Skip to content

googleIamWorkforcePool

Represents a collection of external workforces. Provides namespaces for federated users that can be referenced in IAM policies.

To get more information about WorkforcePool, see:

\~> Note: Ask your Google Cloud account team to request access to workforce identity federation for your billing/quota project. The account team notifies you when the project is granted access.

Example Usage - Iam Workforce Pool Basic

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.iamWorkforcePool.IamWorkforcePool(this, "example", {
  location: "global",
  parent: "organizations/123456789",
  workforce_pool_id: "example-pool",
});

Example Usage - Iam Workforce Pool Full

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.iamWorkforcePool.IamWorkforcePool(this, "example", {
  description: "A sample workforce pool.",
  disabled: false,
  display_name: "Display name",
  location: "global",
  parent: "organizations/123456789",
  session_duration: "7200s",
  workforce_pool_id: "example-pool",
});

Argument Reference

The following arguments are supported:

  • location - (Required) The location for the resource.

  • workforcePoolId - (Required) The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix gcp is reserved for use by Google, and may not be specified.

  • parent - (Required) Immutable. The resource name of the parent. Format: organizations/{orgId}.

  • displayName - (Optional) A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.

  • description - (Optional) A user-specified description of the pool. Cannot exceed 256 characters.

  • disabled - (Optional) Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.

  • sessionDuration - (Optional) Duration that the Google Cloud access tokens, console sign-in sessions, and gcloud sign-in sessions from this pool are valid.\ Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If sessionDuration is not configured, minted credentials have a default duration of one hour (3600s). A duration in seconds with up to nine fractional digits, ending with 's'. Example: "35S".

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format locations/{{location}}/workforcePools/{{workforcePoolId}}

  • name - Output only. The resource name of the pool. Format: locations/{location}/workforcePools/{workforcePoolId}

  • state - Output only. The state of the pool.

    • STATE_UNSPECIFIED: State unspecified.
    • ACTIVE: The pool is active, and may be used in Google Cloud policies.
    • DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after approximately 30 days. You can restore a soft-deleted pool using workforcePools.undelete. You cannot reuse the ID of a soft-deleted pool until it is permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or use existing tokens to access resources. If the pool is undeleted, existing tokens grant access again.

Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 20 minutes.
  • update - Default is 20 minutes.
  • delete - Default is 20 minutes.

Import

WorkforcePool can be imported using any of these accepted formats:

$ terraform import google_iam_workforce_pool.default locations/{{location}}/workforcePools/{{workforce_pool_id}}
$ terraform import google_iam_workforce_pool.default {{location}}/{{workforce_pool_id}}