"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.Authority = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
 * A CertificateAuthority represents an individual Certificate Authority. A
 * CertificateAuthority can be used to create Certificates.
 *
 * To get more information about CertificateAuthority, see:
 *
 * * [API documentation](https://cloud.google.com/certificate-authority-service/docs/reference/rest)
 * * How-to Guides
 *     * [Official Documentation](https://cloud.google.com/certificate-authority-service)
 *
 * > **Warning:** On newer versions of the provider, you must explicitly set `deletion_protection=false`
 * (and run `pulumi up` to write the field to state) in order to destroy a CertificateAuthority.
 * It is recommended to not set this field (or set it to true) until you're ready to destroy.
 *
 * ## Example Usage
 *
 * ### Privateca Certificate Authority Basic
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "ACME",
 *                 commonName: "my-certificate-authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     lifetime: `${10 * 365 * 24 * 3600}s`,
 *     keySpec: {
 *         algorithm: "RSA_PKCS1_4096_SHA256",
 *     },
 * });
 * ```
 * ### Privateca Certificate Authority Basic No Org
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 commonName: "my-certificate-authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     lifetime: `${10 * 365 * 24 * 3600}s`,
 *     keySpec: {
 *         algorithm: "RSA_PKCS1_4096_SHA256",
 *     },
 * });
 * ```
 * ### Privateca Certificate Authority Subordinate
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const root_ca = new gcp.certificateauthority.Authority("root-ca", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority-root",
 *     location: "us-central1",
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "ACME",
 *                 commonName: "my-certificate-authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     keySpec: {
 *         algorithm: "RSA_PKCS1_4096_SHA256",
 *     },
 *     deletionProtection: false,
 *     skipGracePeriod: true,
 *     ignoreActiveCertificatesOnDeletion: true,
 * });
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority-sub",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     subordinateConfig: {
 *         certificateAuthority: root_ca.name,
 *     },
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "ACME",
 *                 commonName: "my-subordinate-authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *                 zeroMaxIssuerPathLength: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     lifetime: `${5 * 365 * 24 * 3600}s`,
 *     keySpec: {
 *         algorithm: "RSA_PKCS1_2048_SHA256",
 *     },
 *     type: "SUBORDINATE",
 * });
 * ```
 * ### Privateca Certificate Authority Byo Key
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const privatecaSa = new gcp.projects.ServiceIdentity("privateca_sa", {service: "privateca.googleapis.com"});
 * const privatecaSaKeyuserSignerverifier = new gcp.kms.CryptoKeyIAMMember("privateca_sa_keyuser_signerverifier", {
 *     cryptoKeyId: "projects/keys-project/locations/us-central1/keyRings/key-ring/cryptoKeys/crypto-key",
 *     role: "roles/cloudkms.signerVerifier",
 *     member: privatecaSa.member,
 * });
 * const privatecaSaKeyuserViewer = new gcp.kms.CryptoKeyIAMMember("privateca_sa_keyuser_viewer", {
 *     cryptoKeyId: "projects/keys-project/locations/us-central1/keyRings/key-ring/cryptoKeys/crypto-key",
 *     role: "roles/viewer",
 *     member: privatecaSa.member,
 * });
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     keySpec: {
 *         cloudKmsKeyVersion: "projects/keys-project/locations/us-central1/keyRings/key-ring/cryptoKeys/crypto-key/cryptoKeyVersions/1",
 *     },
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "Example, Org.",
 *                 commonName: "Example Authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *             nameConstraints: {
 *                 critical: true,
 *                 permittedDnsNames: ["*.example.com"],
 *                 excludedDnsNames: ["*.deny.example.com"],
 *                 permittedIpRanges: ["10.0.0.0/8"],
 *                 excludedIpRanges: ["10.1.1.0/24"],
