Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. CockroachDB Cloud
  3. API Docs
  4. JwtIssuer
CockroachDB v0.9.4 published on Friday, Mar 21, 2025 by pulumiverse
pulumiverse/pulumi-cockroach

cockroach.JwtIssuer

Explore with Pulumi AI

cockroach logo
CockroachDB v0.9.4 published on Friday, Mar 21, 2025 by pulumiverse
pulumiverse/pulumi-cockroach

    Configuration to manage external JSON Web Token (JWT) Issuers for authentication to the CockroachDB Cloud API.

    Example Usage

    Coming soon!

    Coming soon!

    Coming soon!

    Coming soon!

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cockroach.JwtIssuer;
import com.pulumi.cockroach.JwtIssuerArgs;
import com.pulumi.cockroach.inputs.JwtIssuerIdentityMapArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new JwtIssuer("example", JwtIssuerArgs.builder()
            .issuerUrl("https://accounts.google.com")
            .audience("test_audience")
            .jwks("{\"keys\":[{\"alg\":\"RS256\",\"e\":\"AQAB\",\"kid\":\"test_kid1\",\"kty\":\"RSA\",\"n\":\"09lq1lCEuteonwDJOhGTDak11ThplZuC9JEWQNdBnBSQwlkJQIE7A7nTBO0xTibcsh2HwYkC-N_Gs1jP4iwN3dRqnu5FwG2ct5mY8KLwJiHzToFC0MKenSFQCy0FviNtOnpiObcUlDvR2NDeNtMl_6SPzcQEt7GUTBBYZgoAxPmOgevki6ZNO6Y86xFqx3y6v8EPwW010AiC60r4AHGCTBhYF4uqmq5JH2UU4dDh9Udc-9LZxlSqPwJvnKDG2GjcnD8TsU3wjfEM_nRmx3dnXsrZUXYfNGtdv5dlHywf5AhkJmTavqcsJkgrNA-PNBghFMcCR816_kCIkCYWLWC5vQ\"}]}")
            .claim("email")
            .identityMaps(            
                JwtIssuerIdentityMapArgs.builder()
                    .token_identity("test_user")
                    .cc_identity("abc@example.com")
                    .build(),
                JwtIssuerIdentityMapArgs.builder()
                    .token_identity("/^sso_(.*)$")
                    .cc_identity("\\1@example.com")
                    .build())
            .build());

    }
}

    resources:
  example:
    type: cockroach:JwtIssuer
    properties:
      issuerUrl: https://accounts.google.com
      audience: test_audience
      jwks: '{"keys":[{"alg":"RS256","e":"AQAB","kid":"test_kid1","kty":"RSA","n":"09lq1lCEuteonwDJOhGTDak11ThplZuC9JEWQNdBnBSQwlkJQIE7A7nTBO0xTibcsh2HwYkC-N_Gs1jP4iwN3dRqnu5FwG2ct5mY8KLwJiHzToFC0MKenSFQCy0FviNtOnpiObcUlDvR2NDeNtMl_6SPzcQEt7GUTBBYZgoAxPmOgevki6ZNO6Y86xFqx3y6v8EPwW010AiC60r4AHGCTBhYF4uqmq5JH2UU4dDh9Udc-9LZxlSqPwJvnKDG2GjcnD8TsU3wjfEM_nRmx3dnXsrZUXYfNGtdv5dlHywf5AhkJmTavqcsJkgrNA-PNBghFMcCR816_kCIkCYWLWC5vQ"}]}'
      claim: email
      identityMaps:
        - token_identity: test_user
          cc_identity: abc@example.com
        - token_identity: /^sso_(.*)$
          cc_identity: \1@example.com

    Create JwtIssuer Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new JwtIssuer(name: string, args: JwtIssuerArgs, opts?: CustomResourceOptions);
    @overload
def JwtIssuer(resource_name: str,
              args: JwtIssuerArgs,
              opts: Optional[ResourceOptions] = None)

