// *** WARNING: this file was generated by pulumi-java-gen. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

package com.pulumi.azure.compute;

import com.pulumi.azure.Utilities;
import com.pulumi.azure.compute.DiskEncryptionSetArgs;
import com.pulumi.azure.compute.inputs.DiskEncryptionSetState;
import com.pulumi.azure.compute.outputs.DiskEncryptionSetIdentity;
import com.pulumi.core.Output;
import com.pulumi.core.annotations.Export;
import com.pulumi.core.annotations.ResourceType;
import com.pulumi.core.internal.Codegen;
import java.lang.Boolean;
import java.lang.String;
import java.util.Map;
import java.util.Optional;
import javax.annotation.Nullable;

/**
 * Manages a Disk Encryption Set.
 * 
 * &gt; **NOTE:** At this time the Key Vault used to store the Active Key for this Disk Encryption Set must have both Soft Delete &amp; Purge Protection enabled - which are not yet supported by this provider.
 * 
 * ## Example Usage
 * ```java
 * package generated_program;
 * 
 * import com.pulumi.Context;
 * import com.pulumi.Pulumi;
 * import com.pulumi.core.Output;
 * import com.pulumi.azure.core.CoreFunctions;
 * import com.pulumi.azure.core.ResourceGroup;
 * import com.pulumi.azure.core.ResourceGroupArgs;
 * import com.pulumi.azure.keyvault.KeyVault;
 * import com.pulumi.azure.keyvault.KeyVaultArgs;
 * import com.pulumi.azure.keyvault.AccessPolicy;
 * import com.pulumi.azure.keyvault.AccessPolicyArgs;
 * import com.pulumi.azure.keyvault.Key;
 * import com.pulumi.azure.keyvault.KeyArgs;
 * import com.pulumi.azure.compute.DiskEncryptionSet;
 * import com.pulumi.azure.compute.DiskEncryptionSetArgs;
 * import com.pulumi.azure.compute.inputs.DiskEncryptionSetIdentityArgs;
 * import com.pulumi.azure.authorization.Assignment;
 * import com.pulumi.azure.authorization.AssignmentArgs;
 * import com.pulumi.resources.CustomResourceOptions;
 * import java.util.List;
 * import java.util.ArrayList;
 * import java.util.Map;
 * import java.io.File;
 * import java.nio.file.Files;
 * import java.nio.file.Paths;
 * 
 * public class App {
 *     public static void main(String[] args) {
 *         Pulumi.run(App::stack);
 *     }
 * 
 *     public static void stack(Context ctx) {
 *         final var current = CoreFunctions.getClientConfig();
 * 
 *         var exampleResourceGroup = new ResourceGroup(&#34;exampleResourceGroup&#34;, ResourceGroupArgs.builder()        
 *             .location(&#34;West Europe&#34;)
 *             .build());
 * 
 *         var exampleKeyVault = new KeyVault(&#34;exampleKeyVault&#34;, KeyVaultArgs.builder()        
 *             .location(exampleResourceGroup.location())
 *             .resourceGroupName(exampleResourceGroup.name())
 *             .tenantId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.tenantId()))
 *             .skuName(&#34;premium&#34;)
 *             .enabledForDiskEncryption(true)
 *             .purgeProtectionEnabled(true)
 *             .build());
 * 
 *         var example_user = new AccessPolicy(&#34;example-user&#34;, AccessPolicyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .tenantId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.tenantId()))
 *             .objectId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.objectId()))
 *             .keyPermissions(            
 *                 &#34;Create&#34;,
 *                 &#34;Delete&#34;,
 *                 &#34;Get&#34;,
 *                 &#34;Purge&#34;,
 *                 &#34;Recover&#34;,
 *                 &#34;Update&#34;,
 *                 &#34;List&#34;,
 *                 &#34;Decrypt&#34;,
 *                 &#34;Sign&#34;,
 *                 &#34;GetRotationPolicy&#34;)
 *             .build());
 * 
 *         var exampleKey = new Key(&#34;exampleKey&#34;, KeyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .keyType(&#34;RSA&#34;)
 *             .keySize(2048)
