Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native
  3. API Docs
  4. keyvault
  5. Vault
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.4.0 published on Wednesday, May 7, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native.keyvault.Vault

Explore with Pulumi AI

azure-native logo
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.4.0 published on Wednesday, May 7, 2025 by Pulumi
pulumi/pulumi-azure-native

    Resource information with extended details.

    Uses Azure REST API version 2024-11-01. In version 2.x of the Azure Native provider, it used API version 2023-02-01.

    Other available API versions: 2023-02-01, 2023-07-01, 2024-04-01-preview, 2024-12-01-preview. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native keyvault [ApiVersion]. See the version guide for details.

    Example Usage

    Create a new vault or update an existing vault

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var vault = new AzureNative.KeyVault.Vault("vault", new()
    {
        Location = "westus",
        Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
        {
            AccessPolicies = new[]
            {
                new AzureNative.KeyVault.Inputs.AccessPolicyEntryArgs
                {
                    ObjectId = "00000000-0000-0000-0000-000000000000",
                    Permissions = new AzureNative.KeyVault.Inputs.PermissionsArgs
                    {
                        Certificates = new[]
                        {
                            AzureNative.KeyVault.CertificatePermissions.@Get,
                            AzureNative.KeyVault.CertificatePermissions.List,
                            AzureNative.KeyVault.CertificatePermissions.Delete,
                            AzureNative.KeyVault.CertificatePermissions.Create,
                            AzureNative.KeyVault.CertificatePermissions.Import,
                            AzureNative.KeyVault.CertificatePermissions.Update,
                            AzureNative.KeyVault.CertificatePermissions.Managecontacts,
                            AzureNative.KeyVault.CertificatePermissions.Getissuers,
                            AzureNative.KeyVault.CertificatePermissions.Listissuers,
                            AzureNative.KeyVault.CertificatePermissions.Setissuers,
                            AzureNative.KeyVault.CertificatePermissions.Deleteissuers,
                            AzureNative.KeyVault.CertificatePermissions.Manageissuers,
                            AzureNative.KeyVault.CertificatePermissions.Recover,
                            AzureNative.KeyVault.CertificatePermissions.Purge,
                        },
                        Keys = new[]
                        {
                            AzureNative.KeyVault.KeyPermissions.Encrypt,
                            AzureNative.KeyVault.KeyPermissions.Decrypt,
                            AzureNative.KeyVault.KeyPermissions.WrapKey,
                            AzureNative.KeyVault.KeyPermissions.UnwrapKey,
                            AzureNative.KeyVault.KeyPermissions.Sign,
                            AzureNative.KeyVault.KeyPermissions.Verify,
                            AzureNative.KeyVault.KeyPermissions.@Get,
                            AzureNative.KeyVault.KeyPermissions.List,
                            AzureNative.KeyVault.KeyPermissions.Create,
                            AzureNative.KeyVault.KeyPermissions.Update,
                            AzureNative.KeyVault.KeyPermissions.Import,
                            AzureNative.KeyVault.KeyPermissions.Delete,
                            AzureNative.KeyVault.KeyPermissions.Backup,
                            AzureNative.KeyVault.KeyPermissions.Restore,
                            AzureNative.KeyVault.KeyPermissions.Recover,
                            AzureNative.KeyVault.KeyPermissions.Purge,
                        },
                        Secrets = new[]
                        {
                            AzureNative.KeyVault.SecretPermissions.@Get,
                            AzureNative.KeyVault.SecretPermissions.List,
                            AzureNative.KeyVault.SecretPermissions.@Set,
                            AzureNative.KeyVault.SecretPermissions.Delete,
                            AzureNative.KeyVault.SecretPermissions.Backup,
                            AzureNative.KeyVault.SecretPermissions.Restore,
                            AzureNative.KeyVault.SecretPermissions.Recover,
                            AzureNative.KeyVault.SecretPermissions.Purge,
                        },
                    },
                    TenantId = "00000000-0000-0000-0000-000000000000",
                },
            },
            EnabledForDeployment = true,
            EnabledForDiskEncryption = true,
            EnabledForTemplateDeployment = true,
            PublicNetworkAccess = "Enabled",
            Sku = new AzureNative.KeyVault.Inputs.SkuArgs
            {
                Family = AzureNative.KeyVault.SkuFamily.A,
                Name = AzureNative.KeyVault.SkuName.Standard,
            },
            TenantId = "00000000-0000-0000-0000-000000000000",
        },
        ResourceGroupName = "sample-resource-group",
        VaultName = "sample-vault",
    });

});

