Gcp/iam
@swamp/gcp/iamv2026.08.12.3
01README
Google Cloud iam infrastructure models
02Release Notes
- Updated: serviceaccounts
03Models
@swamp/gcp/iam/oauthclientsv2026.08.12.2oauthclients.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| allowedGrantTypes? | array | Required. The list of OAuth grant types is allowed for the OauthClient. |
| allowedRedirectUris? | array | Required. The list of redirect uris that is allowed to redirect back when authorization process is completed. |
| allowedScopes? | array | Required. The list of scopes that the OauthClient is allowed to request during OAuth flows. The following scopes are supported: * `https://www.googleapis.com/auth/cloud-platform`: See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account. |
| clientType? | enum | Immutable. The type of OauthClient. Either public or private. For private clients, the client secret can be managed using the dedicated OauthClientCredential resource. |
| description? | string | Optional. A user-specified description of the OauthClient. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Whether the OauthClient is disabled. You cannot use a disabled OAuth client. |
| displayName? | string | Optional. A user-specified display name of the OauthClient. Cannot exceed 32 characters. |
| name? | string | Immutable. Identifier. The resource name of the OauthClient. Format:`projects/{project}/locations/{location}/oauthClients/{oauth_client}`. |
| oauthClientId? | string | Required. The ID to use for the OauthClient, which becomes the final component of the resource name. This value should be a string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a oauthClients
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a oauthClients
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the oauthClients |
fn update(identifier?: string, waitForReady?: boolean)
Update oauthClients attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific oauthClients by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the oauthClients
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the oauthClients |
fn sync(identifier?: string)
Sync oauthClients state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific oauthClients by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List oauthClients resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | Optional. The maximum number of OauthClients to return. If unspecified, at most 50 OauthClients will be returned. The maximum value is 100; values above 100 are truncated to 100. |
| showDeleted? | boolean | Optional. Whether to return soft-deleted OauthClients. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— Represents an OauthClient. Used to access Google Cloud resources on behalf of...
@swamp/gcp/iam/oauthclients-credentialsv2026.08.12.2oauthclients_credentials.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| disabled? | boolean | Optional. Whether the OauthClientCredential is disabled. You cannot use a disabled OauthClientCredential. |
| displayName? | string | Optional. A user-specified display name of the OauthClientCredential. Cannot exceed 32 characters. |
| name? | string | Immutable. Identifier. The resource name of the OauthClientCredential. Format: `projects/{project}/locations/{location}/oauthClients/{oauth_client}/credentials/{credential}` |
| oauthClientCredentialId? | string | Required. The ID to use for the OauthClientCredential, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create()
Create a credentials
fn get(identifier: string)
Get a credentials
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the credentials |
fn update(identifier?: string)
Update credentials attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific credentials by name (e.g. one discovered by list) |
fn delete(identifier: string)
Delete the credentials
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the credentials |
fn sync(identifier?: string)
Sync credentials state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific credentials by name (e.g. one discovered by list) |
fn list(maxPages?: number)
List credentials resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
Resources
state(infinite)— Represents an OauthClientCredential. Used to authenticate an OauthClient whil...
@swamp/gcp/iam/policiesv2026.08.12.2policies.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| annotations? | record | A key-value map to store arbitrary metadata for the `Policy`. Keys can be up to 63 characters. Values can be up to 255 characters. |
| createTime? | string | Output only. The time when the `Policy` was created. |
| deleteTime? | string | Output only. The time when the `Policy` was deleted. Empty if the policy is not deleted. |
| displayName? | string | A user-specified description of the `Policy`. This value can be up to 63 characters. |
| etag? | string | An opaque tag that identifies the current version of the `Policy`. IAM uses this value to help manage concurrent updates, so they do not cause one update to be overwritten by another. If this field is present in a CreatePolicyRequest, the value is ignored. |
| kind? | string | Output only. The kind of the `Policy`. Always contains the value `DenyPolicy`. |
| name? | string | Immutable. The resource name of the `Policy`, which must be unique. Format: `policies/{attachment_point}/denypolicies/{policy_id}` The attachment point is identified by its URL-encoded full resource name, which means that the forward-slash character, `/`, must be written as `%2F`. For example, `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`. For organizations and folders, use the numeric ID in the full resource name. For projects, requests can u |
| rules? | array | A list of rules that specify the behavior of the `Policy`. All of the rules should be of the `kind` specified in the `Policy`. |
| uid? | string | Immutable. The globally unique ID of the `Policy`. Assigned automatically when the `Policy` is created. |
| updateTime? | string | Output only. The time when the `Policy` was last updated. |
fn get(identifier: string)
Get a policies
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the policies |
fn update(identifier?: string)
Update policies attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific policies by name (e.g. one discovered by list) |
fn delete(identifier: string)
Delete the policies
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the policies |
fn sync(identifier?: string)
Sync policies state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific policies by name (e.g. one discovered by list) |
fn create_policy(annotations?: any, createTime?: any, deleteTime?: any, displayName?: any, etag?: any, kind?: any, name?: any, rules?: any, uid?: any, updateTime?: any)
create policy
| Argument | Type | Description |
|---|---|---|
| annotations? | any | |
| createTime? | any | |
| deleteTime? | any | |
| displayName? | any | |
| etag? | any | |
| kind? | any | |
| name? | any | |
| rules? | any | |
| uid? | any | |
| updateTime? | any |
fn list_policies()
list policies
Resources
state(infinite)— Data for an IAM policy.
