Group

Creates an Identity Group for Vault. The Identity secrets engine is the identity management solution for Vault.

A group can contain multiple entities as its members. A group can also have subgroups. Policies set on the group is granted to all members of the group. During request time, when the token’s entity ID is being evaluated for the policies that it has access to; along with the policies on the entity itself, policies that are inherited due to group memberships are also granted.

Example Usage

Internal Group

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var @internal = new Vault.Identity.Group("internal", new Vault.Identity.GroupArgs
        {
            Metadata = 
            {
                { "version", "2" },
            },
            Policies = 
            {
                "dev",
                "test",
            },
            Type = "internal",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v4/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewGroup(ctx, "internal", &identity.GroupArgs{
			Metadata: pulumi.StringMap{
				"version": pulumi.String("2"),
			},
			Policies: pulumi.StringArray{
				pulumi.String("dev"),
				pulumi.String("test"),
			},
			Type: pulumi.String("internal"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
import pulumi
import pulumi_vault as vault

internal = vault.identity.Group("internal",
    metadata={
        "version": "2",
    },
    policies=[
        "dev",
        "test",
    ],
    type="internal")
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const internal = new vault.identity.Group("internal", {
    metadata: {
        version: "2",
    },
    policies: [
        "dev",
        "test",
    ],
    type: "internal",
});

External Group

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var @group = new Vault.Identity.Group("group", new Vault.Identity.GroupArgs
        {
            Metadata = 
            {
                { "version", "1" },
            },
            Policies = 
            {
                "test",
            },
            Type = "external",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v4/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewGroup(ctx, "group", &identity.GroupArgs{
			Metadata: pulumi.StringMap{
				"version": pulumi.String("1"),
			},
			Policies: pulumi.StringArray{
				pulumi.String("test"),
			},
			Type: pulumi.String("external"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
import pulumi
import pulumi_vault as vault

group = vault.identity.Group("group",
    metadata={
        "version": "1",
    },
    policies=["test"],
    type="external")
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const group = new vault.identity.Group("group", {
    metadata: {
        version: "1",
    },
    policies: ["test"],
    type: "external",
});

Create a Group Resource

new Group(name: string, args?: GroupArgs, opts?: CustomResourceOptions);
@overload
def Group(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          external_member_entity_ids: Optional[bool] = None,
          external_policies: Optional[bool] = None,
          member_entity_ids: Optional[Sequence[str]] = None,
          member_group_ids: Optional[Sequence[str]] = None,
          metadata: Optional[Mapping[str, str]] = None,
          name: Optional[str] = None,
          policies: Optional[Sequence[str]] = None,
          type: Optional[str] = None)
@overload
def Group(resource_name: str,
          args: Optional[GroupArgs] = None,
          opts: Optional[ResourceOptions] = None)
func NewGroup(ctx *Context, name string, args *GroupArgs, opts ...ResourceOption) (*Group, error)
public Group(string name, GroupArgs? args = null, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args GroupArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args GroupArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args GroupArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args GroupArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

Group Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The Group resource accepts the following input properties:

ExternalMemberEntityIds bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
ExternalPolicies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds List<string>
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds List<string>
A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata Dictionary<string, string>
A Map of additional metadata to associate with the group.
Name string
Name of the identity group to create.
Policies List<string>
A list of policies to apply to the group.
Type string
Type of the group, internal or external. Defaults to internal.
ExternalMemberEntityIds bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
ExternalPolicies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds []string
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds []string
A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata map[string]string
A Map of additional metadata to associate with the group.
Name string
Name of the identity group to create.
Policies []string
A list of policies to apply to the group.
Type string
Type of the group, internal or external. Defaults to internal.
externalMemberEntityIds boolean
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
externalPolicies boolean
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
memberEntityIds string[]
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
memberGroupIds string[]
A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata {[key: string]: string}
A Map of additional metadata to associate with the group.
name string
Name of the identity group to create.
policies string[]
A list of policies to apply to the group.
type string
Type of the group, internal or external. Defaults to internal.
external_member_entity_ids bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
external_policies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
member_entity_ids Sequence[str]
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
member_group_ids Sequence[str]
A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata Mapping[str, str]
A Map of additional metadata to associate with the group.
name str
Name of the identity group to create.
policies Sequence[str]
A list of policies to apply to the group.
type str
Type of the group, internal or external. Defaults to internal.

Outputs

All input properties are implicitly available as output properties. Additionally, the Group resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing Group Resource

Get an existing Group resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupState, opts?: CustomResourceOptions): Group
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        external_member_entity_ids: Optional[bool] = None,
        external_policies: Optional[bool] = None,
        member_entity_ids: Optional[Sequence[str]] = None,
        member_group_ids: Optional[Sequence[str]] = None,
        metadata: Optional[Mapping[str, str]] = None,
        name: Optional[str] = None,
        policies: Optional[Sequence[str]] = None,
        type: Optional[str] = None) -> Group
func GetGroup(ctx *Context, name string, id IDInput, state *GroupState, opts ...ResourceOption) (*Group, error)
public static Group Get(string name, Input<string> id, GroupState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

ExternalMemberEntityIds bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
ExternalPolicies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds List<string>
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds List<string>
A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata Dictionary<string, string>
A Map of additional metadata to associate with the group.
Name string
Name of the identity group to create.
Policies List<string>
A list of policies to apply to the group.
Type string
Type of the group, internal or external. Defaults to internal.
ExternalMemberEntityIds bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
ExternalPolicies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds []string
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds []string
A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata map[string]string
A Map of additional metadata to associate with the group.
Name string
Name of the identity group to create.
Policies []string
A list of policies to apply to the group.
Type string
Type of the group, internal or external. Defaults to internal.
externalMemberEntityIds boolean
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
externalPolicies boolean
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
memberEntityIds string[]
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
memberGroupIds string[]
A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata {[key: string]: string}
A Map of additional metadata to associate with the group.
name string
Name of the identity group to create.
policies string[]
A list of policies to apply to the group.
type string
Type of the group, internal or external. Defaults to internal.
external_member_entity_ids bool
false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.
external_policies bool
false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
member_entity_ids Sequence[str]
A list of Entity IDs to be assigned as group members. Not allowed on external groups.
member_group_ids Sequence[str]
A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata Mapping[str, str]
A Map of additional metadata to associate with the group.
name str
Name of the identity group to create.
policies Sequence[str]
A list of policies to apply to the group.
type str
Type of the group, internal or external. Defaults to internal.

Import

Identity group can be imported using the id, e.g.

 $ pulumi import vault:identity/group:Group test 'fcbf1efb-2b69-4209-bed8-811e3475dad3'

Package Details

Repository
https://github.com/pulumi/pulumi-vault
License
Apache-2.0
Notes
This Pulumi package is based on the vault Terraform Provider.