    package main

import (
	keyvault "github.com/pulumi/pulumi-azure-native-sdk/keyvault/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keyvault.NewVault(ctx, "vault", &keyvault.VaultArgs{
			Location: pulumi.String("westus"),
			Properties: &keyvault.VaultPropertiesArgs{
				AccessPolicies: keyvault.AccessPolicyEntryArray{
					&keyvault.AccessPolicyEntryArgs{
						ObjectId: pulumi.String("00000000-0000-0000-0000-000000000000"),
						Permissions: &keyvault.PermissionsArgs{
							Certificates: pulumi.StringArray{
								pulumi.String(keyvault.CertificatePermissionsGet),
								pulumi.String(keyvault.CertificatePermissionsList),
								pulumi.String(keyvault.CertificatePermissionsDelete),
								pulumi.String(keyvault.CertificatePermissionsCreate),
								pulumi.String(keyvault.CertificatePermissionsImport),
								pulumi.String(keyvault.CertificatePermissionsUpdate),
								pulumi.String(keyvault.CertificatePermissionsManagecontacts),
								pulumi.String(keyvault.CertificatePermissionsGetissuers),
								pulumi.String(keyvault.CertificatePermissionsListissuers),
								pulumi.String(keyvault.CertificatePermissionsSetissuers),
								pulumi.String(keyvault.CertificatePermissionsDeleteissuers),
								pulumi.String(keyvault.CertificatePermissionsManageissuers),
								pulumi.String(keyvault.CertificatePermissionsRecover),
								pulumi.String(keyvault.CertificatePermissionsPurge),
							},
							Keys: pulumi.StringArray{
								pulumi.String(keyvault.KeyPermissionsEncrypt),
								pulumi.String(keyvault.KeyPermissionsDecrypt),
								pulumi.String(keyvault.KeyPermissionsWrapKey),
								pulumi.String(keyvault.KeyPermissionsUnwrapKey),
								pulumi.String(keyvault.KeyPermissionsSign),
								pulumi.String(keyvault.KeyPermissionsVerify),
								pulumi.String(keyvault.KeyPermissionsGet),
								pulumi.String(keyvault.KeyPermissionsList),
								pulumi.String(keyvault.KeyPermissionsCreate),
								pulumi.String(keyvault.KeyPermissionsUpdate),
								pulumi.String(keyvault.KeyPermissionsImport),
								pulumi.String(keyvault.KeyPermissionsDelete),
								pulumi.String(keyvault.KeyPermissionsBackup),
								pulumi.String(keyvault.KeyPermissionsRestore),
								pulumi.String(keyvault.KeyPermissionsRecover),
								pulumi.String(keyvault.KeyPermissionsPurge),
							},
							Secrets: pulumi.StringArray{
								pulumi.String(keyvault.SecretPermissionsGet),
								pulumi.String(keyvault.SecretPermissionsList),
								pulumi.String(keyvault.SecretPermissionsSet),
								pulumi.String(keyvault.SecretPermissionsDelete),
								pulumi.String(keyvault.SecretPermissionsBackup),
								pulumi.String(keyvault.SecretPermissionsRestore),
								pulumi.String(keyvault.SecretPermissionsRecover),
								pulumi.String(keyvault.SecretPermissionsPurge),
							},
						},
						TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
					},
				},
				EnabledForDeployment:         pulumi.Bool(true),
				EnabledForDiskEncryption:     pulumi.Bool(true),
				EnabledForTemplateDeployment: pulumi.Bool(true),
				PublicNetworkAccess:          pulumi.String("Enabled"),
				Sku: &keyvault.SkuArgs{
					Family: pulumi.String(keyvault.SkuFamilyA),
					Name:   keyvault.SkuNameStandard,
				},
				TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
			},
			ResourceGroupName: pulumi.String("sample-resource-group"),
			VaultName:         pulumi.String("sample-vault"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.keyvault.Vault;
import com.pulumi.azurenative.keyvault.VaultArgs;
import com.pulumi.azurenative.keyvault.inputs.VaultPropertiesArgs;
import com.pulumi.azurenative.keyvault.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var vault = new Vault("vault", VaultArgs.builder()
            .location("westus")
            .properties(VaultPropertiesArgs.builder()
                .accessPolicies(AccessPolicyEntryArgs.builder()
                    .objectId("00000000-0000-0000-0000-000000000000")
                    .permissions(PermissionsArgs.builder()
                        .certificates(                        
                            "get",
                            "list",
                            "delete",
                            "create",
                            "import",
                            "update",
                            "managecontacts",
                            "getissuers",
                            "listissuers",
                            "setissuers",
                            "deleteissuers",
                            "manageissuers",
                            "recover",
                            "purge")
                        .keys(                        
                            "encrypt",
                            "decrypt",
                            "wrapKey",
                            "unwrapKey",
                            "sign",
                            "verify",
                            "get",
                            "list",
                            "create",
                            "update",
                            "import",
                            "delete",
                            "backup",
                            "restore",
                            "recover",
                            "purge")
                        .secrets(                        
                            "get",
                            "list",
                            "set",
                            "delete",
                            "backup",
                            "restore",
                            "recover",
                            "purge")
                        .build())
                    .tenantId("00000000-0000-0000-0000-000000000000")
                    .build())
                .enabledForDeployment(true)
                .enabledForDiskEncryption(true)
                .enabledForTemplateDeployment(true)
                .publicNetworkAccess("Enabled")
                .sku(SkuArgs.builder()
                    .family("A")
                    .name("standard")
                    .build())
                .tenantId("00000000-0000-0000-0000-000000000000")
                .build())
            .resourceGroupName("sample-resource-group")
            .vaultName("sample-vault")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const vault = new azure_native.keyvault.Vault("vault", {
    location: "westus",
    properties: {
        accessPolicies: [{
            objectId: "00000000-0000-0000-0000-000000000000",
            permissions: {
                certificates: [
                    azure_native.keyvault.CertificatePermissions.Get,
                    azure_native.keyvault.CertificatePermissions.List,
                    azure_native.keyvault.CertificatePermissions.Delete,
                    azure_native.keyvault.CertificatePermissions.Create,
                    azure_native.keyvault.CertificatePermissions.Import,
                    azure_native.keyvault.CertificatePermissions.Update,
                    azure_native.keyvault.CertificatePermissions.Managecontacts,
                    azure_native.keyvault.CertificatePermissions.Getissuers,
                    azure_native.keyvault.CertificatePermissions.Listissuers,
                    azure_native.keyvault.CertificatePermissions.Setissuers,
                    azure_native.keyvault.CertificatePermissions.Deleteissuers,
                    azure_native.keyvault.CertificatePermissions.Manageissuers,
                    azure_native.keyvault.CertificatePermissions.Recover,
                    azure_native.keyvault.CertificatePermissions.Purge,
                ],
                keys: [
                    azure_native.keyvault.KeyPermissions.Encrypt,
                    azure_native.keyvault.KeyPermissions.Decrypt,
                    azure_native.keyvault.KeyPermissions.WrapKey,
                    azure_native.keyvault.KeyPermissions.UnwrapKey,
                    azure_native.keyvault.KeyPermissions.Sign,
                    azure_native.keyvault.KeyPermissions.Verify,
                    azure_native.keyvault.KeyPermissions.Get,
                    azure_native.keyvault.KeyPermissions.List,
                    azure_native.keyvault.KeyPermissions.Create,
                    azure_native.keyvault.KeyPermissions.Update,
                    azure_native.keyvault.KeyPermissions.Import,
                    azure_native.keyvault.KeyPermissions.Delete,
                    azure_native.keyvault.KeyPermissions.Backup,
                    azure_native.keyvault.KeyPermissions.Restore,
                    azure_native.keyvault.KeyPermissions.Recover,
                    azure_native.keyvault.KeyPermissions.Purge,
                ],
                secrets: [
                    azure_native.keyvault.SecretPermissions.Get,
                    azure_native.keyvault.SecretPermissions.List,
                    azure_native.keyvault.SecretPermissions.Set,
                    azure_native.keyvault.SecretPermissions.Delete,
                    azure_native.keyvault.SecretPermissions.Backup,
                    azure_native.keyvault.SecretPermissions.Restore,
                    azure_native.keyvault.SecretPermissions.Recover,
                    azure_native.keyvault.SecretPermissions.Purge,
                ],
            },
            tenantId: "00000000-0000-0000-0000-000000000000",
        }],
        enabledForDeployment: true,
        enabledForDiskEncryption: true,
        enabledForTemplateDeployment: true,
        publicNetworkAccess: "Enabled",
        sku: {
            family: azure_native.keyvault.SkuFamily.A,
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "00000000-0000-0000-0000-000000000000",
    },
    resourceGroupName: "sample-resource-group",
    vaultName: "sample-vault",
});

    import pulumi
import pulumi_azure_native as azure_native

vault = azure_native.keyvault.Vault("vault",
    location="westus",
    properties={
        "access_policies": [{
            "object_id": "00000000-0000-0000-0000-000000000000",
            "permissions": {
                "certificates": [
                    azure_native.keyvault.CertificatePermissions.GET,
                    azure_native.keyvault.CertificatePermissions.LIST,
                    azure_native.keyvault.CertificatePermissions.DELETE,
                    azure_native.keyvault.CertificatePermissions.CREATE,
                    azure_native.keyvault.CertificatePermissions.IMPORT_,
                    azure_native.keyvault.CertificatePermissions.UPDATE,
                    azure_native.keyvault.CertificatePermissions.MANAGECONTACTS,
                    azure_native.keyvault.CertificatePermissions.GETISSUERS,
                    azure_native.keyvault.CertificatePermissions.LISTISSUERS,
                    azure_native.keyvault.CertificatePermissions.SETISSUERS,
                    azure_native.keyvault.CertificatePermissions.DELETEISSUERS,
                    azure_native.keyvault.CertificatePermissions.MANAGEISSUERS,
                    azure_native.keyvault.CertificatePermissions.RECOVER,
                    azure_native.keyvault.CertificatePermissions.PURGE,
                ],
                "keys": [
                    azure_native.keyvault.KeyPermissions.ENCRYPT,
                    azure_native.keyvault.KeyPermissions.DECRYPT,
                    azure_native.keyvault.KeyPermissions.WRAP_KEY,
                    azure_native.keyvault.KeyPermissions.UNWRAP_KEY,
                    azure_native.keyvault.KeyPermissions.SIGN,
                    azure_native.keyvault.KeyPermissions.VERIFY,
                    azure_native.keyvault.KeyPermissions.GET,
                    azure_native.keyvault.KeyPermissions.LIST,
                    azure_native.keyvault.KeyPermissions.CREATE,
                    azure_native.keyvault.KeyPermissions.UPDATE,
                    azure_native.keyvault.KeyPermissions.IMPORT_,
                    azure_native.keyvault.KeyPermissions.DELETE,
                    azure_native.keyvault.KeyPermissions.BACKUP,
                    azure_native.keyvault.KeyPermissions.RESTORE,
                    azure_native.keyvault.KeyPermissions.RECOVER,
                    azure_native.keyvault.KeyPermissions.PURGE,
                ],
                "secrets": [
                    azure_native.keyvault.SecretPermissions.GET,
                    azure_native.keyvault.SecretPermissions.LIST,
                    azure_native.keyvault.SecretPermissions.SET,
                    azure_native.keyvault.SecretPermissions.DELETE,
                    azure_native.keyvault.SecretPermissions.BACKUP,
                    azure_native.keyvault.SecretPermissions.RESTORE,
                    azure_native.keyvault.SecretPermissions.RECOVER,
                    azure_native.keyvault.SecretPermissions.PURGE,
                ],
            },
            "tenant_id": "00000000-0000-0000-0000-000000000000",
        }],
        "enabled_for_deployment": True,
        "enabled_for_disk_encryption": True,
        "enabled_for_template_deployment": True,
        "public_network_access": "Enabled",
        "sku": {
            "family": azure_native.keyvault.SkuFamily.A,
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenant_id": "00000000-0000-0000-0000-000000000000",
    },
    resource_group_name="sample-resource-group",
    vault_name="sample-vault")