@swamp/gcp/iam/rolesv2026.08.12.2roles.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| role? | object | The Role resource to create. |
| roleId? | string | The role ID to use for this role. A role ID may contain alphanumeric characters, underscores (`_`), and periods (`.`). It must contain a minimum of 3 characters and a maximum of 64 characters. |
| deleted? | boolean | The current deleted state of the role. This field is read only. It will be ignored in calls to CreateRole and UpdateRole. |
| description? | string | Optional. A human-readable description for the role. |
| etag? | string | Used to perform a consistent read-modify-write. |
| includedPermissions? | array | The names of the permissions this role grants when bound in an IAM policy. |
| name? | string | The name of the role. When `Role` is used in `CreateRole`, the role name must not be set. When `Role` is used in output and other input such as `UpdateRole`, the role name is the complete path. For example, `roles/logging.viewer` for predefined roles, `organizations/{ORGANIZATION_ID}/roles/myRole` for organization-level custom roles, and `projects/{PROJECT_ID}/roles/myRole` for project-level custom roles. |
| stage? | enum | The current launch stage of the role. If the `ALPHA` launch stage has been selected for a role, the `stage` field will not be included in the returned definition for the role. |
| title? | string | Optional. A human-readable title for the role. Typically this is limited to 100 UTF-8 bytes. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
fn create()
Create a roles
fn get(identifier: string)
Get a roles
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the roles |
fn update(identifier?: string)
Update roles attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific roles by name (e.g. one discovered by list) |
fn delete(identifier: string)
Delete the roles
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the roles |
fn sync(identifier?: string)
Sync roles state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific roles by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, view?: string, maxPages?: number)
List roles resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | Optional limit on the number of roles to include in the response. The default is 300, and the maximum is 1,000. |
| showDeleted? | boolean | Include Roles that have been deleted. |
| view? | string | Optional view for the returned Role objects. When `FULL` is specified, the `includedPermissions` field is returned, which includes a list of all permissions in the role. The default value is `BASIC`, which does not return the `includedPermissions` field. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete(etag?: any)
undelete
| Argument | Type | Description |
|---|---|---|
| etag? | any |
Resources
state(infinite)— A role in the Identity and Access Management API.
