import * as pulumi from "@pulumi/pulumi";
/**
 * Use this resource to link a GCP account to New Relic.
 *
 * ## Prerequisite
 *
 * To start receiving Google Cloud Platform (GCP) data with New Relic GCP integrations, connect your Google project to New Relic infrastructure monitoring. If you don't have one already, create a New Relic account. It's free, forever.
 *
 * Setup is required in GCP for this resource to work properly. The New Relic GCP integration can be done by creating a user account or a service account.
 *
 * A user with Project IAM Admin role is needed to add the service account ID as a member in your GCP project.
 *
 * In the GCP project IAM & admin, the service account must have the Project Viewer role and the Service Usage Consumer role or, alternatively, a custom role.
 *
 * Follow the [steps outlined here](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/get-started/connect-google-cloud-platform-services-new-relic) to set up the integration.
 *
 * ## Example Usage
 *
 * You can also use the full example, including the GCP set up, found in our guides.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as newrelic from "@pulumi/newrelic";
 *
 * const foo = new newrelic.cloud.GcpLinkAccount("foo", {
 *     accountId: "account id of newrelic account",
 *     projectId: "id of the Project",
 *     name: "account name",
 * });
 * ```
 *
 * ### GCP Dimensional Metrics (keyless / WIF) linking
 *
 * To link a GCP project for **GCP Dimensional Metrics** using keyless authentication via Workload Identity Federation (WIF) instead of a service-account key, set `useWorkloadIdentityFederation = true` and provide `audience` and `serviceAccountEmail`. When enabled, the resource authenticates via WIF and links the project as a Dimensional Metrics account. Use this linked account with the `newrelic.cloud.GcpDmIntegrations` resource.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as newrelic from "@pulumi/newrelic";
 *
 * const dm = new newrelic.cloud.GcpLinkAccount("dm", {
 *     accountId: "account id of newrelic account",
 *     name: "account name",
 *     projectId: "id of the Project",
 *     useWorkloadIdentityFederation: true,
 *     audience: "//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/newrelic-wif-pool/providers/newrelic-oidc-provider",
 *     serviceAccountEmail: "newrelic-integration@my-project.iam.gserviceaccount.com",
 * });
 * ```
 *
 * ## Import
 *
 * Linked GCP accounts can be imported using `id`, you can find the `id` of an existing GCP linked accounts in GCP dashboard under Infrastructure in Newrelic Console.
 *
 * ```sh
 *
 *   $ pulumi import newrelic:cloud/gcpLinkAccount:GcpLinkAccount foo <id>
 *
 * ```
 */
export declare class GcpLinkAccount extends pulumi.CustomResource {
    /**
     * Get an existing GcpLinkAccount resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GcpLinkAccountState, opts?: pulumi.CustomResourceOptions): GcpLinkAccount;
    /**
     * Returns true if the given object is an instance of GcpLinkAccount.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is GcpLinkAccount;
    /**
     * Account ID of the New Relic account.
     */
    readonly accountId: pulumi.Output<string>;
    /**
     * The Workload Identity Federation pool provider audience URI. Format: `//iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}`. Required when `useWorkloadIdentityFederation = true`.
     */
    readonly audience: pulumi.Output<string | undefined>;
    /**
     * The name of the GCP account in New Relic.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Project ID of the GCP account.
     */
    readonly projectId: pulumi.Output<string>;
    /**
     * The GCP service account email New Relic impersonates to collect metrics when linking via WIF. The service account must grant the WIF pool the `roles/iam.workloadIdentityUser` binding. Required when `useWorkloadIdentityFederation = true`.
     *
     * > **NOTE:** `audience` and `serviceAccountEmail` are write-only, `ForceNew` fields used to construct the WIF credential internally; they are never returned by the API and are retained from state. When importing a WIF-linked account, also set `useWorkloadIdentityFederation = true` in your configuration (it is not returned by the API and defaults to `false`), and add `audience` and `serviceAccountEmail` to `ImportStateVerifyIgnore` (or run `pulumi up` afterwards to reconcile them).
     *
     * > **WARNING:** Starting with v3.27.2 of the New Relic Terraform Provider, updating any of the aforementioned attributes (except `name`) of a `newrelic.cloud.GcpLinkAccount` resource that has been applied would **force a replacement** of the resource (destruction of the resource, followed by the creation of a new resource). Please carefully review the output of `pulumi preview`, which would clearly indicate a replacement of this resource, before performing a `pulumi up`.
