Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. iam
  5. WorkloadIdentityPoolManagedIdentity
Google Cloud v8.33.0 published on Wednesday, Jun 4, 2025 by Pulumi
pulumi/pulumi-gcp

gcp.iam.WorkloadIdentityPoolManagedIdentity

Explore with Pulumi AI

gcp logo
Google Cloud v8.33.0 published on Wednesday, Jun 4, 2025 by Pulumi
pulumi/pulumi-gcp

    Example Usage

    Iam Workload Identity Pool Managed Identity Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const pool = new gcp.iam.WorkloadIdentityPool("pool", {
    workloadIdentityPoolId: "example-pool",
    mode: "TRUST_DOMAIN",
});
const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", {
    workloadIdentityPoolId: pool.workloadIdentityPoolId,
    workloadIdentityPoolNamespaceId: "example-namespace",
});
const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", {
    workloadIdentityPoolId: pool.workloadIdentityPoolId,
    workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId,
    workloadIdentityPoolManagedIdentityId: "example-managed-identity",
});

    import pulumi
import pulumi_gcp as gcp

pool = gcp.iam.WorkloadIdentityPool("pool",
    workload_identity_pool_id="example-pool",
    mode="TRUST_DOMAIN")
ns = gcp.iam.WorkloadIdentityPoolNamespace("ns",
    workload_identity_pool_id=pool.workload_identity_pool_id,
    workload_identity_pool_namespace_id="example-namespace")
example = gcp.iam.WorkloadIdentityPoolManagedIdentity("example",
    workload_identity_pool_id=pool.workload_identity_pool_id,
    workload_identity_pool_namespace_id=ns.workload_identity_pool_namespace_id,
    workload_identity_pool_managed_identity_id="example-managed-identity")

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
			Mode:                   pulumi.String("TRUST_DOMAIN"),
		})
		if err != nil {
			return err
		}
		ns, err := iam.NewWorkloadIdentityPoolNamespace(ctx, "ns", &iam.WorkloadIdentityPoolNamespaceArgs{
			WorkloadIdentityPoolId:          pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolNamespaceId: pulumi.String("example-namespace"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolManagedIdentity(ctx, "example", &iam.WorkloadIdentityPoolManagedIdentityArgs{
			WorkloadIdentityPoolId:                pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolNamespaceId:       ns.WorkloadIdentityPoolNamespaceId,
			WorkloadIdentityPoolManagedIdentityId: pulumi.String("example-managed-identity"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var pool = new Gcp.Iam.WorkloadIdentityPool("pool", new()
    {
        WorkloadIdentityPoolId = "example-pool",
        Mode = "TRUST_DOMAIN",
    });

    var ns = new Gcp.Iam.WorkloadIdentityPoolNamespace("ns", new()
    {
        WorkloadIdentityPoolId = pool.WorkloadIdentityPoolId,
        WorkloadIdentityPoolNamespaceId = "example-namespace",
    });

    var example = new Gcp.Iam.WorkloadIdentityPoolManagedIdentity("example", new()
    {
        WorkloadIdentityPoolId = pool.WorkloadIdentityPoolId,
        WorkloadIdentityPoolNamespaceId = ns.WorkloadIdentityPoolNamespaceId,
        WorkloadIdentityPoolManagedIdentityId = "example-managed-identity",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import com.pulumi.gcp.iam.WorkloadIdentityPoolNamespace;
import com.pulumi.gcp.iam.WorkloadIdentityPoolNamespaceArgs;
import com.pulumi.gcp.iam.WorkloadIdentityPoolManagedIdentity;
import com.pulumi.gcp.iam.WorkloadIdentityPoolManagedIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pool = new WorkloadIdentityPool("pool", WorkloadIdentityPoolArgs.builder()
            .workloadIdentityPoolId("example-pool")
            .mode("TRUST_DOMAIN")
            .build());

        var ns = new WorkloadIdentityPoolNamespace("ns", WorkloadIdentityPoolNamespaceArgs.builder()
            .workloadIdentityPoolId(pool.workloadIdentityPoolId())
            .workloadIdentityPoolNamespaceId("example-namespace")
            .build());

        var example = new WorkloadIdentityPoolManagedIdentity("example", WorkloadIdentityPoolManagedIdentityArgs.builder()
            .workloadIdentityPoolId(pool.workloadIdentityPoolId())
            .workloadIdentityPoolNamespaceId(ns.workloadIdentityPoolNamespaceId())
            .workloadIdentityPoolManagedIdentityId("example-managed-identity")
            .build());