@swamp/gcp/iam/serviceaccountsv2026.08.12.3serviceaccounts.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| accountId? | string | Required. The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035. |
| serviceAccount? | object | An IAM service account. A service account is an account for an application or a virtual machine (VM) instance, not a person. You can use a service account to call Google APIs. To learn more, read the [overview of service accounts](https://cloud.google.com/iam/help/service-accounts/overview). When you create a service account, you specify the project ID that owns the service account, as well as a name that must be unique within the project. IAM uses these values to create an email address that id |
| description? | string | Optional. A user-specified, human-readable description of the service account. The maximum length is 256 UTF-8 bytes. |
| disabled? | boolean | Output only. Whether the service account is disabled. |
| displayName? | string | Optional. A user-specified, human-readable name for the service account. The maximum length is 100 UTF-8 bytes. |
| email? | string | Output only. The email address of the service account. |
| name? | string | The resource name of the service account. Use one of the following formats: * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}` * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}` As an alternative, you can use the `-` wildcard character instead of the project ID: * `projects/-/serviceAccounts/{EMAIL_ADDRESS}` * `projects/-/serviceAccounts/{UNIQUE_ID}` When possible, avoid using the `-` wildcard character, because it can cause response messages to contain misleading error codes. For exam |
| oauth2ClientId? | string | Output only. The OAuth 2.0 client ID for the service account. |
| projectId? | string | Output only. The ID of the project that owns the service account. |
| uniqueId? | string | Output only. The unique, stable numeric ID for the service account. Each service account retains its unique ID even if you delete the service account. For example, if you delete a service account, then create a new service account with the same name, the new service account has a different unique ID than the deleted service account. |
| updateMask? | string |
fn create()
Create a serviceAccounts
fn get(identifier: string)
Get a serviceAccounts
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the serviceAccounts |
fn update(identifier?: string)
Update serviceAccounts attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific serviceAccounts by name (e.g. one discovered by list) |
fn delete(identifier: string)
Delete the serviceAccounts
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the serviceAccounts |
fn sync(identifier?: string)
Sync serviceAccounts state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific serviceAccounts by name (e.g. one discovered by list) |
fn list(pageSize?: number, maxPages?: number)
List serviceAccounts resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | Optional limit on the number of service accounts to include in the response. Further accounts can subsequently be obtained by including the ListServiceAccountsResponse.next_page_token in a subsequent request. The default is 20, and the maximum is 100. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn disable()
disable
fn enable()
enable
fn get_iam_policy()
get iam policy
fn set_iam_policy(policy?: any, updateMask?: any)
set iam policy
| Argument | Type | Description |
|---|---|---|
| policy? | any | |
| updateMask? | any |
fn sign_blob(bytesToSign?: any)
sign blob
| Argument | Type | Description |
|---|---|---|
| bytesToSign? | any |
fn sign_jwt(payload?: any)
sign jwt
| Argument | Type | Description |
|---|---|---|
| payload? | any |
fn test_iam_permissions(permissions?: any)
test iam permissions
| Argument | Type | Description |
|---|---|---|
| permissions? | any |
fn undelete()
undelete
Resources
state(infinite)— An IAM service account. A service account is an account for an application or...
@swamp/gcp/iam/serviceaccounts-keysv2026.08.12.2serviceaccounts_keys.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| keyAlgorithm? | enum | Which type of key and algorithm to use for the key. The default is currently a 2K RSA key. However this may change in the future. |
| privateKeyType? | enum | The output format of the private key. The default value is `TYPE_GOOGLE_CREDENTIALS_FILE`, which is the Google Credentials File format. |
| name | string | Required. The resource name of the service account. Use one of the following formats: * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}` * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}` As an alternative, you can use the `-` wildcard character instead of the project ID: * `projects/-/serviceAccounts/{EMAIL_ADDRESS}` * `projects/-/serviceAccounts/{UNIQUE_ID}` When possible, avoid using the `-` wildcard character, because it can cause response messages to contain misleading error codes |
fn create()
Create a keys
fn get(identifier: string)
Get a keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn delete(identifier: string)
Delete the keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn sync(identifier?: string)
Sync keys state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific keys by name (e.g. one discovered by list) |
fn list(keyTypes?: string, maxPages?: number)
List keys resources
| Argument | Type | Description |
|---|---|---|
| keyTypes? | string | Filters the types of keys the user wants to include in the list response. Duplicate key types are not allowed. If no key type is provided, all keys are returned. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn disable()
disable
fn enable()
enable
fn upload(publicKeyData?: any)
upload
| Argument | Type | Description |
|---|---|---|
| publicKeyData? | any |
Resources
state(infinite)— Represents a service account key. A service account has two sets of key-pairs...