    resources:
  vault:
    type: azure-native:keyvault:Vault
    properties:
      location: westus
      properties:
        accessPolicies:
          - objectId: 00000000-0000-0000-0000-000000000000
            permissions:
              certificates:
                - get
                - list
                - delete
                - create
                - import
                - update
                - managecontacts
                - getissuers
                - listissuers
                - setissuers
                - deleteissuers
                - manageissuers
                - recover
                - purge
              keys:
                - encrypt
                - decrypt
                - wrapKey
                - unwrapKey
                - sign
                - verify
                - get
                - list
                - create
                - update
                - import
                - delete
                - backup
                - restore
                - recover
                - purge
              secrets:
                - get
                - list
                - set
                - delete
                - backup
                - restore
                - recover
                - purge
            tenantId: 00000000-0000-0000-0000-000000000000
        enabledForDeployment: true
        enabledForDiskEncryption: true
        enabledForTemplateDeployment: true
        publicNetworkAccess: Enabled
        sku:
          family: A
          name: standard
        tenantId: 00000000-0000-0000-0000-000000000000
      resourceGroupName: sample-resource-group
      vaultName: sample-vault

    Create or update a vault with network acls

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var vault = new AzureNative.KeyVault.Vault("vault", new()
    {
        Location = "westus",
        Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
        {
            EnabledForDeployment = true,
            EnabledForDiskEncryption = true,
            EnabledForTemplateDeployment = true,
            NetworkAcls = new AzureNative.KeyVault.Inputs.NetworkRuleSetArgs
            {
                Bypass = AzureNative.KeyVault.NetworkRuleBypassOptions.AzureServices,
                DefaultAction = AzureNative.KeyVault.NetworkRuleAction.Deny,
                IpRules = new[]
                {
                    new AzureNative.KeyVault.Inputs.IPRuleArgs
                    {
                        Value = "124.56.78.91",
                    },
                    new AzureNative.KeyVault.Inputs.IPRuleArgs
                    {
                        Value = "'10.91.4.0/24'",
                    },
                },
                VirtualNetworkRules = new[]
                {
                    new AzureNative.KeyVault.Inputs.VirtualNetworkRuleArgs
                    {
                        Id = "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
                    },
                },
            },
            Sku = new AzureNative.KeyVault.Inputs.SkuArgs
            {
                Family = AzureNative.KeyVault.SkuFamily.A,
                Name = AzureNative.KeyVault.SkuName.Standard,
            },
            TenantId = "00000000-0000-0000-0000-000000000000",
        },
        ResourceGroupName = "sample-resource-group",
        VaultName = "sample-vault",
    });

});

    package main

import (
	keyvault "github.com/pulumi/pulumi-azure-native-sdk/keyvault/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keyvault.NewVault(ctx, "vault", &keyvault.VaultArgs{
			Location: pulumi.String("westus"),
			Properties: &keyvault.VaultPropertiesArgs{
				EnabledForDeployment:         pulumi.Bool(true),
				EnabledForDiskEncryption:     pulumi.Bool(true),
				EnabledForTemplateDeployment: pulumi.Bool(true),
				NetworkAcls: &keyvault.NetworkRuleSetArgs{
					Bypass:        pulumi.String(keyvault.NetworkRuleBypassOptionsAzureServices),
					DefaultAction: pulumi.String(keyvault.NetworkRuleActionDeny),
					IpRules: keyvault.IPRuleArray{
						&keyvault.IPRuleArgs{
							Value: pulumi.String("124.56.78.91"),
						},
						&keyvault.IPRuleArgs{
							Value: pulumi.String("'10.91.4.0/24'"),
						},
					},
					VirtualNetworkRules: keyvault.VirtualNetworkRuleArray{
						&keyvault.VirtualNetworkRuleArgs{
							Id: pulumi.String("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1"),
						},
					},
				},
				Sku: &keyvault.SkuArgs{
					Family: pulumi.String(keyvault.SkuFamilyA),
					Name:   keyvault.SkuNameStandard,
				},
				TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
			},
			ResourceGroupName: pulumi.String("sample-resource-group"),
			VaultName:         pulumi.String("sample-vault"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.keyvault.Vault;
import com.pulumi.azurenative.keyvault.VaultArgs;
import com.pulumi.azurenative.keyvault.inputs.VaultPropertiesArgs;
import com.pulumi.azurenative.keyvault.inputs.NetworkRuleSetArgs;
import com.pulumi.azurenative.keyvault.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var vault = new Vault("vault", VaultArgs.builder()
            .location("westus")
            .properties(VaultPropertiesArgs.builder()
                .enabledForDeployment(true)
                .enabledForDiskEncryption(true)
                .enabledForTemplateDeployment(true)
                .networkAcls(NetworkRuleSetArgs.builder()
                    .bypass("AzureServices")
                    .defaultAction("Deny")
                    .ipRules(                    
                        IPRuleArgs.builder()
                            .value("124.56.78.91")
                            .build(),
                        IPRuleArgs.builder()
                            .value("'10.91.4.0/24'")
                            .build())
                    .virtualNetworkRules(VirtualNetworkRuleArgs.builder()
                        .id("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1")
                        .build())
                    .build())
                .sku(SkuArgs.builder()
                    .family("A")
                    .name("standard")
                    .build())
                .tenantId("00000000-0000-0000-0000-000000000000")
                .build())
            .resourceGroupName("sample-resource-group")
            .vaultName("sample-vault")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const vault = new azure_native.keyvault.Vault("vault", {
    location: "westus",
    properties: {
        enabledForDeployment: true,
        enabledForDiskEncryption: true,
        enabledForTemplateDeployment: true,
        networkAcls: {
            bypass: azure_native.keyvault.NetworkRuleBypassOptions.AzureServices,
            defaultAction: azure_native.keyvault.NetworkRuleAction.Deny,
            ipRules: [
                {
                    value: "124.56.78.91",
                },
                {
                    value: "'10.91.4.0/24'",
                },
            ],
            virtualNetworkRules: [{
                id: "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
            }],
        },
        sku: {
            family: azure_native.keyvault.SkuFamily.A,
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "00000000-0000-0000-0000-000000000000",
    },
    resourceGroupName: "sample-resource-group",
    vaultName: "sample-vault",
});

    import pulumi
import pulumi_azure_native as azure_native

vault = azure_native.keyvault.Vault("vault",
    location="westus",
    properties={
        "enabled_for_deployment": True,
        "enabled_for_disk_encryption": True,
        "enabled_for_template_deployment": True,
        "network_acls": {
            "bypass": azure_native.keyvault.NetworkRuleBypassOptions.AZURE_SERVICES,
            "default_action": azure_native.keyvault.NetworkRuleAction.DENY,
            "ip_rules": [
                {
                    "value": "124.56.78.91",
                },
                {
                    "value": "'10.91.4.0/24'",
                },
            ],
            "virtual_network_rules": [{
                "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
            }],
        },
        "sku": {
            "family": azure_native.keyvault.SkuFamily.A,
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenant_id": "00000000-0000-0000-0000-000000000000",
    },
    resource_group_name="sample-resource-group",
    vault_name="sample-vault")

    resources:
  vault:
    type: azure-native:keyvault:Vault
    properties:
      location: westus
      properties:
        enabledForDeployment: true
        enabledForDiskEncryption: true
        enabledForTemplateDeployment: true
        networkAcls:
          bypass: AzureServices
          defaultAction: Deny
          ipRules:
            - value: 124.56.78.91
            - value: '''10.91.4.0/24'''
          virtualNetworkRules:
            - id: /subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1
        sku:
          family: A
          name: standard
        tenantId: 00000000-0000-0000-0000-000000000000
      resourceGroupName: sample-resource-group
      vaultName: sample-vault

