GroupAlias

Creates an Identity Group Alias for Vault. The Identity secrets engine is the identity management solution for Vault.

Group aliases allows entity membership in external groups to be managed semi-automatically. External group serves as a mapping to a group that is outside of the identity store. External groups can have one (and only one) alias. This alias should map to a notion of group that is outside of the identity store. For example, groups in LDAP, and teams in GitHub. A username in LDAP, belonging to a group in LDAP, can get its entity ID added as a member of a group in Vault automatically during logins and token renewals. This works only if the group in Vault is an external group and has an alias that maps to the group in LDAP. If the user is removed from the group in LDAP, that change gets reflected in Vault only upon the subsequent login or renewal operation.

Example Usage

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var @group = new Vault.Identity.Group("group", new Vault.Identity.GroupArgs
        {
            Type = "external",
            Policies = 
            {
                "test",
            },
        });
        var github = new Vault.AuthBackend("github", new Vault.AuthBackendArgs
        {
            Type = "github",
            Path = "github",
        });
        var group_alias = new Vault.Identity.GroupAlias("group-alias", new Vault.Identity.GroupAliasArgs
        {
            Name = "Github_Team_Slug",
            MountAccessor = github.Accessor,
            CanonicalId = @group.Id,
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v4/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v4/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		group, err := identity.NewGroup(ctx, "group", &identity.GroupArgs{
			Type: pulumi.String("external"),
			Policies: pulumi.StringArray{
				pulumi.String("test"),
			},
		})
		if err != nil {
			return err
		}
		github, err := vault.NewAuthBackend(ctx, "github", &vault.AuthBackendArgs{
			Type: pulumi.String("github"),
			Path: pulumi.String("github"),
		})
		if err != nil {
			return err
		}
		_, err = identity.NewGroupAlias(ctx, "group_alias", &identity.GroupAliasArgs{
			Name:          pulumi.String("Github_Team_Slug"),
			MountAccessor: github.Accessor,
			CanonicalId:   group.ID(),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
import pulumi
import pulumi_vault as vault

group = vault.identity.Group("group",
    type="external",
    policies=["test"])
github = vault.AuthBackend("github",
    type="github",
    path="github")
group_alias = vault.identity.GroupAlias("group-alias",
    name="Github_Team_Slug",
    mount_accessor=github.accessor,
    canonical_id=group.id)
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const group = new vault.identity.Group("group", {
    type: "external",
    policies: ["test"],
});
const github = new vault.AuthBackend("github", {
    type: "github",
    path: "github",
});
const group_alias = new vault.identity.GroupAlias("group-alias", {
    name: "Github_Team_Slug",
    mountAccessor: github.accessor,
    canonicalId: group.id,
});

Create a GroupAlias Resource

new GroupAlias(name: string, args: GroupAliasArgs, opts?: CustomResourceOptions);
@overload
def GroupAlias(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               canonical_id: Optional[str] = None,
               mount_accessor: Optional[str] = None,
               name: Optional[str] = None)
@overload
def GroupAlias(resource_name: str,
               args: GroupAliasArgs,
               opts: Optional[ResourceOptions] = None)
func NewGroupAlias(ctx *Context, name string, args GroupAliasArgs, opts ...ResourceOption) (*GroupAlias, error)
public GroupAlias(string name, GroupAliasArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args GroupAliasArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args GroupAliasArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args GroupAliasArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args GroupAliasArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

GroupAlias Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The GroupAlias resource accepts the following input properties:

CanonicalId string
ID of the group to which this is an alias.
MountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
Name string
Name of the group alias to create.
CanonicalId string
ID of the group to which this is an alias.
MountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
Name string
Name of the group alias to create.
canonicalId string
ID of the group to which this is an alias.
mountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
name string
Name of the group alias to create.
canonical_id str
ID of the group to which this is an alias.
mount_accessor str
Mount accessor of the authentication backend to which this alias belongs to.
name str
Name of the group alias to create.

Outputs

All input properties are implicitly available as output properties. Additionally, the GroupAlias resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing GroupAlias Resource

Get an existing GroupAlias resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupAliasState, opts?: CustomResourceOptions): GroupAlias
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        canonical_id: Optional[str] = None,
        mount_accessor: Optional[str] = None,
        name: Optional[str] = None) -> GroupAlias
func GetGroupAlias(ctx *Context, name string, id IDInput, state *GroupAliasState, opts ...ResourceOption) (*GroupAlias, error)
public static GroupAlias Get(string name, Input<string> id, GroupAliasState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

CanonicalId string
ID of the group to which this is an alias.
MountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
Name string
Name of the group alias to create.
CanonicalId string
ID of the group to which this is an alias.
MountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
Name string
Name of the group alias to create.
canonicalId string
ID of the group to which this is an alias.
mountAccessor string
Mount accessor of the authentication backend to which this alias belongs to.
name string
Name of the group alias to create.
canonical_id str
ID of the group to which this is an alias.
mount_accessor str
Mount accessor of the authentication backend to which this alias belongs to.
name str
Name of the group alias to create.

Import

The group alias can be imported with the group alias id, for example

 $ pulumi import vault:identity/groupAlias:GroupAlias group-alias id

Group aliases can also be imported using the UUID of the alias record, e.g.

 $ pulumi import vault:identity/groupAlias:GroupAlias alias_name 63104e20-88e4-11eb-8d04-cf7ac9d60157

Package Details

Repository
https://github.com/pulumi/pulumi-vault
License
Apache-2.0
Notes
This Pulumi package is based on the vault Terraform Provider.