@swamp/gcp/iam/workforcepoolsv2026.08.12.2workforcepools.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| accessRestrictions? | object | Optional. Configure access restrictions on the workforce pool users. This is an optional field. If specified web sign-in can be restricted to given set of services or programmatic sign-in can be disabled for pool users. |
| description? | string | Optional. A description of the pool. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. |
| displayName? | string | Optional. A display name for the pool. Cannot exceed 32 characters. |
| name? | string | Identifier. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}` |
| parent? | string | Immutable. The resource name of the parent. Format: `organizations/{org-id}`. |
| sessionDuration? | string | Optional. Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials have a default duration of one hour (3600s). For SAML providers, the lifetime of the token is the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion. |
| location | string | Optional. The location of the pool to create. Format: `locations/{location}`. |
| workforcePoolId? | string | Optional. The ID to use for the pool, which becomes the final component of the resource name. The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
fn create(waitForReady?: boolean)
Create a workforcePools
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a workforcePools
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the workforcePools |
fn update(identifier?: string, waitForReady?: boolean)
Update workforcePools attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific workforcePools by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the workforcePools
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the workforcePools |
fn sync(identifier?: string)
Sync workforcePools state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific workforcePools by name (e.g. one discovered by list) |
fn list(pageSize?: number, parent?: string, showDeleted?: boolean, maxPages?: number)
List workforcePools resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of pools to return. The default value is 50. The maximum value is 100. |
| parent? | string | Required. The parent resource to list pools for. Format: `organizations/{org-id}`. |
| showDeleted? | boolean | Whether to return soft-deleted pools. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn get_iam_policy(options?: any)
get iam policy
| Argument | Type | Description |
|---|---|---|
| options? | any |
fn set_iam_policy(policy?: any, updateMask?: any)
set iam policy
| Argument | Type | Description |
|---|---|---|
| policy? | any | |
| updateMask? | any |
fn test_iam_permissions(permissions?: any)
test iam permissions
| Argument | Type | Description |
|---|---|---|
| permissions? | any |
fn undelete()
undelete
Resources
state(infinite)— Represents a collection of external workforces. Provides namespaces for feder...
@swamp/gcp/iam/workforcepools-providersv2026.08.12.2workforcepools_providers.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| attributeCondition? | string | Optional. A [Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the asse |
| attributeMapping? | record | Required. Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot excee |
| description? | string | Optional. A description of the provider. Cannot exceed 256 characters. |
| detailedAuditLogging? | boolean | Optional. If true, populates additional debug information in Cloud Audit Logs for this provider. Logged attribute mappings and values can be found in `sts.googleapis.com` data access logs. Default value is false. |
| disabled? | boolean | Optional. Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access. |
| displayName? | string | Optional. A display name for the provider. Cannot exceed 32 characters. |
| extendedAttributesOauth2Client? | object | Optional. The configuration for OAuth 2.0 client used to get the extended group memberships for user identities. Only the `AZURE_AD_GROUPS_ID` attribute type is supported. Extended groups supports a subset of Google Cloud services. When the user accesses these services, extended group memberships override the mapped `google.groups` attribute. Extended group memberships cannot be used in attribute mapping or attribute condition expressions. To keep extended group memberships up to date, extended |
| extraAttributesOauth2Client? | object | Optional. Defines the configuration for the OAuth 2.0 client that is used to get the additional user attributes in a separate backchannel call to the identity provider. This should be used when users can't get the required claims in authentication credentials. Currently, the OAuth 2.0 protocol is the only supported authorization method for this backchannel call. |
| name? | string | Identifier. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}` |
| oidc? | object | An OpenID Connect 1.0 identity provider configuration. |
| saml | object | |
| scimUsage? | enum | Optional. Gemini Enterprise only. Specifies whether the workforce identity pool provider uses SCIM-managed groups instead of the `google.groups` attribute mapping for authorization checks. The `scim_usage` and `extended_attributes_oauth2_client` fields are mutually exclusive. A request that enables both fields on the same workforce identity pool provider will produce an error. |
| workforcePoolProviderId? | string | Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters `[a-z0-9-]`. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
fn create(waitForReady?: boolean)
Create a providers
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a providers
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the providers |
fn update(identifier?: string, waitForReady?: boolean)
Update providers attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific providers by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the providers
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the providers |
fn sync(identifier?: string)
Sync providers state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific providers by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List providers resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of providers to return. If unspecified, at most 50 providers are returned. The maximum value is 100; values above 100 are truncated to 100. |
| showDeleted? | boolean | Whether to return soft-deleted providers. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— A configuration for an external identity provider.