    Create Vault Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Vault(name: string, args: VaultArgs, opts?: CustomResourceOptions);
    @overload
def Vault(resource_name: str,
          args: VaultArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Vault(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          properties: Optional[VaultPropertiesArgs] = None,
          resource_group_name: Optional[str] = None,
          location: Optional[str] = None,
          tags: Optional[Mapping[str, str]] = None,
          vault_name: Optional[str] = None)
    func NewVault(ctx *Context, name string, args VaultArgs, opts ...ResourceOption) (*Vault, error)
    public Vault(string name, VaultArgs args, CustomResourceOptions? opts = null)
    public Vault(String name, VaultArgs args)
public Vault(String name, VaultArgs args, CustomResourceOptions options)

    type: azure-native:keyvault:Vault
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args VaultArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args VaultArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args VaultArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args VaultArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args VaultArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var azure_nativeVaultResource = new AzureNative.KeyVault.Vault("azure-nativeVaultResource", new()
{
    Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
    {
        Sku = new AzureNative.KeyVault.Inputs.SkuArgs
        {
            Family = "string",
            Name = AzureNative.KeyVault.SkuName.Standard,
        },
        TenantId = "string",
        EnabledForDiskEncryption = false,
        EnableRbacAuthorization = false,
        EnableSoftDelete = false,
        EnabledForDeployment = false,
        AccessPolicies = new[]
        {
            new AzureNative.KeyVault.Inputs.AccessPolicyEntryArgs
            {
                ObjectId = "string",
                Permissions = new AzureNative.KeyVault.Inputs.PermissionsArgs
                {
                    Certificates = new[]
                    {
                        "string",
                    },
                    Keys = new[]
                    {
                        "string",
                    },
                    Secrets = new[]
                    {
                        "string",
                    },
                    Storage = new[]
                    {
                        "string",
                    },
                },
                TenantId = "string",
                ApplicationId = "string",
            },
        },
        EnabledForTemplateDeployment = false,
        NetworkAcls = new AzureNative.KeyVault.Inputs.NetworkRuleSetArgs
        {
            Bypass = "string",
            DefaultAction = "string",
            IpRules = new[]
            {
                new AzureNative.KeyVault.Inputs.IPRuleArgs
                {
                    Value = "string",
                },
            },
            VirtualNetworkRules = new[]
            {
                new AzureNative.KeyVault.Inputs.VirtualNetworkRuleArgs
                {
                    Id = "string",
                    IgnoreMissingVnetServiceEndpoint = false,
                },
            },
        },
        PublicNetworkAccess = "string",
        EnablePurgeProtection = false,
        SoftDeleteRetentionInDays = 0,
        CreateMode = AzureNative.KeyVault.CreateMode.Recover,
    },
    ResourceGroupName = "string",
    Location = "string",
    Tags = 
    {
        { "string", "string" },
    },
    VaultName = "string",
});

    example, err := keyvault.NewVault(ctx, "azure-nativeVaultResource", &keyvault.VaultArgs{
	Properties: &keyvault.VaultPropertiesArgs{
		Sku: &keyvault.SkuArgs{
			Family: pulumi.String("string"),
			Name:   keyvault.SkuNameStandard,
		},
		TenantId:                 pulumi.String("string"),
		EnabledForDiskEncryption: pulumi.Bool(false),
		EnableRbacAuthorization:  pulumi.Bool(false),
		EnableSoftDelete:         pulumi.Bool(false),
		EnabledForDeployment:     pulumi.Bool(false),
		AccessPolicies: keyvault.AccessPolicyEntryArray{
			&keyvault.AccessPolicyEntryArgs{
				ObjectId: pulumi.String("string"),
				Permissions: &keyvault.PermissionsArgs{
					Certificates: pulumi.StringArray{
						pulumi.String("string"),
					},
					Keys: pulumi.StringArray{
						pulumi.String("string"),
					},
					Secrets: pulumi.StringArray{
						pulumi.String("string"),
					},
					Storage: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
				TenantId:      pulumi.String("string"),
				ApplicationId: pulumi.String("string"),
			},
		},
		EnabledForTemplateDeployment: pulumi.Bool(false),
		NetworkAcls: &keyvault.NetworkRuleSetArgs{
			Bypass:        pulumi.String("string"),
			DefaultAction: pulumi.String("string"),
			IpRules: keyvault.IPRuleArray{
				&keyvault.IPRuleArgs{
					Value: pulumi.String("string"),
				},
			},
			VirtualNetworkRules: keyvault.VirtualNetworkRuleArray{
				&keyvault.VirtualNetworkRuleArgs{
					Id:                               pulumi.String("string"),
					IgnoreMissingVnetServiceEndpoint: pulumi.Bool(false),
				},
			},
		},
		PublicNetworkAccess:       pulumi.String("string"),
		EnablePurgeProtection:     pulumi.Bool(false),
		SoftDeleteRetentionInDays: pulumi.Int(0),
		CreateMode:                keyvault.CreateModeRecover,
	},
	ResourceGroupName: pulumi.String("string"),
	Location:          pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	VaultName: pulumi.String("string"),
})

    var azure_nativeVaultResource = new com.pulumi.azurenative.keyvault.Vault("azure-nativeVaultResource", com.pulumi.azurenative.keyvault.VaultArgs.builder()
    .properties(VaultPropertiesArgs.builder()
        .sku(SkuArgs.builder()
            .family("string")
            .name("standard")
            .build())
        .tenantId("string")
        .enabledForDiskEncryption(false)
        .enableRbacAuthorization(false)
        .enableSoftDelete(false)
        .enabledForDeployment(false)
        .accessPolicies(AccessPolicyEntryArgs.builder()
            .objectId("string")
            .permissions(PermissionsArgs.builder()
                .certificates("string")
                .keys("string")
                .secrets("string")
                .storage("string")
                .build())
            .tenantId("string")
            .applicationId("string")
            .build())
        .enabledForTemplateDeployment(false)
        .networkAcls(NetworkRuleSetArgs.builder()
            .bypass("string")
            .defaultAction("string")
            .ipRules(IPRuleArgs.builder()
                .value("string")
                .build())
            .virtualNetworkRules(VirtualNetworkRuleArgs.builder()
                .id("string")
                .ignoreMissingVnetServiceEndpoint(false)
                .build())
            .build())
        .publicNetworkAccess("string")
        .enablePurgeProtection(false)
        .softDeleteRetentionInDays(0)
        .createMode("recover")
        .build())
    .resourceGroupName("string")
    .location("string")
    .tags(Map.of("string", "string"))
    .vaultName("string")
    .build());

    azure_native_vault_resource = azure_native.keyvault.Vault("azure-nativeVaultResource",
    properties={
        "sku": {
            "family": "string",
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenant_id": "string",
        "enabled_for_disk_encryption": False,
        "enable_rbac_authorization": False,
        "enable_soft_delete": False,
        "enabled_for_deployment": False,
        "access_policies": [{
            "object_id": "string",
            "permissions": {
                "certificates": ["string"],
                "keys": ["string"],
                "secrets": ["string"],
                "storage": ["string"],
            },
            "tenant_id": "string",
            "application_id": "string",
        }],
        "enabled_for_template_deployment": False,
        "network_acls": {
            "bypass": "string",
            "default_action": "string",
            "ip_rules": [{
                "value": "string",
            }],
            "virtual_network_rules": [{
                "id": "string",
                "ignore_missing_vnet_service_endpoint": False,
            }],
        },
        "public_network_access": "string",
        "enable_purge_protection": False,
        "soft_delete_retention_in_days": 0,
        "create_mode": azure_native.keyvault.CreateMode.RECOVER,
    },
    resource_group_name="string",
    location="string",
    tags={
        "string": "string",
    },
    vault_name="string")