     */
    readonly serviceAccountEmail: pulumi.Output<string | undefined>;
    /**
     * Set to `true` to link the GCP account for **GCP Dimensional Metrics** using keyless Workload Identity Federation (WIF) instead of a service-account key. When `true`, `audience` and `serviceAccountEmail` are required. Defaults to `false` (legacy service-account-key linking).
     */
    readonly useWorkloadIdentityFederation: pulumi.Output<boolean | undefined>;
    /**
     * Create a GcpLinkAccount resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: GcpLinkAccountArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering GcpLinkAccount resources.
 */
export interface GcpLinkAccountState {
    /**
     * Account ID of the New Relic account.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * The Workload Identity Federation pool provider audience URI. Format: `//iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}`. Required when `useWorkloadIdentityFederation = true`.
     */
    audience?: pulumi.Input<string | undefined>;
    /**
     * The name of the GCP account in New Relic.
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * Project ID of the GCP account.
     */
    projectId?: pulumi.Input<string | undefined>;
    /**
     * The GCP service account email New Relic impersonates to collect metrics when linking via WIF. The service account must grant the WIF pool the `roles/iam.workloadIdentityUser` binding. Required when `useWorkloadIdentityFederation = true`.
     *
     * > **NOTE:** `audience` and `serviceAccountEmail` are write-only, `ForceNew` fields used to construct the WIF credential internally; they are never returned by the API and are retained from state. When importing a WIF-linked account, also set `useWorkloadIdentityFederation = true` in your configuration (it is not returned by the API and defaults to `false`), and add `audience` and `serviceAccountEmail` to `ImportStateVerifyIgnore` (or run `pulumi up` afterwards to reconcile them).
     *
     * > **WARNING:** Starting with v3.27.2 of the New Relic Terraform Provider, updating any of the aforementioned attributes (except `name`) of a `newrelic.cloud.GcpLinkAccount` resource that has been applied would **force a replacement** of the resource (destruction of the resource, followed by the creation of a new resource). Please carefully review the output of `pulumi preview`, which would clearly indicate a replacement of this resource, before performing a `pulumi up`.
     */
    serviceAccountEmail?: pulumi.Input<string | undefined>;
    /**
     * Set to `true` to link the GCP account for **GCP Dimensional Metrics** using keyless Workload Identity Federation (WIF) instead of a service-account key. When `true`, `audience` and `serviceAccountEmail` are required. Defaults to `false` (legacy service-account-key linking).
     */
    useWorkloadIdentityFederation?: pulumi.Input<boolean | undefined>;
}
/**
 * The set of arguments for constructing a GcpLinkAccount resource.
 */
export interface GcpLinkAccountArgs {
    /**
     * Account ID of the New Relic account.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * The Workload Identity Federation pool provider audience URI. Format: `//iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}`. Required when `useWorkloadIdentityFederation = true`.
     */
    audience?: pulumi.Input<string | undefined>;
    /**
     * The name of the GCP account in New Relic.
     */
    name?: pulumi.Input<string | undefined>;
    /**
     * Project ID of the GCP account.
     */
    projectId: pulumi.Input<string>;
    /**
     * The GCP service account email New Relic impersonates to collect metrics when linking via WIF. The service account must grant the WIF pool the `roles/iam.workloadIdentityUser` binding. Required when `useWorkloadIdentityFederation = true`.
     *
     * > **NOTE:** `audience` and `serviceAccountEmail` are write-only, `ForceNew` fields used to construct the WIF credential internally; they are never returned by the API and are retained from state. When importing a WIF-linked account, also set `useWorkloadIdentityFederation = true` in your configuration (it is not returned by the API and defaults to `false`), and add `audience` and `serviceAccountEmail` to `ImportStateVerifyIgnore` (or run `pulumi up` afterwards to reconcile them).
     *
     * > **WARNING:** Starting with v3.27.2 of the New Relic Terraform Provider, updating any of the aforementioned attributes (except `name`) of a `newrelic.cloud.GcpLinkAccount` resource that has been applied would **force a replacement** of the resource (destruction of the resource, followed by the creation of a new resource). Please carefully review the output of `pulumi preview`, which would clearly indicate a replacement of this resource, before performing a `pulumi up`.
     */
    serviceAccountEmail?: pulumi.Input<string | undefined>;
    /**
     * Set to `true` to link the GCP account for **GCP Dimensional Metrics** using keyless Workload Identity Federation (WIF) instead of a service-account key. When `true`, `audience` and `serviceAccountEmail` are required. Defaults to `false` (legacy service-account-key linking).
     */
    useWorkloadIdentityFederation?: pulumi.Input<boolean | undefined>;
}
//# sourceMappingURL=gcpLinkAccount.d.ts.map