    }
}

    resources:
  pool:
    type: gcp:iam:WorkloadIdentityPool
    properties:
      workloadIdentityPoolId: example-pool
      mode: TRUST_DOMAIN
  ns:
    type: gcp:iam:WorkloadIdentityPoolNamespace
    properties:
      workloadIdentityPoolId: ${pool.workloadIdentityPoolId}
      workloadIdentityPoolNamespaceId: example-namespace
  example:
    type: gcp:iam:WorkloadIdentityPoolManagedIdentity
    properties:
      workloadIdentityPoolId: ${pool.workloadIdentityPoolId}
      workloadIdentityPoolNamespaceId: ${ns.workloadIdentityPoolNamespaceId}
      workloadIdentityPoolManagedIdentityId: example-managed-identity

    Iam Workload Identity Pool Managed Identity Full

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const pool = new gcp.iam.WorkloadIdentityPool("pool", {
    workloadIdentityPoolId: "example-pool",
    mode: "TRUST_DOMAIN",
});
const ns = new gcp.iam.WorkloadIdentityPoolNamespace("ns", {
    workloadIdentityPoolId: pool.workloadIdentityPoolId,
    workloadIdentityPoolNamespaceId: "example-namespace",
});
const example = new gcp.iam.WorkloadIdentityPoolManagedIdentity("example", {
    workloadIdentityPoolId: pool.workloadIdentityPoolId,
    workloadIdentityPoolNamespaceId: ns.workloadIdentityPoolNamespaceId,
    workloadIdentityPoolManagedIdentityId: "example-managed-identity",
    description: "Example Managed Identity in a Workload Identity Pool Namespace",
    disabled: true,
});

    import pulumi
import pulumi_gcp as gcp

pool = gcp.iam.WorkloadIdentityPool("pool",
    workload_identity_pool_id="example-pool",
    mode="TRUST_DOMAIN")
ns = gcp.iam.WorkloadIdentityPoolNamespace("ns",
    workload_identity_pool_id=pool.workload_identity_pool_id,
    workload_identity_pool_namespace_id="example-namespace")
example = gcp.iam.WorkloadIdentityPoolManagedIdentity("example",
    workload_identity_pool_id=pool.workload_identity_pool_id,
    workload_identity_pool_namespace_id=ns.workload_identity_pool_namespace_id,
    workload_identity_pool_managed_identity_id="example-managed-identity",
    description="Example Managed Identity in a Workload Identity Pool Namespace",
    disabled=True)

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkloadIdentityPool(ctx, "pool", &iam.WorkloadIdentityPoolArgs{
			WorkloadIdentityPoolId: pulumi.String("example-pool"),
			Mode:                   pulumi.String("TRUST_DOMAIN"),
		})
		if err != nil {
			return err
		}
		ns, err := iam.NewWorkloadIdentityPoolNamespace(ctx, "ns", &iam.WorkloadIdentityPoolNamespaceArgs{
			WorkloadIdentityPoolId:          pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolNamespaceId: pulumi.String("example-namespace"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolManagedIdentity(ctx, "example", &iam.WorkloadIdentityPoolManagedIdentityArgs{
			WorkloadIdentityPoolId:                pool.WorkloadIdentityPoolId,
			WorkloadIdentityPoolNamespaceId:       ns.WorkloadIdentityPoolNamespaceId,
			WorkloadIdentityPoolManagedIdentityId: pulumi.String("example-managed-identity"),
			Description:                           pulumi.String("Example Managed Identity in a Workload Identity Pool Namespace"),
			Disabled:                              pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var pool = new Gcp.Iam.WorkloadIdentityPool("pool", new()
    {
        WorkloadIdentityPoolId = "example-pool",
        Mode = "TRUST_DOMAIN",
    });