    const azure_nativeVaultResource = new azure_native.keyvault.Vault("azure-nativeVaultResource", {
    properties: {
        sku: {
            family: "string",
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "string",
        enabledForDiskEncryption: false,
        enableRbacAuthorization: false,
        enableSoftDelete: false,
        enabledForDeployment: false,
        accessPolicies: [{
            objectId: "string",
            permissions: {
                certificates: ["string"],
                keys: ["string"],
                secrets: ["string"],
                storage: ["string"],
            },
            tenantId: "string",
            applicationId: "string",
        }],
        enabledForTemplateDeployment: false,
        networkAcls: {
            bypass: "string",
            defaultAction: "string",
            ipRules: [{
                value: "string",
            }],
            virtualNetworkRules: [{
                id: "string",
                ignoreMissingVnetServiceEndpoint: false,
            }],
        },
        publicNetworkAccess: "string",
        enablePurgeProtection: false,
        softDeleteRetentionInDays: 0,
        createMode: azure_native.keyvault.CreateMode.Recover,
    },
    resourceGroupName: "string",
    location: "string",
    tags: {
        string: "string",
    },
    vaultName: "string",
});

    type: azure-native:keyvault:Vault
properties:
    location: string
    properties:
        accessPolicies:
            - applicationId: string
              objectId: string
              permissions:
                certificates:
                    - string
                keys:
                    - string
                secrets:
                    - string
                storage:
                    - string
              tenantId: string
        createMode: recover
        enablePurgeProtection: false
        enableRbacAuthorization: false
        enableSoftDelete: false
        enabledForDeployment: false
        enabledForDiskEncryption: false
        enabledForTemplateDeployment: false
        networkAcls:
            bypass: string
            defaultAction: string
            ipRules:
                - value: string
            virtualNetworkRules:
                - id: string
                  ignoreMissingVnetServiceEndpoint: false
        publicNetworkAccess: string
        sku:
            family: string
            name: standard
        softDeleteRetentionInDays: 0
        tenantId: string
    resourceGroupName: string
    tags:
        string: string
    vaultName: string

    Vault Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Vault resource accepts the following input properties:

    Properties Pulumi.AzureNative.KeyVault.Inputs.VaultProperties
    Properties of the vault
    ResourceGroupName string
    The name of the Resource Group to which the server belongs.
    Location string
    The supported Azure location where the key vault should be created.
    Tags Dictionary<string, string>
    The tags that will be assigned to the key vault.
    VaultName string
    Name of the vault
    Properties VaultPropertiesArgs
    Properties of the vault
    ResourceGroupName string
    The name of the Resource Group to which the server belongs.
    Location string
    The supported Azure location where the key vault should be created.
    Tags map[string]string
    The tags that will be assigned to the key vault.
    VaultName string
    Name of the vault
    properties VaultProperties
    Properties of the vault
    resourceGroupName String
    The name of the Resource Group to which the server belongs.
    location String
    The supported Azure location where the key vault should be created.
    tags Map<String,String>
    The tags that will be assigned to the key vault.
    vaultName String
    Name of the vault
    properties VaultProperties
    Properties of the vault
    resourceGroupName string
    The name of the Resource Group to which the server belongs.
    location string
    The supported Azure location where the key vault should be created.
    tags {[key: string]: string}
    The tags that will be assigned to the key vault.
    vaultName string
    Name of the vault
    properties VaultPropertiesArgs
    Properties of the vault
    resource_group_name str
    The name of the Resource Group to which the server belongs.
    location str
    The supported Azure location where the key vault should be created.
    tags Mapping[str, str]
    The tags that will be assigned to the key vault.
    vault_name str
    Name of the vault
    properties Property Map
    Properties of the vault
    resourceGroupName String
    The name of the Resource Group to which the server belongs.
    location String
    The supported Azure location where the key vault should be created.
    tags Map<String>
    The tags that will be assigned to the key vault.
    vaultName String
    Name of the vault

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Vault resource produces the following output properties:

    AzureApiVersion string
    The Azure API version of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Name of the key vault resource.
    SystemData Pulumi.AzureNative.KeyVault.Outputs.SystemDataResponse
    System metadata for the key vault.
    Type string
    Resource type of the key vault resource.
    AzureApiVersion string
    The Azure API version of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Name of the key vault resource.
    SystemData SystemDataResponse
    System metadata for the key vault.
    Type string
    Resource type of the key vault resource.
    azureApiVersion String
    The Azure API version of the resource.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Name of the key vault resource.
    systemData SystemDataResponse
    System metadata for the key vault.
    type String
    Resource type of the key vault resource.
    azureApiVersion string
    The Azure API version of the resource.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    Name of the key vault resource.
    systemData SystemDataResponse
    System metadata for the key vault.
    type string
    Resource type of the key vault resource.
    azure_api_version str
    The Azure API version of the resource.
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    Name of the key vault resource.
    system_data SystemDataResponse
    System metadata for the key vault.
    type str
    Resource type of the key vault resource.
    azureApiVersion String
    The Azure API version of the resource.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Name of the key vault resource.
    systemData Property Map
    System metadata for the key vault.
    type String
    Resource type of the key vault resource.

    Supporting Types

    AccessPolicyEntry, AccessPolicyEntryArgs

    ObjectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    Permissions Pulumi.AzureNative.KeyVault.Inputs.Permissions
    Permissions the identity has for keys, secrets and certificates.
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    ApplicationId string
    Application ID of the client making request on behalf of a principal
    ObjectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    Permissions Permissions
    Permissions the identity has for keys, secrets and certificates.
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    ApplicationId string
    Application ID of the client making request on behalf of a principal
    objectId String
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions Permissions
    Permissions the identity has for keys, secrets and certificates.
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId String
    Application ID of the client making request on behalf of a principal
    objectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions Permissions
    Permissions the identity has for keys, secrets and certificates.
    tenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId string
    Application ID of the client making request on behalf of a principal
    object_id str
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions Permissions
    Permissions the identity has for keys, secrets and certificates.
    tenant_id str
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    application_id str
    Application ID of the client making request on behalf of a principal
    objectId String
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions Property Map
    Permissions the identity has for keys, secrets and certificates.
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId String
    Application ID of the client making request on behalf of a principal

    AccessPolicyEntryResponse, AccessPolicyEntryResponseArgs

    ObjectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    Permissions Pulumi.AzureNative.KeyVault.Inputs.PermissionsResponse
    Permissions the identity has for keys, secrets and certificates.
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    ApplicationId string
    Application ID of the client making request on behalf of a principal
    ObjectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    Permissions PermissionsResponse
    Permissions the identity has for keys, secrets and certificates.
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    ApplicationId string
    Application ID of the client making request on behalf of a principal
    objectId String
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions PermissionsResponse
    Permissions the identity has for keys, secrets and certificates.
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId String
    Application ID of the client making request on behalf of a principal
    objectId string
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions PermissionsResponse
    Permissions the identity has for keys, secrets and certificates.
    tenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId string
    Application ID of the client making request on behalf of a principal
    object_id str
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions PermissionsResponse
    Permissions the identity has for keys, secrets and certificates.
    tenant_id str
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    application_id str
    Application ID of the client making request on behalf of a principal
    objectId String
    The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
    permissions Property Map
    Permissions the identity has for keys, secrets and certificates.
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    applicationId String
    Application ID of the client making request on behalf of a principal

