AivenOrganizationArgs

interface AivenOrganizationArgs extends module:@jobcloud/pulumi-components..AivenOrganizationIdentityArgs {
authoritativeUserManagement: boolean;
deleteUsersOnDestroy: boolean;
eligibleGroupUserKeys?: string[];
eligiblePermissionUserKeys?: string[];
groupMembersFilePath?: string;
identity: string;
organization?: AivenOrganizationResourceArgs;
organizationId?: Input<string>;
permissionsFilePath?: string;
userGroupsFilePath?: string;
userInvitations: AivenOrganizationUserInvitationArgs;
usersFilePath?: string;
}

Input arguments for AivenOrganization.

Remarks

Organisation user, group, membership, and permission capability configuration is loaded from the matching *FilePath argument.

File path arguments resolve relative paths from the Pulumi process working directory. Each JSON file must contain a top-level object map using the serialisable subset of the corresponding capability argument type. JSON files cannot contain Pulumi Input values, Output values, promises, or other runtime expressions. Timeout objects in JSON support only non-empty create, delete, read, and update string fields.

Example

CODE

const args: AivenOrganizationArgs = {
  identity: 'platform-governance',
  organizationId: 'org1234567890',
  deleteUsersOnDestroy: true,
  authoritativeUserManagement: true,
  userInvitations: { apiToken: pulumi.secret(process.env.AIVEN_API_TOKEN ?? '') },
  eligibleGroupUserKeys: ['alice@example.com'],
  eligiblePermissionUserKeys: ['alice@example.com'],
  usersFilePath: 'config/aiven/users.json',
  userGroupsFilePath: 'config/aiven/user-groups.json',
  groupMembersFilePath: 'config/aiven/group-members.json',
  permissionsFilePath: 'config/aiven/permissions.json',
};

Hierarchy

AivenOrganizationIdentityArgs
AivenOrganizationArgs

Properties

`authoritativeUserManagement: boolean`

Controls whether configured users are treated as authoritative for organisation users.

When true, deployment fails fast if existing organisation users include e-mail addresses that are not loaded from args.usersFilePath.

`deleteUsersOnDestroy: boolean`

Controls whether user deletion API calls are executed when this component is destroyed.

When false, delete operations for user lifecycle resources are skipped.

`eligibleGroupUserKeys: string[]`

Optional eligibility filter for memberships referenced by userKey. When omitted, no userKey memberships are eligible by default. When provided, only memberships whose userKey is in this list are created. Eligible userKey memberships must resolve to non-empty user IDs, otherwise deployment fails fast. Memberships using direct userId are not filtered.

`eligiblePermissionUserKeys: string[]`

Optional eligibility filter for permission grants referenced by userKey. When omitted, no userKey grants are eligible by default. When provided, grants whose userKey is not in this list are skipped deterministically. Eligible userKey grants must resolve to non-empty principal IDs, otherwise deployment fails fast. Grants using groupKey or direct principal references are not filtered.

`groupMembersFilePath: string`

JSON file containing a key map of AivenOrganizationUserGroupMemberArgs. The map key is the membership identity.

`identity: string`

Inherited from identity

Required, non-empty plain string identity used to derive Pulumi logical names deterministically.

This value must be available synchronously (not a pulumi.Input/Output, promise, provider lookup, or apply-resolved value). It is sanitised by the shared logical-name builder before use in the component logical name.

`organization: AivenOrganizationResourceArgs`

Optional organisation creation configuration.

`organizationId: Input<string>`

Existing organisation ID.

`permissionsFilePath: string`

JSON file containing a key map of AivenOrganizationPermissionArgs. The map key is the permission identity.

`userGroupsFilePath: string`

JSON file containing a key map of AivenOrganizationUserGroupArgs. The map key is the group identity.

`userInvitations: AivenOrganizationUserInvitationArgs`

Invitation helper configuration.

This component pre-reads existing users and pending invitations, then invites only configured users that are neither existing members nor pending invitations.

`usersFilePath: string`

JSON file containing a key map of AivenOrganizationUserArgs. The map key is the user identity.