 *                 permittedEmailAddresses: [".example.com"],
 *                 excludedEmailAddresses: [".deny.example.com"],
 *                 permittedUris: [".example.com"],
 *                 excludedUris: [".deny.example.com"],
 *             },
 *         },
 *     },
 * }, {
 *     dependsOn: [
 *         privatecaSaKeyuserSignerverifier,
 *         privatecaSaKeyuserViewer,
 *     ],
 * });
 * ```
 * ### Privateca Certificate Authority Custom Ski
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "ACME",
 *                 commonName: "my-certificate-authority",
 *             },
 *         },
 *         subjectKeyId: {
 *             keyId: "4cf3372289b1d411b999dbb9ebcd44744b6b2fca",
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     lifetime: `${10 * 365 * 24 * 3600}s`,
 *     keySpec: {
 *         cloudKmsKeyVersion: "projects/keys-project/locations/us-central1/keyRings/key-ring/cryptoKeys/crypto-key/cryptoKeyVersions/1",
 *     },
 * });
 * ```
 * ### Privateca Certificate Authority Basic With Custom Cdp Aia Urls
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.certificateauthority.Authority("default", {
 *     pool: "ca-pool",
 *     certificateAuthorityId: "my-certificate-authority",
 *     location: "us-central1",
 *     deletionProtection: true,
 *     config: {
 *         subjectConfig: {
 *             subject: {
 *                 organization: "ACME",
 *                 commonName: "my-certificate-authority",
 *             },
 *         },
 *         x509Config: {
 *             caOptions: {
 *                 isCa: true,
 *             },
 *             keyUsage: {
 *                 baseKeyUsage: {
 *                     certSign: true,
 *                     crlSign: true,
 *                 },
 *                 extendedKeyUsage: {},
 *             },
 *         },
 *     },
 *     lifetime: `${10 * 365 * 24 * 3600}s`,
 *     keySpec: {
 *         algorithm: "RSA_PKCS1_4096_SHA256",
 *     },
 *     userDefinedAccessUrls: {
 *         aiaIssuingCertificateUrls: [
 *             "http://example.com/ca.crt",
 *             "http://example.com/anotherca.crt",
 *         ],
 *         crlAccessUrls: [
 *             "http://example.com/crl1.crt",
 *             "http://example.com/crl2.crt",
 *         ],
 *     },
 * });
 * ```
 *
 * ## Import
 *
 * CertificateAuthority can be imported using any of these accepted formats:
 *
 * * `projects/{{project}}/locations/{{location}}/caPools/{{pool}}/certificateAuthorities/{{certificate_authority_id}}`
 *
 * * `{{project}}/{{location}}/{{pool}}/{{certificate_authority_id}}`
 *
 * * `{{location}}/{{pool}}/{{certificate_authority_id}}`
 *
 * When using the `pulumi import` command, CertificateAuthority can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:certificateauthority/authority:Authority default projects/{{project}}/locations/{{location}}/caPools/{{pool}}/certificateAuthorities/{{certificate_authority_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:certificateauthority/authority:Authority default {{project}}/{{location}}/{{pool}}/{{certificate_authority_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:certificateauthority/authority:Authority default {{location}}/{{pool}}/{{certificate_authority_id}}
 * ```
 */
class Authority extends pulumi.CustomResource {
    /**
     * Get an existing Authority resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name, id, state, opts) {
        return new Authority(name, state, { ...opts, id: id });
    }
    /**
     * Returns true if the given object is an instance of Authority.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj) {
        if (obj === undefined || obj === null) {
            return false;
        }
        return obj['__pulumiType'] === Authority.__pulumiType;
    }
    constructor(name, argsOrState, opts) {
        let resourceInputs = {};
        opts = opts || {};
        if (opts.id) {
            const state = argsOrState;
            resourceInputs["accessUrls"] = state?.accessUrls;
            resourceInputs["certificateAuthorityId"] = state?.certificateAuthorityId;
            resourceInputs["config"] = state?.config;
            resourceInputs["createTime"] = state?.createTime;