    var ns = new Gcp.Iam.WorkloadIdentityPoolNamespace("ns", new()
    {
        WorkloadIdentityPoolId = pool.WorkloadIdentityPoolId,
        WorkloadIdentityPoolNamespaceId = "example-namespace",
    });

    var example = new Gcp.Iam.WorkloadIdentityPoolManagedIdentity("example", new()
    {
        WorkloadIdentityPoolId = pool.WorkloadIdentityPoolId,
        WorkloadIdentityPoolNamespaceId = ns.WorkloadIdentityPoolNamespaceId,
        WorkloadIdentityPoolManagedIdentityId = "example-managed-identity",
        Description = "Example Managed Identity in a Workload Identity Pool Namespace",
        Disabled = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPool;
import com.pulumi.gcp.iam.WorkloadIdentityPoolArgs;
import com.pulumi.gcp.iam.WorkloadIdentityPoolNamespace;
import com.pulumi.gcp.iam.WorkloadIdentityPoolNamespaceArgs;
import com.pulumi.gcp.iam.WorkloadIdentityPoolManagedIdentity;
import com.pulumi.gcp.iam.WorkloadIdentityPoolManagedIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pool = new WorkloadIdentityPool("pool", WorkloadIdentityPoolArgs.builder()
            .workloadIdentityPoolId("example-pool")
            .mode("TRUST_DOMAIN")
            .build());

        var ns = new WorkloadIdentityPoolNamespace("ns", WorkloadIdentityPoolNamespaceArgs.builder()
            .workloadIdentityPoolId(pool.workloadIdentityPoolId())
            .workloadIdentityPoolNamespaceId("example-namespace")
            .build());

        var example = new WorkloadIdentityPoolManagedIdentity("example", WorkloadIdentityPoolManagedIdentityArgs.builder()
            .workloadIdentityPoolId(pool.workloadIdentityPoolId())
            .workloadIdentityPoolNamespaceId(ns.workloadIdentityPoolNamespaceId())
            .workloadIdentityPoolManagedIdentityId("example-managed-identity")
            .description("Example Managed Identity in a Workload Identity Pool Namespace")
            .disabled(true)
            .build());

    }
}

    resources:
  pool:
    type: gcp:iam:WorkloadIdentityPool
    properties:
      workloadIdentityPoolId: example-pool
      mode: TRUST_DOMAIN
  ns:
    type: gcp:iam:WorkloadIdentityPoolNamespace
    properties:
      workloadIdentityPoolId: ${pool.workloadIdentityPoolId}
      workloadIdentityPoolNamespaceId: example-namespace
  example:
    type: gcp:iam:WorkloadIdentityPoolManagedIdentity
    properties:
      workloadIdentityPoolId: ${pool.workloadIdentityPoolId}
      workloadIdentityPoolNamespaceId: ${ns.workloadIdentityPoolNamespaceId}
      workloadIdentityPoolManagedIdentityId: example-managed-identity
      description: Example Managed Identity in a Workload Identity Pool Namespace
      disabled: true

    Create WorkloadIdentityPoolManagedIdentity Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new WorkloadIdentityPoolManagedIdentity(name: string, args: WorkloadIdentityPoolManagedIdentityArgs, opts?: CustomResourceOptions);
    @overload
def WorkloadIdentityPoolManagedIdentity(resource_name: str,
                                        args: WorkloadIdentityPoolManagedIdentityArgs,
                                        opts: Optional[ResourceOptions] = None)

@overload
def WorkloadIdentityPoolManagedIdentity(resource_name: str,
                                        opts: Optional[ResourceOptions] = None,
                                        workload_identity_pool_id: Optional[str] = None,
                                        workload_identity_pool_managed_identity_id: Optional[str] = None,
                                        workload_identity_pool_namespace_id: Optional[str] = None,
                                        description: Optional[str] = None,
                                        disabled: Optional[bool] = None,
                                        project: Optional[str] = None)
    func NewWorkloadIdentityPoolManagedIdentity(ctx *Context, name string, args WorkloadIdentityPoolManagedIdentityArgs, opts ...ResourceOption) (*WorkloadIdentityPoolManagedIdentity, error)
    public WorkloadIdentityPoolManagedIdentity(string name, WorkloadIdentityPoolManagedIdentityArgs args, CustomResourceOptions? opts = null)
    public WorkloadIdentityPoolManagedIdentity(String name, WorkloadIdentityPoolManagedIdentityArgs args)
public WorkloadIdentityPoolManagedIdentity(String name, WorkloadIdentityPoolManagedIdentityArgs args, CustomResourceOptions options)

