subcategory | page_title | description |
---|---|---|
Cloud IAM |
Google: google_iam_workforce_pool |
Represents a collection of external workforces. |
Represents a collection of external workforces. Provides namespaces for federated users that can be referenced in IAM policies. Note: Ask your Google Cloud account team to request access to workforce identity federation for your billing/quota project. The account team notifies you when the project is granted access.
~> Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider. See Provider Versions for more details on beta resources.
To get more information about WorkforcePool, see:
- API documentation
- How-to Guides
resource "google_iam_workforce_pool" "example" {
provider = google-beta
workforce_pool_id = "example-pool"
parent = "organizations/123456789"
location = "global"
}
resource "google_iam_workforce_pool" "example" {
provider = google-beta
workforce_pool_id = "example-pool"
parent = "organizations/123456789"
location = "global"
display_name = "Display name"
description = "A sample workforce pool."
disabled = false
session_duration = "7200s"
}
The following arguments are supported:
-
location
- (Required) The location for the resource. -
workforce_pool_id
- (Required) The name of the pool. The ID must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefixgcp-
is reserved for use by Google, and may not be specified. -
parent
- (Required) Immutable. The resource name of the parent. Format:organizations/{org-id}
.
-
display_name
- (Optional) A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. -
description
- (Optional) A user-specified description of the pool. Cannot exceed 256 characters. -
disabled
- (Optional) Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. -
session_duration
- (Optional) Duration that the Google Cloud access tokens, console sign-in sessions, andgcloud
sign-in sessions from this pool are valid.
Must be greater than 15 minutes (900s) and less than 12 hours (43200s). IfsessionDuration
is not configured, minted credentials have a default duration of one hour (3600s). A duration in seconds with up to nine fractional digits, ending with 's
'. Example: "3.5s
".
In addition to the arguments listed above, the following computed attributes are exported:
-
id
- an identifier for the resource with formatlocations/{{location}}/workforcePools/{{workforce_pool_id}}
-
name
- Output only. The resource name of the pool. Format:locations/{location}/workforcePools/{workforcePoolId}
-
state
- Output only. The state of the pool.- STATE_UNSPECIFIED: State unspecified.
- ACTIVE: The pool is active, and may be used in Google Cloud policies.
- DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after approximately 30 days. You can restore a soft-deleted pool using [UndeleteWorkforcePool][WorkforcePools.UndeleteWorkforcePool]. You cannot reuse the ID of a soft-deleted pool until it is permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or use existing tokens to access resources. If the pool is undeleted, existing tokens grant access again.
This resource provides the following Timeouts configuration options:
create
- Default is 20 minutes.update
- Default is 20 minutes.delete
- Default is 20 minutes.
WorkforcePool can be imported using any of these accepted formats:
$ terraform import google_iam_workforce_pool.default locations/{{location}}/workforcePools/{{workforce_pool_id}}
$ terraform import google_iam_workforce_pool.default {{location}}/{{workforce_pool_id}}