeOffset?: pulumi.Input<string>;
        }
        /**
         * Configuration for AES-128 encryption.
         */
        interface Aes128Encryption {
            /**
             * Required. URI of the key delivery service. This URI is inserted into the M3U8 header.
             */
            keyUri?: pulumi.Input<string>;
        }
        /**
         * Animation types.
         */
        interface Animation {
            /**
             * End previous animation.
             */
            animationEnd?: pulumi.Input<inputs.transcoder.v1beta1.AnimationEnd>;
            /**
             * Display overlay object with fade animation.
             */
            animationFade?: pulumi.Input<inputs.transcoder.v1beta1.AnimationFade>;
            /**
             * Display static overlay object.
             */
            animationStatic?: pulumi.Input<inputs.transcoder.v1beta1.AnimationStatic>;
        }
        /**
         * End previous overlay animation from the video. Without AnimationEnd, the overlay object will keep the state of previous animation until the end of the video.
         */
        interface AnimationEnd {
            /**
             * The time to end overlay object, in seconds. Default: 0
             */
            startTimeOffset?: pulumi.Input<string>;
        }
        /**
         * Display overlay object with fade animation.
         */
        interface AnimationFade {
            /**
             * The time to end the fade animation, in seconds. Default: `start_time_offset` + 1s
             */
            endTimeOffset?: pulumi.Input<string>;
            /**
             * Required. Type of fade animation: `FADE_IN` or `FADE_OUT`.
             */
            fadeType?: pulumi.Input<string>;
            /**
             * The time to start the fade animation, in seconds. Default: 0
             */
            startTimeOffset?: pulumi.Input<string>;
            /**
             * Normalized coordinates based on output video resolution. Valid values: `0.0`–`1.0`. `xy` is the upper-left coordinate of the overlay object. For example, use the x and y coordinates {0,0} to position the top-left corner of the overlay animation in the top-left corner of the output video.
             */
            xy?: pulumi.Input<inputs.transcoder.v1beta1.NormalizedCoordinate>;
        }
        /**
         * Display static overlay object.
         */
        interface AnimationStatic {
            /**
             * The time to start displaying the overlay object, in seconds. Default: 0
             */
            startTimeOffset?: pulumi.Input<string>;
            /**
             * Normalized coordinates based on output video resolution. Valid values: `0.0`–`1.0`. `xy` is the upper-left coordinate of the overlay object. For example, use the x and y coordinates {0,0} to position the top-left corner of the overlay animation in the top-left corner of the output video.
             */
            xy?: pulumi.Input<inputs.transcoder.v1beta1.NormalizedCoordinate>;
        }
        /**
         * Audio preprocessing configuration.
         */
        interface Audio {
            /**
             * Enable boosting high frequency components. The default is `false`.
             */
            highBoost?: pulumi.Input<boolean>;
            /**
             * Enable boosting low frequency components. The default is `false`.
             */
            lowBoost?: pulumi.Input<boolean>;
            /**
             * Specify audio loudness normalization in loudness units relative to full scale (LUFS). Enter a value between -24 and 0 (the default), where: * -24 is the Advanced Television Systems Committee (ATSC A/85) standard * -23 is the EU R128 broadcast standard * -19 is the prior standard for online mono audio * -18 is the ReplayGain standard * -16 is the prior standard for stereo audio * -14 is the new online audio standard recommended by Spotify, as well as Amazon Echo * 0 disables normalization
             */
            lufs?: pulumi.Input<number>;
        }
        /**
         * The mapping for the `Job.edit_list` atoms with audio `EditAtom.inputs`.
         */
        interface AudioAtom {
            /**
             * List of `Channel`s for this audio stream. for in-depth explanation.
             */
            channels?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.AudioChannel>[]>;
            /**
             * Required. The `EditAtom.key` that references the atom with audio inputs in the `Job.edit_list`.
             */
            key?: pulumi.Input<string>;
        }
        /**
         * The audio channel.
         */
        interface AudioChannel {
            /**
             * List of `Job.inputs` for this audio channel.
             */
            inputs?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.AudioChannelInput>[]>;
        }
        /**
         * Identifies which input file, track, and channel should be used.
         */
        interface AudioChannelInput {
            /**
             * Required. The zero-based index of the channel in the input file.
             */
            channel?: pulumi.Input<number>;
            /**
             * Audio volume control in dB. Negative values decrease volume, positive values increase. The default is 0.
             */
            gainDb?: pulumi.Input<number>;
            /**
             * Required. The `Input.key` that identifies the input file.
             */
            key?: pulumi.Input<string>;
            /**
             * Required. The zero-based index of the track in the input file.
             */
            track?: pulumi.Input<number>;
        }
        /**
         * Audio stream resource.
         */
        interface AudioStream {
            /**
             * Required. Audio bitrate in bits per second. Must be between 1 and 10,000,000.
             */
            bitrateBps?: pulumi.Input<number>;
            /**
             * Number of audio channels. Must be between 1 and 6. The default is 2.
             */
            channelCount?: pulumi.Input<number>;
            /**
             * A list of channel names specifying layout of the audio channels. This only affects the metadata embedded in the container headers, if supported by the specified format. The default is `["fl", "fr"]`. Supported channel names: - 'fl' - Front left channel - 'fr' - Front right channel - 'sl' - Side left channel - 'sr' - Side right channel - 'fc' - Front center channel - 'lfe' - Low frequency
             */
            channelLayout?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * The codec for this audio stream. The default is `"aac"`. Supported audio codecs: - 'aac' - 'aac-he' - 'aac-he-v2' - 'mp3' - 'ac3' - 'eac3'
             */
            codec?: pulumi.Input<string>;
            /**
             * The mapping for the `Job.edit_list` atoms with audio `EditAtom.inputs`.
             */
            mapping?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.AudioAtom>[]>;
            /**
             * The audio sample rate in Hertz. The default is 48000 Hertz.