@swamp/gcp/iam/workforcepools-providers-keysv2026.08.12.2workforcepools_providers_keys.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| keyData? | object | Immutable. Public half of the asymmetric key. |
| name? | string | Identifier. The resource name of the key. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}/keys/{key_id}` |
| use? | enum | Required. The purpose of the key. |
| workforcePoolProviderKeyId? | string | Required. The ID to use for the key, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters `[a-z0-9-]`. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
fn create(waitForReady?: boolean)
Create a keys
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn delete(identifier: string)
Delete the keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn sync(identifier?: string)
Sync keys state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific keys by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List keys resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of keys to return. If unspecified, all keys are returned. The maximum value is 10; values above 10 are truncated to 10. |
| showDeleted? | boolean | Whether to return soft-deleted keys. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— Represents a public key configuration for a Workforce Pool Provider. The key ...
@swamp/gcp/iam/workforcepools-providers-scimtenantsv2026.08.12.2workforcepools_providers_scimtenants.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| claimMapping? | record | Required. Immutable. Gemini Enterprise only. Maps SCIM attributes to Google attributes. This mapping is used to associate the attributes synced via SCIM with the Google Cloud attributes used in IAM policies for Workforce Identity Federation. SCIM-managed user and group attributes are mapped to `google.subject` and `google.group` respectively. Each key must be a string specifying the Google Cloud IAM attribute to map to. The supported keys are as follows: * `google.subject`: The principal IAM is |
| description? | string | Optional. Gemini Enterprise only. The description of the SCIM tenant. Cannot exceed 256 characters. |
| displayName? | string | Optional. Gemini Enterprise only. The display name of the SCIM tenant. Cannot exceed 32 characters. |
| name? | string | Identifier. Gemini Enterprise only. The resource name of the SCIM Tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/ {workforce_pool_provider}/scimTenants/{scim_tenant}` |
| workforcePoolProviderScimTenantId? | string | Required. Gemini Enterprise only. The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value should be 4-32 characters, containing the characters `[a-z0-9-]`. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
fn create(waitForReady?: boolean)
Create a scimTenants
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a scimTenants
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the scimTenants |
fn update(identifier?: string, waitForReady?: boolean)
Update scimTenants attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific scimTenants by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the scimTenants
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the scimTenants |
fn sync(identifier?: string)
Sync scimTenants state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific scimTenants by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List scimTenants resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | Optional. Gemini Enterprise only. The maximum number of SCIM tenants to return. If unspecified, at most 50 SCIM tenants will be returned. The maximum value is 100; values above 100 are truncated to 100. |
| showDeleted? | boolean | Optional. Gemini Enterprise only. Whether to return soft-deleted SCIM tenants. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— Gemini Enterprise only. Represents a SCIM tenant. Used for provisioning and m...
@swamp/gcp/iam/workforcepools-providers-scimtenants-tokensv2026.08.12.2workforcepools_providers_scimtenants_tokens.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| displayName? | string | Optional. Gemini Enterprise only. The display name of the SCIM token. Cannot exceed 32 characters. |
| name? | string | Identifier. Gemini Enterprise only. The resource name of the SCIM Token. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/ {workforce_pool_provider}/scimTenants/{scim_tenant}/tokens/{token}` |
| workforcePoolProviderScimTokenId? | string | Required. Gemini Enterprise only. The ID to use for the SCIM token, which becomes the final component of the resource name. This value should be 4-32 characters and follow the pattern: `([a-z]([a-z0-9\\\\-]{2,30}[a-z0-9]))` |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
fn create(waitForReady?: boolean)
Create a tokens
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a tokens
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the tokens |
fn update(identifier?: string, waitForReady?: boolean)
Update tokens attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific tokens by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the tokens
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the tokens |
fn sync(identifier?: string)
Sync tokens state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific tokens by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List tokens resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | Optional. Gemini Enterprise only. The maximum number of SCIM tokens to return. If unspecified, at most 2 SCIM tokens will be returned. |
| showDeleted? | boolean | Optional. Gemini Enterprise only. Whether to return soft-deleted SCIM tokens. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
Resources
state(infinite)— Gemini Enterprise only. Represents a token for the WorkforcePoolProviderScimT...