    CertificatePermissions, CertificatePermissionsArgs

    All
    all
    @Get
    get
    List
    list
    Delete
    delete
    Create
    create
    Import
    import
    Update
    update
    Managecontacts
    managecontacts
    Getissuers
    getissuers
    Listissuers
    listissuers
    Setissuers
    setissuers
    Deleteissuers
    deleteissuers
    Manageissuers
    manageissuers
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    CertificatePermissionsAll
    all
    CertificatePermissionsGet
    get
    CertificatePermissionsList
    list
    CertificatePermissionsDelete
    delete
    CertificatePermissionsCreate
    create
    CertificatePermissionsImport
    import
    CertificatePermissionsUpdate
    update
    CertificatePermissionsManagecontacts
    managecontacts
    CertificatePermissionsGetissuers
    getissuers
    CertificatePermissionsListissuers
    listissuers
    CertificatePermissionsSetissuers
    setissuers
    CertificatePermissionsDeleteissuers
    deleteissuers
    CertificatePermissionsManageissuers
    manageissuers
    CertificatePermissionsRecover
    recover
    CertificatePermissionsPurge
    purge
    CertificatePermissionsBackup
    backup
    CertificatePermissionsRestore
    restore
    All
    all
    Get
    get
    List
    list
    Delete
    delete
    Create
    create
    Import_
    import
    Update
    update
    Managecontacts
    managecontacts
    Getissuers
    getissuers
    Listissuers
    listissuers
    Setissuers
    setissuers
    Deleteissuers
    deleteissuers
    Manageissuers
    manageissuers
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    All
    all
    Get
    get
    List
    list
    Delete
    delete
    Create
    create
    Import
    import
    Update
    update
    Managecontacts
    managecontacts
    Getissuers
    getissuers
    Listissuers
    listissuers
    Setissuers
    setissuers
    Deleteissuers
    deleteissuers
    Manageissuers
    manageissuers
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    ALL
    all
    GET
    get
    LIST
    list
    DELETE
    delete
    CREATE
    create
    IMPORT_
    import
    UPDATE
    update
    MANAGECONTACTS
    managecontacts
    GETISSUERS
    getissuers
    LISTISSUERS
    listissuers
    SETISSUERS
    setissuers
    DELETEISSUERS
    deleteissuers
    MANAGEISSUERS
    manageissuers
    RECOVER
    recover
    PURGE
    purge
    BACKUP
    backup
    RESTORE
    restore
    "all"
    all
    "get"
    get
    "list"
    list
    "delete"
    delete
    "create"
    create
    "import"
    import
    "update"
    update
    "managecontacts"
    managecontacts
    "getissuers"
    getissuers
    "listissuers"
    listissuers
    "setissuers"
    setissuers
    "deleteissuers"
    deleteissuers
    "manageissuers"
    manageissuers
    "recover"
    recover
    "purge"
    purge
    "backup"
    backup
    "restore"
    restore

    CreateMode, CreateModeArgs

    Recover
    recover
    @Default
    default
    CreateModeRecover
    recover
    CreateModeDefault
    default
    Recover
    recover
    Default_
    default
    Recover
    recover
    Default
    default
    RECOVER
    recover
    DEFAULT
    default
    "recover"
    recover
    "default"
    default

    IPRule, IPRuleArgs

    Value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    Value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value String
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value str
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value String
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

    IPRuleResponse, IPRuleResponseArgs

    Value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    Value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value String
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value string
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value str
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
    value String
    An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

    KeyPermissions, KeyPermissionsArgs

    All
    all
    Encrypt
    encrypt
    Decrypt
    decrypt
    WrapKey
    wrapKey
    UnwrapKey
    unwrapKey
    Sign
    sign
    Verify
    verify
    @Get
    get
    List
    list
    Create
    create
    Update
    update
    Import
    import
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    Release
    release
    Rotate
    rotate
    Getrotationpolicy
    getrotationpolicy
    Setrotationpolicy
    setrotationpolicy
    KeyPermissionsAll
    all
    KeyPermissionsEncrypt
    encrypt
    KeyPermissionsDecrypt
    decrypt
    KeyPermissionsWrapKey
    wrapKey
    KeyPermissionsUnwrapKey
    unwrapKey
    KeyPermissionsSign
    sign
    KeyPermissionsVerify
    verify
    KeyPermissionsGet
    get
    KeyPermissionsList
    list
    KeyPermissionsCreate
    create
    KeyPermissionsUpdate
    update
    KeyPermissionsImport
    import
    KeyPermissionsDelete
    delete
    KeyPermissionsBackup
    backup
    KeyPermissionsRestore
    restore
    KeyPermissionsRecover
    recover
    KeyPermissionsPurge
    purge
    KeyPermissionsRelease
    release
    KeyPermissionsRotate
    rotate
    KeyPermissionsGetrotationpolicy
    getrotationpolicy
    KeyPermissionsSetrotationpolicy
    setrotationpolicy
    All
    all
    Encrypt
    encrypt
    Decrypt
    decrypt
    WrapKey
    wrapKey
    UnwrapKey
    unwrapKey
    Sign
    sign
    Verify
    verify
    Get
    get
    List
    list
    Create
    create
    Update
    update
    Import_
    import
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    Release
    release
    Rotate
    rotate
    Getrotationpolicy
    getrotationpolicy
    Setrotationpolicy
    setrotationpolicy
    All
    all
    Encrypt
    encrypt
    Decrypt
    decrypt
    WrapKey
    wrapKey
    UnwrapKey
    unwrapKey
    Sign
    sign
    Verify
    verify
    Get
    get
    List
    list
    Create
    create
    Update
    update
    Import
    import
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    Release
    release
    Rotate
    rotate
    Getrotationpolicy
    getrotationpolicy
    Setrotationpolicy
    setrotationpolicy
    ALL
    all
    ENCRYPT
    encrypt
    DECRYPT
    decrypt
    WRAP_KEY
    wrapKey
    UNWRAP_KEY
    unwrapKey
    SIGN
    sign
    VERIFY
    verify
    GET
    get
    LIST
    list
    CREATE
    create
    UPDATE
    update
    IMPORT_
    import
    DELETE
    delete
    BACKUP
    backup
    RESTORE
    restore
    RECOVER
    recover
    PURGE
    purge
    RELEASE
    release
    ROTATE
    rotate
    GETROTATIONPOLICY
    getrotationpolicy
    SETROTATIONPOLICY
    setrotationpolicy
    "all"
    all
    "encrypt"
    encrypt
    "decrypt"
    decrypt
    "wrapKey"
    wrapKey
    "unwrapKey"
    unwrapKey
    "sign"
    sign
    "verify"
    verify
    "get"
    get
    "list"
    list
    "create"
    create
    "update"
    update
    "import"
    import
    "delete"
    delete
    "backup"
    backup
    "restore"
    restore
    "recover"
    recover
    "purge"
    purge
    "release"
    release
    "rotate"
    rotate
    "getrotationpolicy"
    getrotationpolicy
    "setrotationpolicy"
    setrotationpolicy

    NetworkRuleAction, NetworkRuleActionArgs

    Allow
    Allow
    Deny
    Deny
    NetworkRuleActionAllow
    Allow
    NetworkRuleActionDeny
    Deny
    Allow
    Allow
    Deny
    Deny
    Allow
    Allow
    Deny
    Deny
    ALLOW
    Allow
    DENY
    Deny
    "Allow"
    Allow
    "Deny"
    Deny

    NetworkRuleBypassOptions, NetworkRuleBypassOptionsArgs

    AzureServices
    AzureServices
    None
    None
    NetworkRuleBypassOptionsAzureServices
    AzureServices
    NetworkRuleBypassOptionsNone
    None
    AzureServices
    AzureServices
    None
    None
    AzureServices
    AzureServices
    None
    None
    AZURE_SERVICES
    AzureServices
    NONE
    None
    "AzureServices"
    AzureServices
    "None"
    None

    NetworkRuleSet, NetworkRuleSetArgs

    Bypass string | Pulumi.AzureNative.KeyVault.NetworkRuleBypassOptions
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    DefaultAction string | Pulumi.AzureNative.KeyVault.NetworkRuleAction
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    IpRules List<Pulumi.AzureNative.KeyVault.Inputs.IPRule>
    The list of IP address rules.
    VirtualNetworkRules List<Pulumi.AzureNative.KeyVault.Inputs.VirtualNetworkRule>
    The list of virtual network rules.
    Bypass string | NetworkRuleBypassOptions
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    DefaultAction string | NetworkRuleAction
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    IpRules []IPRule
    The list of IP address rules.
    VirtualNetworkRules []VirtualNetworkRule
    The list of virtual network rules.
    bypass String | NetworkRuleBypassOptions
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction String | NetworkRuleAction
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules List<IPRule>
    The list of IP address rules.
    virtualNetworkRules List<VirtualNetworkRule>
    The list of virtual network rules.
    bypass string | NetworkRuleBypassOptions
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction string | NetworkRuleAction
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules IPRule[]
    The list of IP address rules.
    virtualNetworkRules VirtualNetworkRule[]
    The list of virtual network rules.
    bypass str | NetworkRuleBypassOptions
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    default_action str | NetworkRuleAction
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ip_rules Sequence[IPRule]
    The list of IP address rules.
    virtual_network_rules Sequence[VirtualNetworkRule]
    The list of virtual network rules.
    bypass String | "AzureServices" | "None"
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction String | "Allow" | "Deny"
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules List<Property Map>
    The list of IP address rules.
    virtualNetworkRules List<Property Map>
    The list of virtual network rules.

