// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;

namespace Pulumi.AliCloud.CloudSso
{
    /// <summary>
    /// Provides a Cloud SSO Access Assignment resource.
    /// 
    /// For information about Cloud SSO Access Assignment and how to use it, see [What is Access Assignment](https://www.alibabacloud.com/help/en/doc-detail/265996.htm).
    /// 
    /// &gt; **NOTE:** When you configure access assignment for the first time, access configuration will be automatically deployed.
    /// 
    /// &gt; **NOTE:** Available in v1.145.0+.
    /// 
    /// &gt; **NOTE:** Cloud SSO Only Support `cn-shanghai` And `us-west-1` Region
    /// 
    /// ## Import
    /// 
    /// Cloud SSO Access Assignment can be imported using the id, e.g.
    /// 
    /// ```sh
    ///  $ pulumi import alicloud:cloudsso/accessManagement:AccessManagement example &lt;directory_id&gt;:&lt;access_configuration_id&gt;:&lt;target_type&gt;:&lt;target_id&gt;:&lt;principal_type&gt;:&lt;principal_id&gt;
    /// ```
    /// </summary>
    [AliCloudResourceType("alicloud:cloudsso/accessManagement:AccessManagement")]
    public partial class AccessManagement : global::Pulumi.CustomResource
    {
        /// <summary>
        /// The Access configuration ID.
        /// </summary>
        [Output("accessConfigurationId")]
        public Output<string> AccessConfigurationId { get; private set; } = null!;

        /// <summary>
        /// The deprovision strategy. Valid values: `DeprovisionForLastAccessAssignmentOnAccount` and `None`. Default Value: `DeprovisionForLastAccessAssignmentOnAccount`. **NOTE:** When `deprovision_strategy` is `DeprovisionForLastAccessAssignmentOnAccount`, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation。
        /// </summary>
        [Output("deprovisionStrategy")]
        public Output<string?> DeprovisionStrategy { get; private set; } = null!;

        /// <summary>
        /// The ID of the Directory.
        /// </summary>
        [Output("directoryId")]
        public Output<string> DirectoryId { get; private set; } = null!;

        /// <summary>
        /// The ID of the access assignment.
        /// </summary>
        [Output("principalId")]
        public Output<string> PrincipalId { get; private set; } = null!;

        /// <summary>
        /// The identity type of the access assignment, which can be a user or a user group. Valid values: `Group`, `User`.
        /// </summary>
        [Output("principalType")]
        public Output<string> PrincipalType { get; private set; } = null!;

        /// <summary>
        /// The ID of the target to create the resource range.
        /// </summary>
        [Output("targetId")]
        public Output<string> TargetId { get; private set; } = null!;

        /// <summary>
        /// The type of the resource range target to be accessed. Valid values: `RD-Account`.
        /// </summary>
        [Output("targetType")]
        public Output<string> TargetType { get; private set; } = null!;


        /// <summary>
        /// Create a AccessManagement resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public AccessManagement(string name, AccessManagementArgs args, CustomResourceOptions? options = null)
            : base("alicloud:cloudsso/accessManagement:AccessManagement", name, args ?? new AccessManagementArgs(), MakeResourceOptions(options, ""))
        {
        }

        private AccessManagement(string name, Input<string> id, AccessManagementState? state = null, CustomResourceOptions? options = null)
            : base("alicloud:cloudsso/accessManagement:AccessManagement", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/rhysmdnz/pulumi-alicloud",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing AccessManagement resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static AccessManagement Get(string name, Input<string> id, AccessManagementState? state = null, CustomResourceOptions? options = null)
        {
            return new AccessManagement(name, id, state, options);
        }
    }

    public sealed class AccessManagementArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// The Access configuration ID.
        /// </summary>
        [Input("accessConfigurationId", required: true)]
        public Input<string> AccessConfigurationId { get; set; } = null!;

        /// <summary>
        /// The deprovision strategy. Valid values: `DeprovisionForLastAccessAssignmentOnAccount` and `None`. Default Value: `DeprovisionForLastAccessAssignmentOnAccount`. **NOTE:** When `deprovision_strategy` is `DeprovisionForLastAccessAssignmentOnAccount`, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation。
        /// </summary>
        [Input("deprovisionStrategy")]
        public Input<string>? DeprovisionStrategy { get; set; }

        /// <summary>
        /// The ID of the Directory.
        /// </summary>
        [Input("directoryId", required: true)]
        public Input<string> DirectoryId { get; set; } = null!;

        /// <summary>
        /// The ID of the access assignment.
        /// </summary>
        [Input("principalId", required: true)]
        public Input<string> PrincipalId { get; set; } = null!;

        /// <summary>
        /// The identity type of the access assignment, which can be a user or a user group. Valid values: `Group`, `User`.
        /// </summary>
        [Input("principalType", required: true)]
        public Input<string> PrincipalType { get; set; } = null!;

        /// <summary>
        /// The ID of the target to create the resource range.
        /// </summary>
        [Input("targetId", required: true)]
        public Input<string> TargetId { get; set; } = null!;

        /// <summary>
        /// The type of the resource range target to be accessed. Valid values: `RD-Account`.
        /// </summary>
        [Input("targetType", required: true)]
        public Input<string> TargetType { get; set; } = null!;

        public AccessManagementArgs()
        {
        }
        public static new AccessManagementArgs Empty => new AccessManagementArgs();
    }

    public sealed class AccessManagementState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// The Access configuration ID.
        /// </summary>
        [Input("accessConfigurationId")]
        public Input<string>? AccessConfigurationId { get; set; }

        /// <summary>
        /// The deprovision strategy. Valid values: `DeprovisionForLastAccessAssignmentOnAccount` and `None`. Default Value: `DeprovisionForLastAccessAssignmentOnAccount`. **NOTE:** When `deprovision_strategy` is `DeprovisionForLastAccessAssignmentOnAccount`, and the access assignment to be deleted is the last access assignment for the same account and the same AC, this option is used for the undeployment operation。
        /// </summary>
        [Input("deprovisionStrategy")]
        public Input<string>? DeprovisionStrategy { get; set; }

        /// <summary>
        /// The ID of the Directory.
        /// </summary>
        [Input("directoryId")]
        public Input<string>? DirectoryId { get; set; }

        /// <summary>
        /// The ID of the access assignment.
        /// </summary>
        [Input("principalId")]
        public Input<string>? PrincipalId { get; set; }

        /// <summary>
        /// The identity type of the access assignment, which can be a user or a user group. Valid values: `Group`, `User`.
        /// </summary>
        [Input("principalType")]
        public Input<string>? PrincipalType { get; set; }

        /// <summary>
        /// The ID of the target to create the resource range.
        /// </summary>
        [Input("targetId")]
        public Input<string>? TargetId { get; set; }

        /// <summary>
        /// The type of the resource range target to be accessed. Valid values: `RD-Account`.
        /// </summary>
        [Input("targetType")]
        public Input<string>? TargetType { get; set; }

        public AccessManagementState()
        {
        }
        public static new AccessManagementState Empty => new AccessManagementState();
    }
}