 *             .keyOpts(            
 *                 &#34;decrypt&#34;,
 *                 &#34;encrypt&#34;,
 *                 &#34;sign&#34;,
 *                 &#34;unwrapKey&#34;,
 *                 &#34;verify&#34;,
 *                 &#34;wrapKey&#34;)
 *             .build(), CustomResourceOptions.builder()
 *                 .dependsOn(example_user)
 *                 .build());
 * 
 *         var exampleDiskEncryptionSet = new DiskEncryptionSet(&#34;exampleDiskEncryptionSet&#34;, DiskEncryptionSetArgs.builder()        
 *             .resourceGroupName(exampleResourceGroup.name())
 *             .location(exampleResourceGroup.location())
 *             .keyVaultKeyId(exampleKey.id())
 *             .identity(DiskEncryptionSetIdentityArgs.builder()
 *                 .type(&#34;SystemAssigned&#34;)
 *                 .build())
 *             .build());
 * 
 *         var example_diskAccessPolicy = new AccessPolicy(&#34;example-diskAccessPolicy&#34;, AccessPolicyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .tenantId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.tenantId()))
 *             .objectId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.principalId()))
 *             .keyPermissions(            
 *                 &#34;Create&#34;,
 *                 &#34;Delete&#34;,
 *                 &#34;Get&#34;,
 *                 &#34;Purge&#34;,
 *                 &#34;Recover&#34;,
 *                 &#34;Update&#34;,
 *                 &#34;List&#34;,
 *                 &#34;Decrypt&#34;,
 *                 &#34;Sign&#34;)
 *             .build());
 * 
 *         var example_diskAssignment = new Assignment(&#34;example-diskAssignment&#34;, AssignmentArgs.builder()        
 *             .scope(exampleKeyVault.id())
 *             .roleDefinitionName(&#34;Key Vault Crypto Service Encryption User&#34;)
 *             .principalId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.principalId()))
 *             .build());
 * 
 *     }
 * }
 * ```
 * ### With Automatic Key Rotation Enabled
 * ```java
 * package generated_program;
 * 
 * import com.pulumi.Context;
 * import com.pulumi.Pulumi;
 * import com.pulumi.core.Output;
 * import com.pulumi.azure.core.CoreFunctions;
 * import com.pulumi.azure.core.ResourceGroup;
 * import com.pulumi.azure.core.ResourceGroupArgs;
 * import com.pulumi.azure.keyvault.KeyVault;
 * import com.pulumi.azure.keyvault.KeyVaultArgs;
 * import com.pulumi.azure.keyvault.AccessPolicy;
 * import com.pulumi.azure.keyvault.AccessPolicyArgs;
 * import com.pulumi.azure.keyvault.Key;
 * import com.pulumi.azure.keyvault.KeyArgs;
 * import com.pulumi.azure.compute.DiskEncryptionSet;
 * import com.pulumi.azure.compute.DiskEncryptionSetArgs;
 * import com.pulumi.azure.compute.inputs.DiskEncryptionSetIdentityArgs;
 * import com.pulumi.azure.authorization.Assignment;
 * import com.pulumi.azure.authorization.AssignmentArgs;
 * import com.pulumi.resources.CustomResourceOptions;
 * import java.util.List;
 * import java.util.ArrayList;
 * import java.util.Map;
 * import java.io.File;
 * import java.nio.file.Files;
 * import java.nio.file.Paths;
 * 
 * public class App {
 *     public static void main(String[] args) {
 *         Pulumi.run(App::stack);
 *     }
 * 
 *     public static void stack(Context ctx) {
 *         final var current = CoreFunctions.getClientConfig();
 * 
 *         var exampleResourceGroup = new ResourceGroup(&#34;exampleResourceGroup&#34;, ResourceGroupArgs.builder()        
 *             .location(&#34;West Europe&#34;)
 *             .build());
 * 
 *         var exampleKeyVault = new KeyVault(&#34;exampleKeyVault&#34;, KeyVaultArgs.builder()        
 *             .location(exampleResourceGroup.location())
 *             .resourceGroupName(exampleResourceGroup.name())