             */
            sampleRateHertz?: pulumi.Input<number>;
        }
        /**
         * Color preprocessing configuration.
         */
        interface Color {
            /**
             * Control brightness of the video. Enter a value between -1 and 1, where -1 is minimum brightness and 1 is maximum brightness. 0 is no change. The default is 0.
             */
            brightness?: pulumi.Input<number>;
            /**
             * Control black and white contrast of the video. Enter a value between -1 and 1, where -1 is minimum contrast and 1 is maximum contrast. 0 is no change. The default is 0.
             */
            contrast?: pulumi.Input<number>;
            /**
             * Control color saturation of the video. Enter a value between -1 and 1, where -1 is fully desaturated and 1 is maximum saturation. 0 is no change. The default is 0.
             */
            saturation?: pulumi.Input<number>;
        }
        /**
         * Video cropping configuration for the input video. The cropped input video is scaled to match the output resolution.
         */
        interface Crop {
            /**
             * The number of pixels to crop from the bottom. The default is 0.
             */
            bottomPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to crop from the left. The default is 0.
             */
            leftPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to crop from the right. The default is 0.
             */
            rightPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to crop from the top. The default is 0.
             */
            topPixels?: pulumi.Input<number>;
        }
        /**
         * Deblock preprocessing configuration.
         */
        interface Deblock {
            /**
             * Enable deblocker. The default is `false`.
             */
            enabled?: pulumi.Input<boolean>;
            /**
             * Set strength of the deblocker. Enter a value between 0 and 1. The higher the value, the stronger the block removal. 0 is no deblocking. The default is 0.
             */
            strength?: pulumi.Input<number>;
        }
        /**
         * Denoise preprocessing configuration.
         */
        interface Denoise {
            /**
             * Set strength of the denoise. Enter a value between 0 and 1. The higher the value, the smoother the image. 0 is no denoising. The default is 0.
             */
            strength?: pulumi.Input<number>;
            /**
             * Set the denoiser mode. The default is `"standard"`. Supported denoiser modes: - 'standard' - 'grain'
             */
            tune?: pulumi.Input<string>;
        }
        /**
         * Edit atom.
         */
        interface EditAtom {
            /**
             * End time in seconds for the atom, relative to the input file timeline. When `end_time_offset` is not specified, the `inputs` are used until the end of the atom.
             */
            endTimeOffset?: pulumi.Input<string>;
            /**
             * List of `Input.key`s identifying files that should be used in this atom. The listed `inputs` must have the same timeline.
             */
            inputs?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * A unique key for this atom. Must be specified when using advanced mapping.
             */
            key?: pulumi.Input<string>;
            /**
             * Start time in seconds for the atom, relative to the input file timeline. The default is `0s`.
             */
            startTimeOffset?: pulumi.Input<string>;
        }
        /**
         * Encoding of an input file such as an audio, video, or text track. Elementary streams must be packaged before mapping and sharing between different output formats.
         */
        interface ElementaryStream {
            /**
             * Encoding of an audio stream.
             */
            audioStream?: pulumi.Input<inputs.transcoder.v1beta1.AudioStream>;
            /**
             * A unique key for this elementary stream.
             */
            key?: pulumi.Input<string>;
            /**
             * Encoding of a text stream. For example, closed captions or subtitles.
             */
            textStream?: pulumi.Input<inputs.transcoder.v1beta1.TextStream>;
            /**
             * Encoding of a video stream.
             */
            videoStream?: pulumi.Input<inputs.transcoder.v1beta1.VideoStream>;
        }
        /**
         * Encryption settings.
         */
        interface Encryption {
            /**
             * Configuration for AES-128 encryption.
             */
            aes128?: pulumi.Input<inputs.transcoder.v1beta1.Aes128Encryption>;
            /**
             * Required. 128 bit Initialization Vector (IV) represented as lowercase hexadecimal digits.
             */
            iv?: pulumi.Input<string>;
            /**
             * Required. 128 bit encryption key represented as lowercase hexadecimal digits.
             */
            key?: pulumi.Input<string>;
            /**
             * Configuration for MPEG Common Encryption (MPEG-CENC).
             */
            mpegCenc?: pulumi.Input<inputs.transcoder.v1beta1.MpegCommonEncryption>;
            /**
             * Configuration for SAMPLE-AES encryption.
             */
            sampleAes?: pulumi.Input<inputs.transcoder.v1beta1.SampleAesEncryption>;
        }
        /**
         * Overlaid jpeg image.
         */
        interface Image {
            /**
             * Target image opacity. Valid values: `1.0` (solid, default) to `0.0` (transparent).
             */
            alpha?: pulumi.Input<number>;
            /**
             * Normalized image resolution, based on output video resolution. Valid values: `0.0`–`1.0`. To respect the original image aspect ratio, set either `x` or `y` to `0.0`. To use the original image resolution, set both `x` and `y` to `0.0`.
             */
            resolution?: pulumi.Input<inputs.transcoder.v1beta1.NormalizedCoordinate>;
            /**
             * Required. URI of the JPEG image in Cloud Storage. For example, `gs://bucket/inputs/image.jpeg`. JPEG is the only supported image type.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Input asset.
         */
        interface Input {
            /**
             * A unique key for this input. Must be specified when using advanced mapping and edit lists.
             */
            key?: pulumi.Input<string>;
            /**
             * Preprocessing configurations.
             */
            preprocessingConfig?: pulumi.Input<inputs.transcoder.v1beta1.PreprocessingConfig>;
            /**
             * URI of the media. Input files must be at least 5 seconds in duration and stored in Cloud Storage (for example, `gs://bucket/inputs/file.mp4`). If empty, the value will be populated from `Job.input_uri`.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Job configuration
         */
        interface JobConfig {
            /**
             * List of ad breaks. Specifies where to insert ad break tags in the output manifests.