    NetworkRuleSetResponse, NetworkRuleSetResponseArgs

    Bypass string
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    DefaultAction string
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    IpRules List<Pulumi.AzureNative.KeyVault.Inputs.IPRuleResponse>
    The list of IP address rules.
    VirtualNetworkRules List<Pulumi.AzureNative.KeyVault.Inputs.VirtualNetworkRuleResponse>
    The list of virtual network rules.
    Bypass string
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    DefaultAction string
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    IpRules []IPRuleResponse
    The list of IP address rules.
    VirtualNetworkRules []VirtualNetworkRuleResponse
    The list of virtual network rules.
    bypass String
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction String
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules List<IPRuleResponse>
    The list of IP address rules.
    virtualNetworkRules List<VirtualNetworkRuleResponse>
    The list of virtual network rules.
    bypass string
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction string
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules IPRuleResponse[]
    The list of IP address rules.
    virtualNetworkRules VirtualNetworkRuleResponse[]
    The list of virtual network rules.
    bypass str
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    default_action str
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ip_rules Sequence[IPRuleResponse]
    The list of IP address rules.
    virtual_network_rules Sequence[VirtualNetworkRuleResponse]
    The list of virtual network rules.
    bypass String
    Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
    defaultAction String
    The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
    ipRules List<Property Map>
    The list of IP address rules.
    virtualNetworkRules List<Property Map>
    The list of virtual network rules.

    Permissions, PermissionsArgs

    Certificates List<Union<string, Pulumi.AzureNative.KeyVault.CertificatePermissions>>
    Permissions to certificates
    Keys List<Union<string, Pulumi.AzureNative.KeyVault.KeyPermissions>>
    Permissions to keys
    Secrets List<Union<string, Pulumi.AzureNative.KeyVault.SecretPermissions>>
    Permissions to secrets
    Storage List<Union<string, Pulumi.AzureNative.KeyVault.StoragePermissions>>
    Permissions to storage accounts
    Certificates []string
    Permissions to certificates
    Keys []string
    Permissions to keys
    Secrets []string
    Permissions to secrets
    Storage []string
    Permissions to storage accounts
    certificates List<Either<String,CertificatePermissions>>
    Permissions to certificates
    keys List<Either<String,KeyPermissions>>
    Permissions to keys
    secrets List<Either<String,SecretPermissions>>
    Permissions to secrets
    storage List<Either<String,StoragePermissions>>
    Permissions to storage accounts
    certificates (string | CertificatePermissions)[]
    Permissions to certificates
    keys (string | KeyPermissions)[]
    Permissions to keys
    secrets (string | SecretPermissions)[]
    Permissions to secrets
    storage (string | StoragePermissions)[]
    Permissions to storage accounts
    certificates Sequence[Union[str, CertificatePermissions]]
    Permissions to certificates
    keys Sequence[Union[str, KeyPermissions]]
    Permissions to keys
    secrets Sequence[Union[str, SecretPermissions]]
    Permissions to secrets
    storage Sequence[Union[str, StoragePermissions]]
    Permissions to storage accounts
    certificates List<String | "all" | "get" | "list" | "delete" | "create" | "import" | "update" | "managecontacts" | "getissuers" | "listissuers" | "setissuers" | "deleteissuers" | "manageissuers" | "recover" | "purge" | "backup" | "restore">
    Permissions to certificates
    keys List<String | "all" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "sign" | "verify" | "get" | "list" | "create" | "update" | "import" | "delete" | "backup" | "restore" | "recover" | "purge" | "release" | "rotate" | "getrotationpolicy" | "setrotationpolicy">
    Permissions to keys
    secrets List<String | "all" | "get" | "list" | "set" | "delete" | "backup" | "restore" | "recover" | "purge">
    Permissions to secrets
    storage List<String | "all" | "get" | "list" | "delete" | "set" | "update" | "regeneratekey" | "recover" | "purge" | "backup" | "restore" | "setsas" | "listsas" | "getsas" | "deletesas">
    Permissions to storage accounts

    PermissionsResponse, PermissionsResponseArgs

    Certificates List<string>
    Permissions to certificates
    Keys List<string>
    Permissions to keys
    Secrets List<string>
    Permissions to secrets
    Storage List<string>
    Permissions to storage accounts
    Certificates []string
    Permissions to certificates
    Keys []string
    Permissions to keys
    Secrets []string
    Permissions to secrets
    Storage []string
    Permissions to storage accounts
    certificates List<String>
    Permissions to certificates
    keys List<String>
    Permissions to keys
    secrets List<String>
    Permissions to secrets
    storage List<String>
    Permissions to storage accounts
    certificates string[]
    Permissions to certificates
    keys string[]
    Permissions to keys
    secrets string[]
    Permissions to secrets
    storage string[]
    Permissions to storage accounts
    certificates Sequence[str]
    Permissions to certificates
    keys Sequence[str]
    Permissions to keys
    secrets Sequence[str]
    Permissions to secrets
    storage Sequence[str]
    Permissions to storage accounts
    certificates List<String>
    Permissions to certificates
    keys List<String>
    Permissions to keys
    secrets List<String>
    Permissions to secrets
    storage List<String>
    Permissions to storage accounts

    PrivateEndpointConnectionItemResponse, PrivateEndpointConnectionItemResponseArgs

    ProvisioningState string
    Provisioning state of the private endpoint connection.
    Etag string
    Modified whenever there is a change in the state of private endpoint connection.
    Id string
    Id of private endpoint connection.
    PrivateEndpoint Pulumi.AzureNative.KeyVault.Inputs.PrivateEndpointResponse
    Properties of the private endpoint object.
    PrivateLinkServiceConnectionState Pulumi.AzureNative.KeyVault.Inputs.PrivateLinkServiceConnectionStateResponse
    Approval state of the private link connection.
    ProvisioningState string
    Provisioning state of the private endpoint connection.
    Etag string
    Modified whenever there is a change in the state of private endpoint connection.
    Id string
    Id of private endpoint connection.
    PrivateEndpoint PrivateEndpointResponse
    Properties of the private endpoint object.
    PrivateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse
    Approval state of the private link connection.
    provisioningState String
    Provisioning state of the private endpoint connection.
    etag String
    Modified whenever there is a change in the state of private endpoint connection.
    id String
    Id of private endpoint connection.
    privateEndpoint PrivateEndpointResponse
    Properties of the private endpoint object.
    privateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse
    Approval state of the private link connection.
    provisioningState string
    Provisioning state of the private endpoint connection.
    etag string
    Modified whenever there is a change in the state of private endpoint connection.
    id string
    Id of private endpoint connection.
    privateEndpoint PrivateEndpointResponse
    Properties of the private endpoint object.
    privateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse
    Approval state of the private link connection.
    provisioning_state str
    Provisioning state of the private endpoint connection.
    etag str
    Modified whenever there is a change in the state of private endpoint connection.
    id str
    Id of private endpoint connection.
    private_endpoint PrivateEndpointResponse
    Properties of the private endpoint object.
    private_link_service_connection_state PrivateLinkServiceConnectionStateResponse
    Approval state of the private link connection.
    provisioningState String
    Provisioning state of the private endpoint connection.
    etag String
    Modified whenever there is a change in the state of private endpoint connection.
    id String
    Id of private endpoint connection.
    privateEndpoint Property Map
    Properties of the private endpoint object.
    privateLinkServiceConnectionState Property Map
    Approval state of the private link connection.