 *             .tenantId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.tenantId()))
 *             .skuName(&#34;premium&#34;)
 *             .enabledForDiskEncryption(true)
 *             .purgeProtectionEnabled(true)
 *             .build());
 * 
 *         var example_user = new AccessPolicy(&#34;example-user&#34;, AccessPolicyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .tenantId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.tenantId()))
 *             .objectId(current.applyValue(getClientConfigResult -&gt; getClientConfigResult.objectId()))
 *             .keyPermissions(            
 *                 &#34;Create&#34;,
 *                 &#34;Delete&#34;,
 *                 &#34;Get&#34;,
 *                 &#34;Purge&#34;,
 *                 &#34;Recover&#34;,
 *                 &#34;Update&#34;,
 *                 &#34;List&#34;,
 *                 &#34;Decrypt&#34;,
 *                 &#34;Sign&#34;,
 *                 &#34;GetRotationPolicy&#34;)
 *             .build());
 * 
 *         var exampleKey = new Key(&#34;exampleKey&#34;, KeyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .keyType(&#34;RSA&#34;)
 *             .keySize(2048)
 *             .keyOpts(            
 *                 &#34;decrypt&#34;,
 *                 &#34;encrypt&#34;,
 *                 &#34;sign&#34;,
 *                 &#34;unwrapKey&#34;,
 *                 &#34;verify&#34;,
 *                 &#34;wrapKey&#34;)
 *             .build(), CustomResourceOptions.builder()
 *                 .dependsOn(example_user)
 *                 .build());
 * 
 *         var exampleDiskEncryptionSet = new DiskEncryptionSet(&#34;exampleDiskEncryptionSet&#34;, DiskEncryptionSetArgs.builder()        
 *             .resourceGroupName(exampleResourceGroup.name())
 *             .location(exampleResourceGroup.location())
 *             .keyVaultKeyId(exampleKey.versionlessId())
 *             .autoKeyRotationEnabled(true)
 *             .identity(DiskEncryptionSetIdentityArgs.builder()
 *                 .type(&#34;SystemAssigned&#34;)
 *                 .build())
 *             .build());
 * 
 *         var example_diskAccessPolicy = new AccessPolicy(&#34;example-diskAccessPolicy&#34;, AccessPolicyArgs.builder()        
 *             .keyVaultId(exampleKeyVault.id())
 *             .tenantId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.tenantId()))
 *             .objectId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.principalId()))
 *             .keyPermissions(            
 *                 &#34;Create&#34;,
 *                 &#34;Delete&#34;,
 *                 &#34;Get&#34;,
 *                 &#34;Purge&#34;,
 *                 &#34;Recover&#34;,
 *                 &#34;Update&#34;,
 *                 &#34;List&#34;,
 *                 &#34;Decrypt&#34;,
 *                 &#34;Sign&#34;)
 *             .build());
 * 
 *         var example_diskAssignment = new Assignment(&#34;example-diskAssignment&#34;, AssignmentArgs.builder()        
 *             .scope(exampleKeyVault.id())
 *             .roleDefinitionName(&#34;Key Vault Crypto Service Encryption User&#34;)
 *             .principalId(exampleDiskEncryptionSet.identity().applyValue(identity -&gt; identity.principalId()))
 *             .build());
 * 
 *     }
 * }
 * ```
 * 
 * ## Import
 * 
 * Disk Encryption Sets can be imported using the `resource id`, e.g.
 * 
 * ```sh
 *  $ pulumi import azure:compute/diskEncryptionSet:DiskEncryptionSet example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.Compute/diskEncryptionSets/encryptionSet1
 * ```
 * 
 */
@ResourceType(type="azure:compute/diskEncryptionSet:DiskEncryptionSet")
public class DiskEncryptionSet extends com.pulumi.resources.CustomResource {
    @Export(name="autoKeyRotationEnabled", refs={Boolean.class}, tree="[0]")
    private Output</* @Nullable */ Boolean> autoKeyRotationEnabled;

