AivenOrganization

Service-level Aiven organisation governance component.

Remarks

This component orchestrates organisation creation/reference, datasource user resolution (with optional API invitations), user groups, group memberships, and permissions within one service-level resource.

Naming:

The component type is ${namespace}:aiven:AivenOrganization; capability segment aiven-organization produces ${env}-${projectHash}-aiven-organization-${sanitised args.identity}. args.identity is logical-only.
aiven:index/organization:Organization, when configured, uses [args.identity]. Under parent ${namespace}:aiven:AivenOrganization, its final logical name is ${env}-${projectHash}-${sanitised args.identity}. Its semantic provider name comes from args.organization.name, is trimmed by existing component validation, and is otherwise left in Aiven-native form; Aiven owns its constraints.
Dynamic invitation and deletion children share the pulumi-nodejs:dynamic:Resource type, so use [args.identity, "invitation" | "deletion", args.users.<key>] in one collision group. Under parent ${namespace}:aiven:AivenOrganization, their final names are ${env}-${projectHash}-${sanitised args.identity}-invitation|deletion-${sanitised args.users.<key>}. They use the configured user e-mail and organisation ID for Aiven API calls, rather than a provider resource name.
aiven:index/organizationUserGroup:OrganizationUserGroup uses [args.identity, args.userGroups.<key>]; provider name and description come from the map value, are trimmed by existing validation, and retain Aiven-native semantics. Under parent ${namespace}:aiven:AivenOrganization, its final logical name is ${env}-${projectHash}-${sanitised args.identity}-${sanitised args.userGroups.<key>}.
aiven:index/organizationUserGroupMember:OrganizationUserGroupMember uses [args.identity, args.groupMembers.<key>]. Under parent ${namespace}:aiven:AivenOrganization, its final logical name is ${env}-${projectHash}-${sanitised args.identity}-${sanitised args.groupMembers.<key>}.
aiven:index/organizationPermission:OrganizationPermission uses [args.identity, args.permissions.<key>]. Membership and permission provider values are semantic references forwarded unchanged after component reference resolution. Under parent ${namespace}:aiven:AivenOrganization, its final logical name is ${env}-${projectHash}-${sanitised args.identity}-${sanitised args.permissions.<key>}. All map keys are the sole child identities; no map value exposes a second key field.

When args.authoritativeUserManagement is true, users loaded from args.usersFilePath are treated as authoritative. Deployment fails fast if existing organisation users are found that are not declared in that configured user set.

When args.deleteUsersOnDestroy is true, destroy-time lifecycle operations attempt to remove managed users via the Aiven API. When false, destroy skips those user deletion API calls.

Example

CODE

const organisation = new AivenOrganization({
  identity: 'org-governance',
  organizationId: 'org1234567890',
  deleteUsersOnDestroy: true,
  authoritativeUserManagement: true,
  userInvitations: {
    apiToken: pulumi.secret(process.env.AIVEN_API_TOKEN ?? ''),
  },
  eligibleGroupUserKeys: ['alice@example.com'],
  usersFilePath: 'config/aiven/users.json',
  userGroupsFilePath: 'config/aiven/user-groups.json',
  groupMembersFilePath: 'config/aiven/group-members.json',
  eligiblePermissionUserKeys: ['alice@example.com'],
  permissionsFilePath: 'config/aiven/permissions.json',
});

Constructors

`new AivenOrganization( args: AivenOrganizationArgs, options?: ComponentResourceOptions, ): AivenOrganization`

Parameters

args (AivenOrganizationArgs) — Organisation source and capability arguments.
options (ComponentResourceOptions, optional) — Pulumi resource options.

Returns

AivenOrganization

Hierarchy

ComponentResource
AivenOrganization

Properties

`groupIdsByKey: Record<string, pulumi.Output<string>>`

readonly

Convenience map of group IDs keyed by resolved group key.

`groupMembers: Record<string, aiven.OrganizationUserGroupMember>`

readonly

Managed organisation user group memberships keyed by resolved membership key.

`organization: Organization | undefined`

readonly

Optional organisation resource when args.organization is provided.

`organizationId: Output<string>`

readonly

Resolved organisation ID from existing or managed source.

`permissions: Record<string, aiven.OrganizationPermission>`

readonly

Managed organisation permissions keyed by resolved permission key.

Permission keys can be omitted from this map when all configured grants for the permission are filtered out by eligibility rules.

`urn: Output<string>`

readonly

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

`userGroups: Record<string, aiven.OrganizationUserGroup>`

readonly

Managed organisation user groups keyed by resolved group key.

`userIdsByKey: Record<string, pulumi.Output<string>>`

readonly

Convenience map of user IDs keyed by resolved user key.

`users: Record<string, pulumi.Output<aiven.GetOrganizationUserResult>>`

readonly

Resolved organisation users keyed by resolved user key.

Methods

`getData(): Promise<any>`

protectedasync

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

Promise<any>

`getProvider(moduleMember: string): ProviderResource | undefined`

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

moduleMember (string)

Returns

ProviderResource | undefined

`initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>`

protectedasync

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

args (Inputs)
opts (ComponentResourceOptions, optional)
name (string, optional)
type (string, optional)

Returns

Promise<any>

`registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void`

protected

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

void

Static Methods

`isInstance(obj: any): obj is ComponentResource<any>`

static

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

obj (any)

Returns

obj is ComponentResource<any>