@swamp/gcp/iam/workloadidentitypoolsv2026.08.12.2workloadidentitypools.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| description? | string | Optional. A description of the pool. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. |
| displayName? | string | Optional. A display name for the pool. Cannot exceed 32 characters. |
| inlineCertificateIssuanceConfig? | object | Optional. Defines the Certificate Authority (CA) pool resources and configurations required for issuance and rotation of mTLS workload certificates. |
| inlineTrustConfig? | object | Optional. Represents config to add additional trusted trust domains. |
| mode? | enum | Immutable. The mode the pool is operating in. |
| name? | string | Identifier. The resource name of the pool. |
| workloadIdentityPoolId? | string | Required. The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a workloadIdentityPools
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a workloadIdentityPools
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the workloadIdentityPools |
fn update(identifier?: string, waitForReady?: boolean)
Update workloadIdentityPools attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific workloadIdentityPools by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the workloadIdentityPools
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the workloadIdentityPools |
fn sync(identifier?: string)
Sync workloadIdentityPools state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific workloadIdentityPools by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List workloadIdentityPools resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of pools to return. If unspecified, at most 50 pools are returned. The maximum value is 1000; values above are 1000 truncated to 1000. |
| showDeleted? | boolean | Whether to return soft-deleted pools. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn add_attestation_rule(attestationRule?: any)
add attestation rule
| Argument | Type | Description |
|---|---|---|
| attestationRule? | any |
fn get_iam_policy(options?: any)
get iam policy
| Argument | Type | Description |
|---|---|---|
| options? | any |
fn list_attestation_rules()
list attestation rules
fn set_attestation_rules(attestationRules?: any)
set attestation rules
| Argument | Type | Description |
|---|---|---|
| attestationRules? | any |
fn set_iam_policy(policy?: any, updateMask?: any)
set iam policy
| Argument | Type | Description |
|---|---|---|
| policy? | any | |
| updateMask? | any |
fn test_iam_permissions(permissions?: any)
test iam permissions
| Argument | Type | Description |
|---|---|---|
| permissions? | any |
fn undelete()
undelete
Resources
state(infinite)— Represents a collection of workload identities. You can define IAM policies t...
@swamp/gcp/iam/workloadidentitypools-namespacesv2026.08.12.2workloadidentitypools_namespaces.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| description? | string | Optional. A description of the namespace. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Whether the namespace is disabled. If disabled, credentials may no longer be issued for identities within this namespace, however existing credentials will still be accepted until they expire. |
| name? | string | Identifier. The resource name of the namespace. |
| workloadIdentityPoolNamespaceId? | string | Required. The ID to use for the namespace. This value must: * contain at most 63 characters * contain only lowercase alphanumeric characters or `-` * start with an alphanumeric character * end with an alphanumeric character The prefix "gcp-" will be reserved for future uses. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a namespaces
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a namespaces
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the namespaces |
fn update(identifier?: string, waitForReady?: boolean)
Update namespaces attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific namespaces by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the namespaces
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the namespaces |
fn sync(identifier?: string)
Sync namespaces state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific namespaces by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List namespaces resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of namespaces to return. If unspecified, at most 50 namespaces are returned. The maximum value is 1000; values above are 1000 truncated to 1000. |
| showDeleted? | boolean | Whether to return soft-deleted namespaces. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— Represents a namespace for a workload identity pool. Namespaces are used to s...
@swamp/gcp/iam/workloadidentitypools-namespaces-managedidentitiesv2026.08.12.2workloadidentitypools_namespaces_managedidentities.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| description? | string | Optional. A description of the managed identity. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire. |
| name? | string | Identifier. The resource name of the managed identity. |
| workloadIdentityPoolManagedIdentityId? | string | Required. The ID to use for the managed identity. This value must: * contain at most 63 characters * contain only lowercase alphanumeric characters or `-` * start with an alphanumeric character * end with an alphanumeric character The prefix "gcp-" will be reserved for future uses. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a managedIdentities
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a managedIdentities
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the managedIdentities |
fn update(identifier?: string, waitForReady?: boolean)
Update managedIdentities attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific managedIdentities by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the managedIdentities
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the managedIdentities |
fn sync(identifier?: string)
Sync managedIdentities state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific managedIdentities by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List managedIdentities resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of managed identities to return. If unspecified, at most 50 managed identities are returned. The maximum value is 1000; values above are 1000 truncated to 1000. |
| showDeleted? | boolean | Whether to return soft-deleted managed identities. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn add_attestation_rule(attestationRule?: any)
add attestation rule
| Argument | Type | Description |
|---|---|---|
| attestationRule? | any |
fn list_attestation_rules()
list attestation rules
fn set_attestation_rules(attestationRules?: any)
set attestation rules
| Argument | Type | Description |
|---|---|---|
| attestationRules? | any |
fn undelete()
undelete
Resources
state(infinite)— Represents a managed identity for a workload identity pool namespace.