    public Output<Optional<Boolean>> autoKeyRotationEnabled() {
        return Codegen.optional(this.autoKeyRotationEnabled);
    }
    /**
     * The type of key used to encrypt the data of the disk. Possible values are `EncryptionAtRestWithCustomerKey`, `EncryptionAtRestWithPlatformAndCustomerKeys` and `ConfidentialVmEncryptedWithCustomerKey`. Defaults to `EncryptionAtRestWithCustomerKey`. Changing this forces a new resource to be created.
     * 
     */
    @Export(name="encryptionType", refs={String.class}, tree="[0]")
    private Output</* @Nullable */ String> encryptionType;

    /**
     * @return The type of key used to encrypt the data of the disk. Possible values are `EncryptionAtRestWithCustomerKey`, `EncryptionAtRestWithPlatformAndCustomerKeys` and `ConfidentialVmEncryptedWithCustomerKey`. Defaults to `EncryptionAtRestWithCustomerKey`. Changing this forces a new resource to be created.
     * 
     */
    public Output<Optional<String>> encryptionType() {
        return Codegen.optional(this.encryptionType);
    }
    /**
     * Multi-tenant application client id to access key vault in a different tenant.
     * 
     */
    @Export(name="federatedClientId", refs={String.class}, tree="[0]")
    private Output</* @Nullable */ String> federatedClientId;

    /**
     * @return Multi-tenant application client id to access key vault in a different tenant.
     * 
     */
    public Output<Optional<String>> federatedClientId() {
        return Codegen.optional(this.federatedClientId);
    }
    /**
     * An `identity` block as defined below.
     * 
     */
    @Export(name="identity", refs={DiskEncryptionSetIdentity.class}, tree="[0]")
    private Output<DiskEncryptionSetIdentity> identity;

    /**
     * @return An `identity` block as defined below.
     * 
     */
    public Output<DiskEncryptionSetIdentity> identity() {
        return this.identity;
    }
    /**
     * Specifies the URL to a Key Vault Key (either from a Key Vault Key, or the Key URL for the Key Vault Secret).
     * 
     * &gt; **NOTE** Access to the KeyVault must be granted for this Disk Encryption Set, if you want to further use this Disk Encryption Set in a Managed Disk or Virtual Machine, or Virtual Machine Scale Set. For instructions, please refer to the doc of [Server side encryption of Azure managed disks](https://docs.microsoft.com/azure/virtual-machines/linux/disk-encryption).
     * 
     * &gt; **NOTE** A KeyVault using enable_rbac_authorization requires to use `azure.authorization.Assignment` to assigne the role `Key Vault Crypto Service Encryption User` to this Disk Encryption Set.
     * In this case, `azure.keyvault.AccessPolicy` is not needed.
     * 
     */
    @Export(name="keyVaultKeyId", refs={String.class}, tree="[0]")
    private Output<String> keyVaultKeyId;

    /**
     * @return Specifies the URL to a Key Vault Key (either from a Key Vault Key, or the Key URL for the Key Vault Secret).
     * 
     * &gt; **NOTE** Access to the KeyVault must be granted for this Disk Encryption Set, if you want to further use this Disk Encryption Set in a Managed Disk or Virtual Machine, or Virtual Machine Scale Set. For instructions, please refer to the doc of [Server side encryption of Azure managed disks](https://docs.microsoft.com/azure/virtual-machines/linux/disk-encryption).
     * 
     * &gt; **NOTE** A KeyVault using enable_rbac_authorization requires to use `azure.authorization.Assignment` to assigne the role `Key Vault Crypto Service Encryption User` to this Disk Encryption Set.
     * In this case, `azure.keyvault.AccessPolicy` is not needed.
     * 
     */
    public Output<String> keyVaultKeyId() {
        return this.keyVaultKeyId;
    }
    /**
     * The URL for the Key Vault Key or Key Vault Secret that is currently being used by the service.
     * 
     */
    @Export(name="keyVaultKeyUrl", refs={String.class}, tree="[0]")
    private Output<String> keyVaultKeyUrl;