             */
            adBreaks?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.AdBreak>[]>;
            /**
             * List of `Edit atom`s. Defines the ultimate timeline of the resulting file or manifest.
             */
            editList?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.EditAtom>[]>;
            /**
             * List of elementary streams.
             */
            elementaryStreams?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.ElementaryStream>[]>;
            /**
             * List of input assets stored in Cloud Storage.
             */
            inputs?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.Input>[]>;
            /**
             * List of output manifests.
             */
            manifests?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.Manifest>[]>;
            /**
             * List of multiplexing settings for output streams.
             */
            muxStreams?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.MuxStream>[]>;
            /**
             * Output configuration.
             */
            output?: pulumi.Input<inputs.transcoder.v1beta1.Output>;
            /**
             * List of overlays on the output video, in descending Z-order.
             */
            overlays?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.Overlay>[]>;
            /**
             * Destination on Pub/Sub.
             */
            pubsubDestination?: pulumi.Input<inputs.transcoder.v1beta1.PubsubDestination>;
            /**
             * List of output sprite sheets.
             */
            spriteSheets?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.SpriteSheet>[]>;
        }
        /**
         * Manifest configuration.
         */
        interface Manifest {
            /**
             * The name of the generated file. The default is `"manifest"` with the extension suffix corresponding to the `Manifest.type`.
             */
            fileName?: pulumi.Input<string>;
            /**
             * Required. List of user given `MuxStream.key`s that should appear in this manifest. When `Manifest.type` is `HLS`, a media manifest with name `MuxStream.key` and `.m3u8` extension is generated for each element of the `Manifest.mux_streams`.
             */
            muxStreams?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Required. Type of the manifest, can be "HLS" or "DASH".
             */
            type?: pulumi.Input<string>;
        }
        /**
         * Configuration for MPEG Common Encryption (MPEG-CENC).
         */
        interface MpegCommonEncryption {
            /**
             * Required. 128 bit Key ID represented as lowercase hexadecimal digits for use with common encryption.
             */
            keyId?: pulumi.Input<string>;
            /**
             * Required. Specify the encryption scheme. Supported encryption schemes: - 'cenc' - 'cbcs'
             */
            scheme?: pulumi.Input<string>;
        }
        /**
         * Multiplexing settings for output stream.
         */
        interface MuxStream {
            /**
             * The container format. The default is `"mp4"` Supported container formats: - 'ts' - 'fmp4'- the corresponding file extension is `".m4s"` - 'mp4' - 'vtt'
             */
            container?: pulumi.Input<string>;
            /**
             * List of `ElementaryStream.key`s multiplexed in this stream.
             */
            elementaryStreams?: pulumi.Input<pulumi.Input<string>[]>;
            /**
             * Encryption settings.
             */
            encryption?: pulumi.Input<inputs.transcoder.v1beta1.Encryption>;
            /**
             * The name of the generated file. The default is `MuxStream.key` with the extension suffix corresponding to the `MuxStream.container`. Individual segments also have an incremental 10-digit zero-padded suffix starting from 0 before the extension, such as `"mux_stream0000000123.ts"`.
             */
            fileName?: pulumi.Input<string>;
            /**
             * A unique key for this multiplexed stream. HLS media manifests will be named `MuxStream.key` with the `".m3u8"` extension suffix.
             */
            key?: pulumi.Input<string>;
            /**
             * Segment settings for `"ts"`, `"fmp4"` and `"vtt"`.
             */
            segmentSettings?: pulumi.Input<inputs.transcoder.v1beta1.SegmentSettings>;
        }
        /**
         * 2D normalized coordinates. Default: `{0.0, 0.0}`
         */
        interface NormalizedCoordinate {
            /**
             * Normalized x coordinate.
             */
            x?: pulumi.Input<number>;
            /**
             * Normalized y coordinate.
             */
            y?: pulumi.Input<number>;
        }
        /**
         * Location of output file(s) in a Cloud Storage bucket.
         */
        interface Output {
            /**
             * URI for the output file(s). For example, `gs://my-bucket/outputs/`. If empty the value is populated from `Job.output_uri`.
             */
            uri?: pulumi.Input<string>;
        }
        /**
         * Overlay configuration.
         */
        interface Overlay {
            /**
             * List of Animations. The list should be chronological, without any time overlap.
             */
            animations?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.Animation>[]>;
            /**
             * Image overlay.
             */
            image?: pulumi.Input<inputs.transcoder.v1beta1.Image>;
        }
        /**
         * Pad filter configuration for the input video. The padded input video is scaled after padding with black to match the output resolution.
         */
        interface Pad {
            /**
             * The number of pixels to add to the bottom. The default is 0.
             */
            bottomPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to add to the left. The default is 0.
             */
            leftPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to add to the right. The default is 0.
             */
            rightPixels?: pulumi.Input<number>;
            /**
             * The number of pixels to add to the top. The default is 0.
             */
            topPixels?: pulumi.Input<number>;
        }
        /**
         * Preprocessing configurations.
         */
        interface PreprocessingConfig {
            /**
             * Audio preprocessing configuration.
             */
            audio?: pulumi.Input<inputs.transcoder.v1beta1.Audio>;
            /**
             * Color preprocessing configuration.
             */
            color?: pulumi.Input<inputs.transcoder.v1beta1.Color>;
            /**
             * Specify the video cropping configuration.
             */
            crop?: pulumi.Input<inputs.transcoder.v1beta1.Crop>;
            /**
             * Deblock preprocessing configuration.
             */
            deblock?: pulumi.Input<inputs.transcoder.v1beta1.Deblock>;
            /**
             * Denoise preprocessing configuration.
             */
            denoise?: pulumi.Input<inputs.transcoder.v1beta1.Denoise>;
            /**
             * Specify the video pad filter configuration.