    type: gcp:iam:WorkloadIdentityPoolManagedIdentity
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args WorkloadIdentityPoolManagedIdentityArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args WorkloadIdentityPoolManagedIdentityArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args WorkloadIdentityPoolManagedIdentityArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args WorkloadIdentityPoolManagedIdentityArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args WorkloadIdentityPoolManagedIdentityArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var workloadIdentityPoolManagedIdentityResource = new Gcp.Iam.WorkloadIdentityPoolManagedIdentity("workloadIdentityPoolManagedIdentityResource", new()
{
    WorkloadIdentityPoolId = "string",
    WorkloadIdentityPoolManagedIdentityId = "string",
    WorkloadIdentityPoolNamespaceId = "string",
    Description = "string",
    Disabled = false,
    Project = "string",
});

    example, err := iam.NewWorkloadIdentityPoolManagedIdentity(ctx, "workloadIdentityPoolManagedIdentityResource", &iam.WorkloadIdentityPoolManagedIdentityArgs{
	WorkloadIdentityPoolId:                pulumi.String("string"),
	WorkloadIdentityPoolManagedIdentityId: pulumi.String("string"),
	WorkloadIdentityPoolNamespaceId:       pulumi.String("string"),
	Description:                           pulumi.String("string"),
	Disabled:                              pulumi.Bool(false),
	Project:                               pulumi.String("string"),
})

    var workloadIdentityPoolManagedIdentityResource = new WorkloadIdentityPoolManagedIdentity("workloadIdentityPoolManagedIdentityResource", WorkloadIdentityPoolManagedIdentityArgs.builder()
    .workloadIdentityPoolId("string")
    .workloadIdentityPoolManagedIdentityId("string")
    .workloadIdentityPoolNamespaceId("string")
    .description("string")
    .disabled(false)
    .project("string")
    .build());

    workload_identity_pool_managed_identity_resource = gcp.iam.WorkloadIdentityPoolManagedIdentity("workloadIdentityPoolManagedIdentityResource",
    workload_identity_pool_id="string",
    workload_identity_pool_managed_identity_id="string",
    workload_identity_pool_namespace_id="string",
    description="string",
    disabled=False,
    project="string")

    const workloadIdentityPoolManagedIdentityResource = new gcp.iam.WorkloadIdentityPoolManagedIdentity("workloadIdentityPoolManagedIdentityResource", {
    workloadIdentityPoolId: "string",
    workloadIdentityPoolManagedIdentityId: "string",
    workloadIdentityPoolNamespaceId: "string",
    description: "string",
    disabled: false,
    project: "string",
});

    type: gcp:iam:WorkloadIdentityPoolManagedIdentity
properties:
    description: string
    disabled: false
    project: string
    workloadIdentityPoolId: string
    workloadIdentityPoolManagedIdentityId: string
    workloadIdentityPoolNamespaceId: string

    WorkloadIdentityPoolManagedIdentity Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The WorkloadIdentityPoolManagedIdentity resource accepts the following input properties:

    WorkloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    WorkloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    WorkloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    Description string
    A description of the managed identity. Cannot exceed 256 characters.
    Disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    WorkloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    WorkloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    WorkloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    Description string
    A description of the managed identity. Cannot exceed 256 characters.
    Disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId String
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId String

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId String

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description String
    A description of the managed identity. Cannot exceed 256 characters.
    disabled Boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description string
    A description of the managed identity. Cannot exceed 256 characters.
    disabled boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    workload_identity_pool_id str
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workload_identity_pool_managed_identity_id str

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workload_identity_pool_namespace_id str

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description str
    A description of the managed identity. Cannot exceed 256 characters.
    disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    workloadIdentityPoolId String
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId String

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId String

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description String
    A description of the managed identity. Cannot exceed 256 characters.
    disabled Boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the WorkloadIdentityPoolManagedIdentity resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    State string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    State string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    state String
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    state string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    state str
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    state String
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.