    /**
     * @return The URL for the Key Vault Key or Key Vault Secret that is currently being used by the service.
     * 
     */
    public Output<String> keyVaultKeyUrl() {
        return this.keyVaultKeyUrl;
    }
    /**
     * Specifies the Azure Region where the Disk Encryption Set exists. Changing this forces a new resource to be created.
     * 
     */
    @Export(name="location", refs={String.class}, tree="[0]")
    private Output<String> location;

    /**
     * @return Specifies the Azure Region where the Disk Encryption Set exists. Changing this forces a new resource to be created.
     * 
     */
    public Output<String> location() {
        return this.location;
    }
    /**
     * The name of the Disk Encryption Set. Changing this forces a new resource to be created.
     * 
     */
    @Export(name="name", refs={String.class}, tree="[0]")
    private Output<String> name;

    /**
     * @return The name of the Disk Encryption Set. Changing this forces a new resource to be created.
     * 
     */
    public Output<String> name() {
        return this.name;
    }
    /**
     * Specifies the name of the Resource Group where the Disk Encryption Set should exist. Changing this forces a new resource to be created.
     * 
     */
    @Export(name="resourceGroupName", refs={String.class}, tree="[0]")
    private Output<String> resourceGroupName;

    /**
     * @return Specifies the name of the Resource Group where the Disk Encryption Set should exist. Changing this forces a new resource to be created.
     * 
     */
    public Output<String> resourceGroupName() {
        return this.resourceGroupName;
    }
    /**
     * A mapping of tags to assign to the Disk Encryption Set.
     * 
     */
    @Export(name="tags", refs={Map.class,String.class}, tree="[0,1,1]")
    private Output</* @Nullable */ Map<String,String>> tags;

    /**
     * @return A mapping of tags to assign to the Disk Encryption Set.
     * 
     */
    public Output<Optional<Map<String,String>>> tags() {
        return Codegen.optional(this.tags);
    }

    /**
     *
     * @param name The _unique_ name of the resulting resource.
     */
    public DiskEncryptionSet(String name) {
        this(name, DiskEncryptionSetArgs.Empty);
    }
    /**
     *
     * @param name The _unique_ name of the resulting resource.
     * @param args The arguments to use to populate this resource's properties.
     */
    public DiskEncryptionSet(String name, DiskEncryptionSetArgs args) {
        this(name, args, null);
    }
    /**
     *
     * @param name The _unique_ name of the resulting resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param options A bag of options that control this resource's behavior.
     */
    public DiskEncryptionSet(String name, DiskEncryptionSetArgs args, @Nullable com.pulumi.resources.CustomResourceOptions options) {
        super("azure:compute/diskEncryptionSet:DiskEncryptionSet", name, args == null ? DiskEncryptionSetArgs.Empty : args, makeResourceOptions(options, Codegen.empty()));
    }

    private DiskEncryptionSet(String name, Output<String> id, @Nullable DiskEncryptionSetState state, @Nullable com.pulumi.resources.CustomResourceOptions options) {
        super("azure:compute/diskEncryptionSet:DiskEncryptionSet", name, state, makeResourceOptions(options, id));
    }

    private static com.pulumi.resources.CustomResourceOptions makeResourceOptions(@Nullable com.pulumi.resources.CustomResourceOptions options, @Nullable Output<String> id) {
        var defaultOptions = com.pulumi.resources.CustomResourceOptions.builder()
            .version(Utilities.getVersion())
            .build();
        return com.pulumi.resources.CustomResourceOptions.merge(defaultOptions, options, id);
    }

    /**
     * Get an existing Host resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state
     * @param options Optional settings to control the behavior of the CustomResource.
     */
    public static DiskEncryptionSet get(String name, Output<String> id, @Nullable DiskEncryptionSetState state, @Nullable com.pulumi.resources.CustomResourceOptions options) {
        return new DiskEncryptionSet(name, id, state, options);
    }
}