             */
            pad?: pulumi.Input<inputs.transcoder.v1beta1.Pad>;
        }
        /**
         * A Pub/Sub destination.
         */
        interface PubsubDestination {
            /**
             * The name of the Pub/Sub topic to publish job completion notification to. For example: `projects/{project}/topics/{topic}`.
             */
            topic?: pulumi.Input<string>;
        }
        /**
         * Configuration for SAMPLE-AES encryption.
         */
        interface SampleAesEncryption {
            /**
             * Required. URI of the key delivery service. This URI is inserted into the M3U8 header.
             */
            keyUri?: pulumi.Input<string>;
        }
        /**
         * Segment settings for `"ts"`, `"fmp4"` and `"vtt"`.
         */
        interface SegmentSettings {
            /**
             * Required. Create an individual segment file. The default is `false`.
             */
            individualSegments?: pulumi.Input<boolean>;
            /**
             * Duration of the segments in seconds. The default is `"6.0s"`. Note that `segmentDuration` must be greater than or equal to [`gopDuration`](#videostream), and `segmentDuration` must be divisible by [`gopDuration`](#videostream).
             */
            segmentDuration?: pulumi.Input<string>;
        }
        /**
         * Sprite sheet configuration.
         */
        interface SpriteSheet {
            /**
             * The maximum number of sprites per row in a sprite sheet. The default is 0, which indicates no maximum limit.
             */
            columnCount?: pulumi.Input<number>;
            /**
             * End time in seconds, relative to the output file timeline. When `end_time_offset` is not specified, the sprites are generated until the end of the output file.
             */
            endTimeOffset?: pulumi.Input<string>;
            /**
             * Required. File name prefix for the generated sprite sheets. Each sprite sheet has an incremental 10-digit zero-padded suffix starting from 0 before the extension, such as `"sprite_sheet0000000123.jpeg"`.
             */
            filePrefix?: pulumi.Input<string>;
            /**
             * Format type. The default is `"jpeg"`. Supported formats: - 'jpeg'
             */
            format?: pulumi.Input<string>;
            /**
             * Starting from `0s`, create sprites at regular intervals. Specify the interval value in seconds.
             */
            interval?: pulumi.Input<string>;
            /**
             * The quality of the generated sprite sheet. Enter a value between 1 and 100, where 1 is the lowest quality and 100 is the highest quality. The default is 100. A high quality value corresponds to a low image data compression ratio.
             */
            quality?: pulumi.Input<number>;
            /**
             * The maximum number of rows per sprite sheet. When the sprite sheet is full, a new sprite sheet is created. The default is 0, which indicates no maximum limit.
             */
            rowCount?: pulumi.Input<number>;
            /**
             * Required. The height of sprite in pixels. Must be an even integer. To preserve the source aspect ratio, set the SpriteSheet.sprite_height_pixels field or the SpriteSheet.sprite_width_pixels field, but not both (the API will automatically calculate the missing field).
             */
            spriteHeightPixels?: pulumi.Input<number>;
            /**
             * Required. The width of sprite in pixels. Must be an even integer. To preserve the source aspect ratio, set the SpriteSheet.sprite_width_pixels field or the SpriteSheet.sprite_height_pixels field, but not both (the API will automatically calculate the missing field).
             */
            spriteWidthPixels?: pulumi.Input<number>;
            /**
             * Start time in seconds, relative to the output file timeline. Determines the first sprite to pick. The default is `0s`.
             */
            startTimeOffset?: pulumi.Input<string>;
            /**
             * Total number of sprites. Create the specified number of sprites distributed evenly across the timeline of the output media. The default is 100.
             */
            totalCount?: pulumi.Input<number>;
        }
        /**
         * The mapping for the `Job.edit_list` atoms with text `EditAtom.inputs`.
         */
        interface TextAtom {
            /**
             * List of `Job.inputs` that should be embedded in this atom. Only one input is supported.
             */
            inputs?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.TextInput>[]>;
            /**
             * Required. The `EditAtom.key` that references atom with text inputs in the `Job.edit_list`.
             */
            key?: pulumi.Input<string>;
        }
        /**
         * Identifies which input file and track should be used.
         */
        interface TextInput {
            /**
             * Required. The `Input.key` that identifies the input file.
             */
            key?: pulumi.Input<string>;
            /**
             * Required. The zero-based index of the track in the input file.
             */
            track?: pulumi.Input<number>;
        }
        /**
         * Encoding of a text stream. For example, closed captions or subtitles.
         */
        interface TextStream {
            /**
             * The codec for this text stream. The default is `"webvtt"`. Supported text codecs: - 'srt' - 'ttml' - 'cea608' - 'cea708' - 'webvtt'
             */
            codec?: pulumi.Input<string>;
            /**
             * Required. The BCP-47 language code, such as `"en-US"` or `"sr-Latn"`. For more information, see https://www.unicode.org/reports/tr35/#Unicode_locale_identifier.
             */
            languageCode?: pulumi.Input<string>;
            /**
             * The mapping for the `Job.edit_list` atoms with text `EditAtom.inputs`.
             */
            mapping?: pulumi.Input<pulumi.Input<inputs.transcoder.v1beta1.TextAtom>[]>;
        }
        /**
         * Video stream resource.
         */
        interface VideoStream {
            /**
             * Specifies whether an open Group of Pictures (GOP) structure should be allowed or not. The default is `false`.
             */
            allowOpenGop?: pulumi.Input<boolean>;
            /**
             * Specify the intensity of the adaptive quantizer (AQ). Must be between 0 and 1, where 0 disables the quantizer and 1 maximizes the quantizer. A higher value equals a lower bitrate but smoother image. The default is 0.
             */
            aqStrength?: pulumi.Input<number>;
            /**
             * The number of consecutive B-frames. Must be greater than or equal to zero. Must be less than `VideoStream.gop_frame_count` if set. The default is 0.