@swamp/gcp/iam/workloadidentitypools-providersv2026.08.12.2workloadidentitypools_providers.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| attributeCondition? | string | Optional. [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the asse |
| attributeMapping? | record | Optional. Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 bytes. * `google.groups`: Groups the external |
| aws? | object | An Amazon Web Services identity provider. |
| description? | string | Optional. A description for the provider. Cannot exceed 256 characters. |
| disabled? | boolean | Optional. Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access. |
| displayName? | string | Optional. A display name for the provider. Cannot exceed 32 characters. |
| name? | string | Identifier. The resource name of the provider. |
| oidc? | object | An OpenId Connect 1.0 identity provider. |
| saml? | object | An SAML 2.0 identity provider. |
| x509? | object | An X.509-type identity provider. |
| workloadIdentityPoolProviderId? | string | Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a providers
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a providers
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the providers |
fn update(identifier?: string, waitForReady?: boolean)
Update providers attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific providers by name (e.g. one discovered by list) |
| waitForReady? | boolean | Wait for the resource to reach a ready state after update (default: true) |
fn delete(identifier: string)
Delete the providers
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the providers |
fn sync(identifier?: string)
Sync providers state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific providers by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List providers resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of providers to return. If unspecified, at most 50 providers are returned. The maximum value is 100; values above 100 are truncated to 100. |
| showDeleted? | boolean | Whether to return soft-deleted providers. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— A configuration for an external identity provider.
@swamp/gcp/iam/workloadidentitypools-providers-keysv2026.08.12.2workloadidentitypools_providers_keys.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| apiEndpoint? | string | Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL. |
| keyData? | object | Immutable. Public half of the asymmetric key. |
| name? | string | Identifier. The resource name of the key. |
| use? | enum | Required. The purpose of the key. |
| workloadIdentityPoolProviderKeyId? | string | Required. The ID to use for the key, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn create(waitForReady?: boolean)
Create a keys
| Argument | Type | Description |
|---|---|---|
| waitForReady? | boolean | Wait for the resource to reach a ready state after creation (default: true) |
fn get(identifier: string)
Get a keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn delete(identifier: string)
Delete the keys
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the keys |
fn sync(identifier?: string)
Sync keys state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific keys by name (e.g. one discovered by list) |
fn list(pageSize?: number, showDeleted?: boolean, maxPages?: number)
List keys resources
| Argument | Type | Description |
|---|---|---|
| pageSize? | number | The maximum number of keys to return. If unspecified, all keys are returned. The maximum value is 10; values above 10 are truncated to 10. |
| showDeleted? | boolean | Whether to return soft deleted resources as well. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn undelete()
undelete
Resources
state(infinite)— Represents a public key configuration for your workload identity pool provide...
04Previous Versions
2026.07.29.1
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.07.28.2
- Updated: serviceaccounts_keys
2026.07.28.1
- Updated: serviceaccounts_keys
2026.07.21.4
- Added: workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.07.21.1
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, roles, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_providers, workloadidentitypools_providers_keys
2026.07.20.2
- Added: workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
Added 15 models
2026.07.20.1
- Updated: policies
Removed 15 models
2026.07.19.1
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.07.18.2
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.07.17.2
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.07.17.1
- Updated: roles
2026.07.16.2
- Updated: workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys
2026.07.10.1
- Updated: serviceaccounts_keys
Added 16, removed 1 models
2026.06.08.2
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.06.07.1
- Updated: policies, workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, roles, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
2026.06.06.2
- Updated: serviceaccounts
2026.06.05.1
- Added: workforcepools, workforcepools_providers, workforcepools_providers_keys, workforcepools_providers_scimtenants, workforcepools_providers_scimtenants_tokens, oauthclients, oauthclients_credentials, workloadidentitypools, workloadidentitypools_namespaces, workloadidentitypools_namespaces_managedidentities, workloadidentitypools_providers, workloadidentitypools_providers_keys, serviceaccounts, serviceaccounts_keys
Added 14 models
2026.05.26.1
- Added: roles
Added 1 models
2026.05.25.1
- Updated: policies
Removed 1 models
05Stats
A
100 / 100
Downloads
51
Archive size
237.8 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
06Platforms
07Labels