@overload
def JwtIssuer(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              audience: Optional[str] = None,
              issuer_url: Optional[str] = None,
              claim: Optional[str] = None,
              identity_maps: Optional[Sequence[JwtIssuerIdentityMapArgs]] = None,
              jwks: Optional[str] = None)
    func NewJwtIssuer(ctx *Context, name string, args JwtIssuerArgs, opts ...ResourceOption) (*JwtIssuer, error)
    public JwtIssuer(string name, JwtIssuerArgs args, CustomResourceOptions? opts = null)
    public JwtIssuer(String name, JwtIssuerArgs args)
public JwtIssuer(String name, JwtIssuerArgs args, CustomResourceOptions options)

    type: cockroach:JwtIssuer
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args JwtIssuerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args JwtIssuerArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args JwtIssuerArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args JwtIssuerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args JwtIssuerArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var jwtIssuerResource = new Cockroach.JwtIssuer("jwtIssuerResource", new()
{
    Audience = "string",
    IssuerUrl = "string",
    Claim = "string",
    IdentityMaps = new[]
    {
        new Cockroach.Inputs.JwtIssuerIdentityMapArgs
        {
            CcIdentity = "string",
            TokenIdentity = "string",
        },
    },
    Jwks = "string",
});

    example, err := cockroach.NewJwtIssuer(ctx, "jwtIssuerResource", &cockroach.JwtIssuerArgs{
	Audience:  pulumi.String("string"),
	IssuerUrl: pulumi.String("string"),
	Claim:     pulumi.String("string"),
	IdentityMaps: cockroach.JwtIssuerIdentityMapArray{
		&cockroach.JwtIssuerIdentityMapArgs{
			CcIdentity:    pulumi.String("string"),
			TokenIdentity: pulumi.String("string"),
		},
	},
	Jwks: pulumi.String("string"),
})

    var jwtIssuerResource = new JwtIssuer("jwtIssuerResource", JwtIssuerArgs.builder()
    .audience("string")
    .issuerUrl("string")
    .claim("string")
    .identityMaps(JwtIssuerIdentityMapArgs.builder()
        .ccIdentity("string")
        .tokenIdentity("string")
        .build())
    .jwks("string")
    .build());

    jwt_issuer_resource = cockroach.JwtIssuer("jwtIssuerResource",
    audience="string",
    issuer_url="string",
    claim="string",
    identity_maps=[{
        "cc_identity": "string",
        "token_identity": "string",
    }],
    jwks="string")

    const jwtIssuerResource = new cockroach.JwtIssuer("jwtIssuerResource", {
    audience: "string",
    issuerUrl: "string",
    claim: "string",
    identityMaps: [{
        ccIdentity: "string",
        tokenIdentity: "string",
    }],
    jwks: "string",
});

    type: cockroach:JwtIssuer
properties:
    audience: string
    claim: string
    identityMaps:
        - ccIdentity: string
          tokenIdentity: string
    issuerUrl: string
    jwks: string

    JwtIssuer Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The JwtIssuer resource accepts the following input properties:

    Audience string
    The intended audience for consuming the JWT.
    IssuerUrl string
    The URL of the server issuing JWTs.
    Claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    IdentityMaps List<Pulumiverse.Cockroach.Inputs.JwtIssuerIdentityMap>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    Jwks string
    A set of public keys (JWKS) used to verify the JWT.
    Audience string
    The intended audience for consuming the JWT.
    IssuerUrl string
    The URL of the server issuing JWTs.
    Claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    IdentityMaps []JwtIssuerIdentityMapArgs
    A list of mappings to map the external token identity into CockroachDB Cloud.
    Jwks string
    A set of public keys (JWKS) used to verify the JWT.
    audience String
    The intended audience for consuming the JWT.
    issuerUrl String
    The URL of the server issuing JWTs.
    claim String
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps List<JwtIssuerIdentityMap>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    jwks String
    A set of public keys (JWKS) used to verify the JWT.
    audience string
    The intended audience for consuming the JWT.
    issuerUrl string
    The URL of the server issuing JWTs.
    claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps JwtIssuerIdentityMap[]
    A list of mappings to map the external token identity into CockroachDB Cloud.
    jwks string
    A set of public keys (JWKS) used to verify the JWT.
    audience str
    The intended audience for consuming the JWT.
    issuer_url str
    The URL of the server issuing JWTs.
    claim str
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identity_maps Sequence[JwtIssuerIdentityMapArgs]
    A list of mappings to map the external token identity into CockroachDB Cloud.
    jwks str
    A set of public keys (JWKS) used to verify the JWT.
    audience String
    The intended audience for consuming the JWT.
    issuerUrl String
    The URL of the server issuing JWTs.
    claim String
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps List<Property Map>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    jwks String
    A set of public keys (JWKS) used to verify the JWT.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the JwtIssuer resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing JwtIssuer Resource