             */
            bFrameCount?: pulumi.Input<number>;
            /**
             * Allow B-pyramid for reference frame selection. This may not be supported on all decoders. The default is `false`.
             */
            bPyramid?: pulumi.Input<boolean>;
            /**
             * Required. The video bitrate in bits per second. Must be between 1 and 1,000,000,000.
             */
            bitrateBps?: pulumi.Input<number>;
            /**
             * Codec type. The following codecs are supported: * `h264` (default) * `h265` * `vp9`
             */
            codec?: pulumi.Input<string>;
            /**
             * Target CRF level. Must be between 10 and 36, where 10 is the highest quality and 36 is the most efficient compression. The default is 21.
             */
            crfLevel?: pulumi.Input<number>;
            /**
             * Use two-pass encoding strategy to achieve better video quality. `VideoStream.rate_control_mode` must be `"vbr"`. The default is `false`.
             */
            enableTwoPass?: pulumi.Input<boolean>;
            /**
             * The entropy coder to use. The default is `"cabac"`. Supported entropy coders: - 'cavlc' - 'cabac'
             */
            entropyCoder?: pulumi.Input<string>;
            /**
             * Required. The target video frame rate in frames per second (FPS). Must be less than or equal to 120. Will default to the input frame rate if larger than the input frame rate. The API will generate an output FPS that is divisible by the input FPS, and smaller or equal to the target FPS. The following table shows the computed video FPS given the target FPS (in parenthesis) and input FPS (in the first column): ``` | | (30) | (60) | (25) | (50) | |--------|--------|--------|------|------| | 240 | Fail | Fail | Fail | Fail | | 120 | 30 | 60 | 20 | 30 | | 100 | 25 | 50 | 20 | 30 | | 50 | 25 | 50 | 20 | 30 | | 60 | 30 | 60 | 20 | 30 | | 59.94 | 29.97 | 59.94 | 20 | 30 | | 48 | 24 | 48 | 20 | 30 | | 30 | 30 | 30 | 20 | 30 | | 25 | 25 | 25 | 20 | 30 | | 24 | 24 | 24 | 20 | 30 | | 23.976 | 23.976 | 23.976 | 20 | 30 | | 15 | 15 | 15 | 20 | 30 | | 12 | 12 | 12 | 20 | 30 | | 10 | 10 | 10 | 20 | 30 | ```
             */
            frameRate?: pulumi.Input<number>;
            /**
             * Select the GOP size based on the specified duration. The default is `"3s"`. Note that `gopDuration` must be less than or equal to [`segmentDuration`](#SegmentSettings), and [`segmentDuration`](#SegmentSettings) must be divisible by `gopDuration`.
             */
            gopDuration?: pulumi.Input<string>;
            /**
             * Select the GOP size based on the specified frame count. Must be greater than zero.
             */
            gopFrameCount?: pulumi.Input<number>;
            /**
             * The height of the video in pixels. Must be an even integer. When not specified, the height is adjusted to match the specified width and input aspect ratio. If both are omitted, the input height is used.
             */
            heightPixels?: pulumi.Input<number>;
            /**
             * Pixel format to use. The default is `"yuv420p"`. Supported pixel formats: - 'yuv420p' pixel format. - 'yuv422p' pixel format. - 'yuv444p' pixel format. - 'yuv420p10' 10-bit HDR pixel format. - 'yuv422p10' 10-bit HDR pixel format. - 'yuv444p10' 10-bit HDR pixel format. - 'yuv420p12' 12-bit HDR pixel format. - 'yuv422p12' 12-bit HDR pixel format. - 'yuv444p12' 12-bit HDR pixel format.
             */
            pixelFormat?: pulumi.Input<string>;
            /**
             * Enforces the specified codec preset. The default is `veryfast`. The available options are FFmpeg-compatible. Note that certain values for this field may cause the transcoder to override other fields you set in the `VideoStream` message.
             */
            preset?: pulumi.Input<string>;
            /**
             * Enforces the specified codec profile. The following profiles are supported: * `baseline` * `main` * `high` (default) The available options are FFmpeg-compatible. Note that certain values for this field may cause the transcoder to override other fields you set in the `VideoStream` message.
             */
            profile?: pulumi.Input<string>;
            /**
             * Specify the `rate_control_mode`. The default is `"vbr"`. Supported rate control modes: - 'vbr' - variable bitrate - 'crf' - constant rate factor
             */
            rateControlMode?: pulumi.Input<string>;
            /**
             * Enforces the specified codec tune. The available options are FFmpeg-compatible. Note that certain values for this field may cause the transcoder to override other fields you set in the `VideoStream` message.
             */
            tune?: pulumi.Input<string>;
            /**
             * Initial fullness of the Video Buffering Verifier (VBV) buffer in bits. Must be greater than zero. The default is equal to 90% of `VideoStream.vbv_size_bits`.
             */
            vbvFullnessBits?: pulumi.Input<number>;
            /**
             * Size of the Video Buffering Verifier (VBV) buffer in bits. Must be greater than zero. The default is equal to `VideoStream.bitrate_bps`.
             */
            vbvSizeBits?: pulumi.Input<number>;
            /**
             * The width of the video in pixels. Must be an even integer. When not specified, the width is adjusted to match the specified height and input aspect ratio. If both are omitted, the input width is used.
             */
            widthPixels?: pulumi.Input<number>;
        }
    }
}
export declare namespace translate {
    namespace v3 {
        /**
         * The Google Cloud Storage location for the input content.
         */
        interface GcsSource {
            /**
             * Required. Source data URI. For example, `gs://my_bucket/my_object`.
             */
            inputUri?: pulumi.Input<string>;
        }
        /**
         * Input configuration for glossaries.