    Look up Existing WorkloadIdentityPoolManagedIdentity Resource

    Get an existing WorkloadIdentityPoolManagedIdentity resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: WorkloadIdentityPoolManagedIdentityState, opts?: CustomResourceOptions): WorkloadIdentityPoolManagedIdentity
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        description: Optional[str] = None,
        disabled: Optional[bool] = None,
        name: Optional[str] = None,
        project: Optional[str] = None,
        state: Optional[str] = None,
        workload_identity_pool_id: Optional[str] = None,
        workload_identity_pool_managed_identity_id: Optional[str] = None,
        workload_identity_pool_namespace_id: Optional[str] = None) -> WorkloadIdentityPoolManagedIdentity
    func GetWorkloadIdentityPoolManagedIdentity(ctx *Context, name string, id IDInput, state *WorkloadIdentityPoolManagedIdentityState, opts ...ResourceOption) (*WorkloadIdentityPoolManagedIdentity, error)
    public static WorkloadIdentityPoolManagedIdentity Get(string name, Input<string> id, WorkloadIdentityPoolManagedIdentityState? state, CustomResourceOptions? opts = null)
    public static WorkloadIdentityPoolManagedIdentity get(String name, Output<String> id, WorkloadIdentityPoolManagedIdentityState state, CustomResourceOptions options)
    resources:  _:    type: gcp:iam:WorkloadIdentityPoolManagedIdentity    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Description string
    A description of the managed identity. Cannot exceed 256 characters.
    Disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    Name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    State string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    WorkloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    WorkloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    WorkloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    Description string
    A description of the managed identity. Cannot exceed 256 characters.
    Disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    Name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    State string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    WorkloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    WorkloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    WorkloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description String
    A description of the managed identity. Cannot exceed 256 characters.
    disabled Boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    name String
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state String
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    workloadIdentityPoolId String
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId String

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId String

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description string
    A description of the managed identity. Cannot exceed 256 characters.
    disabled boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    name string
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state string
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    workloadIdentityPoolId string
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId string

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId string

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description str
    A description of the managed identity. Cannot exceed 256 characters.
    disabled bool
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    name str
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state str
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    workload_identity_pool_id str
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workload_identity_pool_managed_identity_id str

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workload_identity_pool_namespace_id str

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    description String
    A description of the managed identity. Cannot exceed 256 characters.
    disabled Boolean
    Whether the managed identity is disabled. If disabled, credentials may no longer be issued for the identity, however existing credentials will still be accepted until they expire.
    name String
    The resource name of the managed identity as projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    state String
    The current state of the managed identity.

    • ACTIVE: The managed identity is active.
    • DELETED: The managed identity is soft-deleted. Soft-deleted managed identities are permanently deleted after approximately 30 days. You can restore a soft-deleted managed identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a soft-deleted managed identity until it is permanently deleted.
    workloadIdentityPoolId String
    The ID to use for the pool, which becomes the final component of the resource name. This value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix gcp- is reserved for use by Google, and may not be specified.
    workloadIdentityPoolManagedIdentityId String

    The ID to use for the managed identity. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    workloadIdentityPoolNamespaceId String

    The ID to use for the namespace. This value must:

    • contain at most 63 characters
    • contain only lowercase alphanumeric characters or -
    • start with an alphanumeric character
    • end with an alphanumeric character

    The prefix gcp- will be reserved for future uses.

    Import

    WorkloadIdentityPoolManagedIdentity can be imported using any of these accepted formats:

    • projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}

    • {{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}

    • {{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}

    When using the pulumi import command, WorkloadIdentityPoolManagedIdentity can be imported using one of the formats above. For example:

    $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}

    $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{project}}/{{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}

    $ pulumi import gcp:iam/workloadIdentityPoolManagedIdentity:WorkloadIdentityPoolManagedIdentity default {{workload_identity_pool_id}}/{{workload_identity_pool_namespace_id}}/{{workload_identity_pool_managed_identity_id}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Google Cloud v8.33.0 published on Wednesday, Jun 4, 2025 by Pulumi
    pulumi/pulumi-gcp