    Get an existing JwtIssuer resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: JwtIssuerState, opts?: CustomResourceOptions): JwtIssuer
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        audience: Optional[str] = None,
        claim: Optional[str] = None,
        identity_maps: Optional[Sequence[JwtIssuerIdentityMapArgs]] = None,
        issuer_url: Optional[str] = None,
        jwks: Optional[str] = None) -> JwtIssuer
    func GetJwtIssuer(ctx *Context, name string, id IDInput, state *JwtIssuerState, opts ...ResourceOption) (*JwtIssuer, error)
    public static JwtIssuer Get(string name, Input<string> id, JwtIssuerState? state, CustomResourceOptions? opts = null)
    public static JwtIssuer get(String name, Output<String> id, JwtIssuerState state, CustomResourceOptions options)
    resources:  _:    type: cockroach:JwtIssuer    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Audience string
    The intended audience for consuming the JWT.
    Claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    IdentityMaps List<Pulumiverse.Cockroach.Inputs.JwtIssuerIdentityMap>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    IssuerUrl string
    The URL of the server issuing JWTs.
    Jwks string
    A set of public keys (JWKS) used to verify the JWT.
    Audience string
    The intended audience for consuming the JWT.
    Claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    IdentityMaps []JwtIssuerIdentityMapArgs
    A list of mappings to map the external token identity into CockroachDB Cloud.
    IssuerUrl string
    The URL of the server issuing JWTs.
    Jwks string
    A set of public keys (JWKS) used to verify the JWT.
    audience String
    The intended audience for consuming the JWT.
    claim String
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps List<JwtIssuerIdentityMap>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    issuerUrl String
    The URL of the server issuing JWTs.
    jwks String
    A set of public keys (JWKS) used to verify the JWT.
    audience string
    The intended audience for consuming the JWT.
    claim string
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps JwtIssuerIdentityMap[]
    A list of mappings to map the external token identity into CockroachDB Cloud.
    issuerUrl string
    The URL of the server issuing JWTs.
    jwks string
    A set of public keys (JWKS) used to verify the JWT.
    audience str
    The intended audience for consuming the JWT.
    claim str
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identity_maps Sequence[JwtIssuerIdentityMapArgs]
    A list of mappings to map the external token identity into CockroachDB Cloud.
    issuer_url str
    The URL of the server issuing JWTs.
    jwks str
    A set of public keys (JWKS) used to verify the JWT.
    audience String
    The intended audience for consuming the JWT.
    claim String
    Used to identify the user from the external Identity Provider. Defaults to "sub".
    identityMaps List<Property Map>
    A list of mappings to map the external token identity into CockroachDB Cloud.
    issuerUrl String
    The URL of the server issuing JWTs.
    jwks String
    A set of public keys (JWKS) used to verify the JWT.

    Supporting Types

    JwtIssuerIdentityMap, JwtIssuerIdentityMapArgs

    CcIdentity string
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    TokenIdentity string
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.
    CcIdentity string
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    TokenIdentity string
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.
    ccIdentity String
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    tokenIdentity String
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.
    ccIdentity string
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    tokenIdentity string
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.
    cc_identity str
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    token_identity str
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.
    ccIdentity String
    Specifies how to map the fetched token identity to an identity in CockroachDB Cloud. In case of a regular expression for token_identity, this must contain a \1 placeholder for the matched content. Note that you will need to escape the backslash in the string as in the example usage (\1).
    tokenIdentity String
    Specifies how to fetch external identity from the token claim. A regular expression must start with a forward slash. The regular expression must be in RE2 compatible syntax. For further details, please see https://github.com/google/re2/wiki/Syntax.

    Import

    JWT Issuer ID can be found by running a GET against the Cockroach Cloud API to

    list all existing JWT issuers.

    https://www.cockroachlabs.com/docs/api/cloud/v1#get-/api/v1/jwt-issuers

    format: 

    $ pulumi import cockroach:index/jwtIssuer:JwtIssuer my_issuer 1f69fdd2-600a-4cfc-a9ba-16995df0d77d

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    cockroach pulumiverse/pulumi-cockroach
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cockroach Terraform Provider.
    cockroach logo
    CockroachDB v0.9.4 published on Friday, Mar 21, 2025 by pulumiverse
    pulumiverse/pulumi-cockroach