         */
        interface GlossaryInputConfig {
            /**
             * Required. Google Cloud Storage location of glossary data. File format is determined based on the filename extension. API returns [google.rpc.Code.INVALID_ARGUMENT] for unsupported URI-s and file formats. Wildcards are not allowed. This must be a single file in one of the following formats: For unidirectional glossaries: - TSV/CSV (`.tsv`/`.csv`): 2 column file, tab- or comma-separated. The first column is source text. The second column is target text. The file must not contain headers. That is, the first row is data, not column names. - TMX (`.tmx`): TMX file with parallel data defining source/target term pairs. For equivalent term sets glossaries: - CSV (`.csv`): Multi-column CSV file defining equivalent glossary terms in multiple languages. See documentation for more information - [glossaries](https://cloud.google.com/translate/docs/advanced/glossary).
             */
            gcsSource?: pulumi.Input<inputs.translate.v3.GcsSource>;
        }
        /**
         * Used with unidirectional glossaries.
         */
        interface LanguageCodePair {
            /**
             * Required. The BCP-47 language code of the input text, for example, "en-US". Expected to be an exact match for GlossaryTerm.language_code.
             */
            sourceLanguageCode?: pulumi.Input<string>;
            /**
             * Required. The BCP-47 language code for translation output, for example, "zh-CN". Expected to be an exact match for GlossaryTerm.language_code.
             */
            targetLanguageCode?: pulumi.Input<string>;
        }
        /**
         * Used with equivalent term set glossaries.
         */
        interface LanguageCodesSet {
            /**
             * The BCP-47 language code(s) for terms defined in the glossary. All entries are unique. The list contains at least two entries. Expected to be an exact match for GlossaryTerm.language_code.
             */
            languageCodes?: pulumi.Input<pulumi.Input<string>[]>;
        }
    }
    namespace v3beta1 {
        /**
         * The Google Cloud Storage location for the input content.
         */
        interface GcsSource {
            /**
             * Required. Source data URI. For example, `gs://my_bucket/my_object`.
             */
            inputUri?: pulumi.Input<string>;
        }
        /**
         * Input configuration for glossaries.
         */
        interface GlossaryInputConfig {
            /**
             * Required. Google Cloud Storage location of glossary data. File format is determined based on the filename extension. API returns [google.rpc.Code.INVALID_ARGUMENT] for unsupported URI-s and file formats. Wildcards are not allowed. This must be a single file in one of the following formats: For unidirectional glossaries: - TSV/CSV (`.tsv`/`.csv`): 2 column file, tab- or comma-separated. The first column is source text. The second column is target text. The file must not contain headers. That is, the first row is data, not column names. - TMX (`.tmx`): TMX file with parallel data defining source/target term pairs. For equivalent term sets glossaries: - CSV (`.csv`): Multi-column CSV file defining equivalent glossary terms in multiple languages. The format is defined for Google Translation Toolkit and documented in [Use a glossary](https://support.google.com/translatortoolkit/answer/6306379?hl=en).
             */
            gcsSource?: pulumi.Input<inputs.translate.v3beta1.GcsSource>;
        }
        /**
         * Used with unidirectional glossaries.
         */
        interface LanguageCodePair {
            /**
             * Required. The BCP-47 language code of the input text, for example, "en-US". Expected to be an exact match for GlossaryTerm.language_code.
             */
            sourceLanguageCode?: pulumi.Input<string>;
            /**
             * Required. The BCP-47 language code for translation output, for example, "zh-CN". Expected to be an exact match for GlossaryTerm.language_code.
             */
            targetLanguageCode?: pulumi.Input<string>;
        }
        /**
         * Used with equivalent term set glossaries.
         */
        interface LanguageCodesSet {
            /**
             * The BCP-47 language code(s) for terms defined in the glossary. All entries are unique. The list contains at least two entries. Expected to be an exact match for GlossaryTerm.language_code.
             */
            languageCodes?: pulumi.Input<pulumi.Input<string>[]>;
        }
    }
}
export declare namespace vision {
    namespace v1 {
        /**
         * A bounding polygon for the detected image annotation.
         */
        interface BoundingPoly {
            /**
             * The bounding polygon normalized vertices.
             */
            normalizedVertices?: pulumi.Input<pulumi.Input<inputs.vision.v1.NormalizedVertex>[]>;
            /**
             * The bounding polygon vertices.
             */
            vertices?: pulumi.Input<pulumi.Input<inputs.vision.v1.Vertex>[]>;
        }
        /**
         * A product label represented as a key-value pair.
         */
        interface KeyValue {
            /**
             * The key of the label attached to the product. Cannot be empty and cannot exceed 128 bytes.
             */
            key?: pulumi.Input<string>;
            /**
             * The value of the label attached to the product. Cannot be empty and cannot exceed 128 bytes.
             */
            value?: pulumi.Input<string>;
        }
        /**
         * A vertex represents a 2D point in the image. NOTE: the normalized vertex coordinates are relative to the original image and range from 0 to 1.
         */
        interface NormalizedVertex {
            /**
             * X coordinate.
             */
            x?: pulumi.Input<number>;
            /**
             * Y coordinate.
             */
            y?: pulumi.Input<number>;
        }
        /**
         * A vertex represents a 2D point in the image. NOTE: the vertex coordinates are in the same scale as the original image.
         */
        interface Vertex {
            /**
             * X coordinate.
             */
            x?: pulumi.Input<number>;
            /**
             * Y coordinate.
             */
            y?: pulumi.Input<number>;
        }
    }
}
export declare namespace vpcaccess {
    namespace v1 {
        /**
         * The subnet in which to house the connector
         */
        interface Subnet {
            /**
             * Subnet name (relative, not fully qualified). E.g. if the full subnet selfLink is https://compute.googleapis.com/compute/v1/projects/{project}/regions/{region}/subnetworks/{subnetName} the correct input for this field would be {subnetName}
             */
            name?: pulumi.Input<string>;
            /**
             * Project in which the subnet exists. If not set, this project is assumed to be the project for which the connector create request was issued.