            resourceInputs["deletionProtection"] = state?.deletionProtection;
            resourceInputs["desiredState"] = state?.desiredState;
            resourceInputs["effectiveLabels"] = state?.effectiveLabels;
            resourceInputs["gcsBucket"] = state?.gcsBucket;
            resourceInputs["ignoreActiveCertificatesOnDeletion"] = state?.ignoreActiveCertificatesOnDeletion;
            resourceInputs["keySpec"] = state?.keySpec;
            resourceInputs["labels"] = state?.labels;
            resourceInputs["lifetime"] = state?.lifetime;
            resourceInputs["location"] = state?.location;
            resourceInputs["name"] = state?.name;
            resourceInputs["pemCaCertificate"] = state?.pemCaCertificate;
            resourceInputs["pemCaCertificates"] = state?.pemCaCertificates;
            resourceInputs["pool"] = state?.pool;
            resourceInputs["project"] = state?.project;
            resourceInputs["pulumiLabels"] = state?.pulumiLabels;
            resourceInputs["skipGracePeriod"] = state?.skipGracePeriod;
            resourceInputs["state"] = state?.state;
            resourceInputs["subordinateConfig"] = state?.subordinateConfig;
            resourceInputs["type"] = state?.type;
            resourceInputs["updateTime"] = state?.updateTime;
            resourceInputs["userDefinedAccessUrls"] = state?.userDefinedAccessUrls;
        }
        else {
            const args = argsOrState;
            if (args?.certificateAuthorityId === undefined && !opts.urn) {
                throw new Error("Missing required property 'certificateAuthorityId'");
            }
            if (args?.config === undefined && !opts.urn) {
                throw new Error("Missing required property 'config'");
            }
            if (args?.keySpec === undefined && !opts.urn) {
                throw new Error("Missing required property 'keySpec'");
            }
            if (args?.location === undefined && !opts.urn) {
                throw new Error("Missing required property 'location'");
            }
            if (args?.pool === undefined && !opts.urn) {
                throw new Error("Missing required property 'pool'");
            }
            resourceInputs["certificateAuthorityId"] = args?.certificateAuthorityId;
            resourceInputs["config"] = args?.config;
            resourceInputs["deletionProtection"] = args?.deletionProtection;
            resourceInputs["desiredState"] = args?.desiredState;
            resourceInputs["gcsBucket"] = args?.gcsBucket;
            resourceInputs["ignoreActiveCertificatesOnDeletion"] = args?.ignoreActiveCertificatesOnDeletion;
            resourceInputs["keySpec"] = args?.keySpec;
            resourceInputs["labels"] = args?.labels;
            resourceInputs["lifetime"] = args?.lifetime;
            resourceInputs["location"] = args?.location;
            resourceInputs["pemCaCertificate"] = args?.pemCaCertificate;
            resourceInputs["pool"] = args?.pool;
            resourceInputs["project"] = args?.project;
            resourceInputs["skipGracePeriod"] = args?.skipGracePeriod;
            resourceInputs["subordinateConfig"] = args?.subordinateConfig;
            resourceInputs["type"] = args?.type;
            resourceInputs["userDefinedAccessUrls"] = args?.userDefinedAccessUrls;
            resourceInputs["accessUrls"] = undefined /*out*/;
            resourceInputs["createTime"] = undefined /*out*/;
            resourceInputs["effectiveLabels"] = undefined /*out*/;
            resourceInputs["name"] = undefined /*out*/;
            resourceInputs["pemCaCertificates"] = undefined /*out*/;
            resourceInputs["pulumiLabels"] = undefined /*out*/;
            resourceInputs["state"] = undefined /*out*/;
            resourceInputs["updateTime"] = undefined /*out*/;
        }
        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
        const secretOpts = { additionalSecretOutputs: ["effectiveLabels", "pulumiLabels"] };
        opts = pulumi.mergeOptions(opts, secretOpts);
        super(Authority.__pulumiType, name, resourceInputs, opts);
    }
}
exports.Authority = Authority;
/** @internal */
Authority.__pulumiType = 'gcp:certificateauthority/authority:Authority';
//# sourceMappingURL=authority.js.map