             */
            projectId?: pulumi.Input<string>;
        }
    }
}
export declare namespace websecurityscanner {
    namespace v1 {
        /**
         * Scan authentication configuration.
         */
        interface Authentication {
            /**
             * Authentication using a custom account.
             */
            customAccount?: pulumi.Input<inputs.websecurityscanner.v1.CustomAccount>;
            /**
             * Authentication using a Google account.
             */
            googleAccount?: pulumi.Input<inputs.websecurityscanner.v1.GoogleAccount>;
            /**
             * Authentication using Identity-Aware-Proxy (IAP).
             */
            iapCredential?: pulumi.Input<inputs.websecurityscanner.v1.IapCredential>;
        }
        /**
         * Describes authentication configuration that uses a custom account.
         */
        interface CustomAccount {
            /**
             * Required. The login form URL of the website.
             */
            loginUrl?: pulumi.Input<string>;
            /**
             * Required. Input only. The password of the custom account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the custom account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Describes authentication configuration that uses a Google account.
         */
        interface GoogleAccount {
            /**
             * Required. Input only. The password of the Google account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the Google account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Describes authentication configuration for Identity-Aware-Proxy (IAP).
         */
        interface IapCredential {
            /**
             * Authentication configuration when Web-Security-Scanner service account is added in Identity-Aware-Proxy (IAP) access policies.
             */
            iapTestServiceAccountInfo?: pulumi.Input<inputs.websecurityscanner.v1.IapTestServiceAccountInfo>;
        }
        /**
         * Describes authentication configuration when Web-Security-Scanner service account is added in Identity-Aware-Proxy (IAP) access policies.
         */
        interface IapTestServiceAccountInfo {
            /**
             * Required. Describes OAuth2 client id of resources protected by Identity-Aware-Proxy (IAP).
             */
            targetAudienceClientId?: pulumi.Input<string>;
        }
        /**
         * Scan schedule configuration.
         */
        interface Schedule {
            /**
             * Required. The duration of time between executions in days.
             */
            intervalDurationDays?: pulumi.Input<number>;
            /**
             * A timestamp indicates when the next run will be scheduled. The value is refreshed by the server after each run. If unspecified, it will default to current server time, which means the scan will be scheduled to start immediately.
             */
            scheduleTime?: pulumi.Input<string>;
        }
    }
    namespace v1alpha {
        /**
         * Scan authentication configuration.
         */
        interface Authentication {
            /**
             * Authentication using a custom account.
             */
            customAccount?: pulumi.Input<inputs.websecurityscanner.v1alpha.CustomAccount>;
            /**
             * Authentication using a Google account.
             */
            googleAccount?: pulumi.Input<inputs.websecurityscanner.v1alpha.GoogleAccount>;
        }
        /**
         * Describes authentication configuration that uses a custom account.
         */
        interface CustomAccount {
            /**
             * Required. The login form URL of the website.
             */
            loginUrl?: pulumi.Input<string>;
            /**
             * Required. Input only. The password of the custom account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the custom account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Describes authentication configuration that uses a Google account.
         */
        interface GoogleAccount {
            /**
             * Required. Input only. The password of the Google account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the Google account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * A ScanRun is a output-only resource representing an actual run of the scan.
         */
        interface ScanRun {
            /**
             * The time at which the ScanRun reached termination state - that the ScanRun is either finished or stopped by user.
             */
            endTime?: pulumi.Input<string>;
            /**
             * The execution state of the ScanRun.
             */
            executionState?: pulumi.Input<string>;
            /**
             * Whether the scan run has found any vulnerabilities.
             */
            hasVulnerabilities?: pulumi.Input<boolean>;
            /**
             * The resource name of the ScanRun. The name follows the format of 'projects/{projectId}/scanConfigs/{scanConfigId}/scanRuns/{scanRunId}'. The ScanRun IDs are generated by the system.
             */
            name?: pulumi.Input<string>;
            /**
             * The percentage of total completion ranging from 0 to 100. If the scan is in queue, the value is 0. If the scan is running, the value ranges from 0 to 100. If the scan is finished, the value is 100.
             */
            progressPercent?: pulumi.Input<number>;
            /**
             * The result state of the ScanRun. This field is only available after the execution state reaches "FINISHED".
             */
            resultState?: pulumi.Input<string>;
            /**
             * The time at which the ScanRun started.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The number of URLs crawled during this ScanRun. If the scan is in progress, the value represents the number of URLs crawled up to now.
             */
            urlsCrawledCount?: pulumi.Input<string>;
            /**
             * The number of URLs tested during this ScanRun. If the scan is in progress, the value represents the number of URLs tested up to now. The number of URLs tested is usually larger than the number URLS crawled because typically a crawled URL is tested with multiple test payloads.
             */
            urlsTestedCount?: pulumi.Input<string>;
        }
        /**
         * Scan schedule configuration.
         */
        interface Schedule {
            /**
             * Required. The duration of time between executions in days.
             */
            intervalDurationDays?: pulumi.Input<number>;
            /**
             * A timestamp indicates when the next run will be scheduled. The value is refreshed by the server after each run. If unspecified, it will default to current server time, which means the scan will be scheduled to start immediately.
             */
            scheduleTime?: pulumi.Input<string>;
        }
    }
    namespace v1beta {
        /**
         * Scan authentication configuration.
         */
        interface Authentication {
            /**
             * Authentication using a custom account.
             */
            customAccount?: pulumi.Input<inputs.websecurityscanner.v1beta.CustomAccount>;
            /**
             * Authentication using a Google account.
             */
            googleAccount?: pulumi.Input<inputs.websecurityscanner.v1beta.GoogleAccount>;
            /**
             * Authentication using Identity-Aware-Proxy (IAP).
             */
            iapCredential?: pulumi.Input<inputs.websecurityscanner.v1beta.IapCredential>;
        }
        /**
         * Describes authentication configuration that uses a custom account.
         */
        interface CustomAccount {
            /**
             * Required. The login form URL of the website.
             */
            loginUrl?: pulumi.Input<string>;
            /**
             * Required. Input only. The password of the custom account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the custom account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Describes authentication configuration that uses a Google account.
         */
        interface GoogleAccount {
            /**
             * Required. Input only. The password of the Google account. The credential is stored encrypted and not returned in any response nor included in audit logs.
             */
            password?: pulumi.Input<string>;
            /**
             * Required. The user name of the Google account.
             */
            username?: pulumi.Input<string>;
        }
        /**
         * Describes authentication configuration for Identity-Aware-Proxy (IAP).
         */
        interface IapCredential {
            /**
             * Authentication configuration when Web-Security-Scanner service account is added in Identity-Aware-Proxy (IAP) access policies.
             */
            iapTestServiceAccountInfo?: pulumi.Input<inputs.websecurityscanner.v1beta.IapTestServiceAccountInfo>;
        }
        /**
         * Describes authentication configuration when Web-Security-Scanner service account is added in Identity-Aware-Proxy (IAP) access policies.
         */
        interface IapTestServiceAccountInfo {
            /**
             * Required. Describes OAuth2 Client ID of resources protected by Identity-Aware-Proxy(IAP).
             */
            targetAudienceClientId?: pulumi.Input<string>;
        }
        /**
         * Defines a custom error message used by CreateScanConfig and UpdateScanConfig APIs when scan configuration validation fails. It is also reported as part of a ScanRunErrorTrace message if scan validation fails due to a scan configuration error.
         */
        interface ScanConfigError {
            /**
             * Indicates the reason code for a configuration failure.
             */
            code?: pulumi.Input<string>;
            /**
             * Indicates the full name of the ScanConfig field that triggers this error, for example "scan_config.max_qps". This field is provided for troubleshooting purposes only and its actual value can change in the future.
             */
            fieldName?: pulumi.Input<string>;
        }
        /**
         * A ScanRun is a output-only resource representing an actual run of the scan. Next id: 12
         */
        interface ScanRun {
            /**
             * The time at which the ScanRun reached termination state - that the ScanRun is either finished or stopped by user.
             */
            endTime?: pulumi.Input<string>;
            /**
             * If result_state is an ERROR, this field provides the primary reason for scan's termination and more details, if such are available.
             */
            errorTrace?: pulumi.Input<inputs.websecurityscanner.v1beta.ScanRunErrorTrace>;
            /**
             * The execution state of the ScanRun.
             */
            executionState?: pulumi.Input<string>;
            /**
             * Whether the scan run has found any vulnerabilities.
             */
            hasVulnerabilities?: pulumi.Input<boolean>;
            /**
             * The resource name of the ScanRun. The name follows the format of 'projects/{projectId}/scanConfigs/{scanConfigId}/scanRuns/{scanRunId}'. The ScanRun IDs are generated by the system.
             */
            name?: pulumi.Input<string>;
            /**
             * The percentage of total completion ranging from 0 to 100. If the scan is in queue, the value is 0. If the scan is running, the value ranges from 0 to 100. If the scan is finished, the value is 100.
             */
            progressPercent?: pulumi.Input<number>;
            /**
             * The result state of the ScanRun. This field is only available after the execution state reaches "FINISHED".
             */
            resultState?: pulumi.Input<string>;
            /**
             * The time at which the ScanRun started.
             */
            startTime?: pulumi.Input<string>;
            /**
             * The number of URLs crawled during this ScanRun. If the scan is in progress, the value represents the number of URLs crawled up to now.
             */
            urlsCrawledCount?: pulumi.Input<string>;
            /**
             * The number of URLs tested during this ScanRun. If the scan is in progress, the value represents the number of URLs tested up to now. The number of URLs tested is usually larger than the number URLS crawled because typically a crawled URL is tested with multiple test payloads.
             */
            urlsTestedCount?: pulumi.Input<string>;
            /**
             * A list of warnings, if such are encountered during this scan run.
             */
            warningTraces?: pulumi.Input<pulumi.Input<inputs.websecurityscanner.v1beta.ScanRunWarningTrace>[]>;
        }
        /**
         * Output only. Defines an error trace message for a ScanRun.
         */
        interface ScanRunErrorTrace {
            /**
             * Indicates the error reason code.
             */
            code?: pulumi.Input<string>;
            /**
             * If the scan encounters TOO_MANY_HTTP_ERRORS, this field indicates the most common HTTP error code, if such is available. For example, if this code is 404, the scan has encountered too many NOT_FOUND responses.
             */
            mostCommonHttpErrorCode?: pulumi.Input<number>;
            /**
             * If the scan encounters SCAN_CONFIG_ISSUE error, this field has the error message encountered during scan configuration validation that is performed before each scan run.
             */
            scanConfigError?: pulumi.Input<inputs.websecurityscanner.v1beta.ScanConfigError>;
        }
        /**
         * Output only. Defines a warning trace message for ScanRun. Warning traces provide customers with useful information that helps make the scanning process more effective.
         */
        interface ScanRunWarningTrace {
            /**
             * Indicates the warning code.
             */
            code?: pulumi.Input<string>;
        }
        /**
         * Scan schedule configuration.
         */
        interface Schedule {
            /**
             * Required. The duration of time between executions in days.
             */
            intervalDurationDays?: pulumi.Input<number>;
            /**
             * A timestamp indicates when the next run will be scheduled. The value is refreshed by the server after each run. If unspecified, it will default to current server time, which means the scan will be scheduled to start immediately.
             */
            scheduleTime?: pulumi.Input<string>;
        }
    }
}
export declare namespace workflowexecutions {
    namespace v1 {
    }
    namespace v1beta {
    }
}