    PrivateEndpointResponse, PrivateEndpointResponseArgs

    Id string
    Full identifier of the private endpoint resource.
    Id string
    Full identifier of the private endpoint resource.
    id String
    Full identifier of the private endpoint resource.
    id string
    Full identifier of the private endpoint resource.
    id str
    Full identifier of the private endpoint resource.
    id String
    Full identifier of the private endpoint resource.

    PrivateLinkServiceConnectionStateResponse, PrivateLinkServiceConnectionStateResponseArgs

    ActionsRequired string
    A message indicating if changes on the service provider require any updates on the consumer.
    Description string
    The reason for approval or rejection.
    Status string
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.
    ActionsRequired string
    A message indicating if changes on the service provider require any updates on the consumer.
    Description string
    The reason for approval or rejection.
    Status string
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.
    actionsRequired String
    A message indicating if changes on the service provider require any updates on the consumer.
    description String
    The reason for approval or rejection.
    status String
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.
    actionsRequired string
    A message indicating if changes on the service provider require any updates on the consumer.
    description string
    The reason for approval or rejection.
    status string
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.
    actions_required str
    A message indicating if changes on the service provider require any updates on the consumer.
    description str
    The reason for approval or rejection.
    status str
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.
    actionsRequired String
    A message indicating if changes on the service provider require any updates on the consumer.
    description String
    The reason for approval or rejection.
    status String
    Indicates whether the connection has been approved, rejected or removed by the key vault owner.

    SecretPermissions, SecretPermissionsArgs

    All
    all
    @Get
    get
    List
    list
    @Set
    set
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    SecretPermissionsAll
    all
    SecretPermissionsGet
    get
    SecretPermissionsList
    list
    SecretPermissionsSet
    set
    SecretPermissionsDelete
    delete
    SecretPermissionsBackup
    backup
    SecretPermissionsRestore
    restore
    SecretPermissionsRecover
    recover
    SecretPermissionsPurge
    purge
    All
    all
    Get
    get
    List
    list
    Set
    set
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    All
    all
    Get
    get
    List
    list
    Set
    set
    Delete
    delete
    Backup
    backup
    Restore
    restore
    Recover
    recover
    Purge
    purge
    ALL
    all
    GET
    get
    LIST
    list
    SET
    set
    DELETE
    delete
    BACKUP
    backup
    RESTORE
    restore
    RECOVER
    recover
    PURGE
    purge
    "all"
    all
    "get"
    get
    "list"
    list
    "set"
    set
    "delete"
    delete
    "backup"
    backup
    "restore"
    restore
    "recover"
    recover
    "purge"
    purge

    Sku, SkuArgs

    Family string | Pulumi.AzureNative.KeyVault.SkuFamily
    SKU family name
    Name Pulumi.AzureNative.KeyVault.SkuName
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    Family string | SkuFamily
    SKU family name
    Name SkuName
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family String | SkuFamily
    SKU family name
    name SkuName
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family string | SkuFamily
    SKU family name
    name SkuName
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family str | SkuFamily
    SKU family name
    name SkuName
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family String | "A"
    SKU family name
    name "standard" | "premium"
    SKU name to specify whether the key vault is a standard vault or a premium vault.

    SkuFamily, SkuFamilyArgs

    A
    A
    SkuFamilyA
    A
    A
    A
    A
    A
    A
    A
    "A"
    A

    SkuName, SkuNameArgs

    Standard
    standard
    Premium
    premium
    SkuNameStandard
    standard
    SkuNamePremium
    premium
    Standard
    standard
    Premium
    premium
    Standard
    standard
    Premium
    premium
    STANDARD
    standard
    PREMIUM
    premium
    "standard"
    standard
    "premium"
    premium

    SkuResponse, SkuResponseArgs

    Family string
    SKU family name
    Name string
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    Family string
    SKU family name
    Name string
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family String
    SKU family name
    name String
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family string
    SKU family name
    name string
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family str
    SKU family name
    name str
    SKU name to specify whether the key vault is a standard vault or a premium vault.
    family String
    SKU family name
    name String
    SKU name to specify whether the key vault is a standard vault or a premium vault.

    StoragePermissions, StoragePermissionsArgs

    All
    all
    @Get
    get
    List
    list
    Delete
    delete
    @Set
    set
    Update
    update
    Regeneratekey
    regeneratekey
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    Setsas
    setsas
    Listsas
    listsas
    Getsas
    getsas
    Deletesas
    deletesas
    StoragePermissionsAll
    all
    StoragePermissionsGet
    get
    StoragePermissionsList
    list
    StoragePermissionsDelete
    delete
    StoragePermissionsSet
    set
    StoragePermissionsUpdate
    update
    StoragePermissionsRegeneratekey
    regeneratekey
    StoragePermissionsRecover
    recover
    StoragePermissionsPurge
    purge
    StoragePermissionsBackup
    backup
    StoragePermissionsRestore
    restore
    StoragePermissionsSetsas
    setsas
    StoragePermissionsListsas
    listsas
    StoragePermissionsGetsas
    getsas
    StoragePermissionsDeletesas
    deletesas
    All
    all
    Get
    get
    List
    list
    Delete
    delete
    Set
    set
    Update
    update
    Regeneratekey
    regeneratekey
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    Setsas
    setsas
    Listsas
    listsas
    Getsas
    getsas
    Deletesas
    deletesas
    All
    all
    Get
    get
    List
    list
    Delete
    delete
    Set
    set
    Update
    update
    Regeneratekey
    regeneratekey
    Recover
    recover
    Purge
    purge
    Backup
    backup
    Restore
    restore
    Setsas
    setsas
    Listsas
    listsas
    Getsas
    getsas
    Deletesas
    deletesas
    ALL
    all
    GET
    get
    LIST
    list
    DELETE
    delete
    SET
    set
    UPDATE
    update
    REGENERATEKEY
    regeneratekey
    RECOVER
    recover
    PURGE
    purge
    BACKUP
    backup
    RESTORE
    restore
    SETSAS
    setsas
    LISTSAS
    listsas
    GETSAS
    getsas
    DELETESAS
    deletesas
    "all"
    all
    "get"
    get
    "list"
    list
    "delete"
    delete
    "set"
    set
    "update"
    update
    "regeneratekey"
    regeneratekey
    "recover"
    recover
    "purge"
    purge
    "backup"
    backup
    "restore"
    restore
    "setsas"
    setsas
    "listsas"
    listsas
    "getsas"
    getsas
    "deletesas"
    deletesas

    SystemDataResponse, SystemDataResponseArgs

    CreatedAt string
    The timestamp of the key vault resource creation (UTC).
    CreatedBy string
    The identity that created the key vault resource.
    CreatedByType string
    The type of identity that created the key vault resource.
    LastModifiedAt string
    The timestamp of the key vault resource last modification (UTC).
    LastModifiedBy string
    The identity that last modified the key vault resource.
    LastModifiedByType string
    The type of identity that last modified the key vault resource.
    CreatedAt string
    The timestamp of the key vault resource creation (UTC).
    CreatedBy string
    The identity that created the key vault resource.
    CreatedByType string
    The type of identity that created the key vault resource.
    LastModifiedAt string
    The timestamp of the key vault resource last modification (UTC).
    LastModifiedBy string
    The identity that last modified the key vault resource.
    LastModifiedByType string
    The type of identity that last modified the key vault resource.
    createdAt String
    The timestamp of the key vault resource creation (UTC).
    createdBy String
    The identity that created the key vault resource.
    createdByType String
    The type of identity that created the key vault resource.
    lastModifiedAt String
    The timestamp of the key vault resource last modification (UTC).
    lastModifiedBy String
    The identity that last modified the key vault resource.
    lastModifiedByType String
    The type of identity that last modified the key vault resource.
    createdAt string
    The timestamp of the key vault resource creation (UTC).
    createdBy string
    The identity that created the key vault resource.
    createdByType string
    The type of identity that created the key vault resource.
    lastModifiedAt string
    The timestamp of the key vault resource last modification (UTC).
    lastModifiedBy string
    The identity that last modified the key vault resource.
    lastModifiedByType string
    The type of identity that last modified the key vault resource.
    created_at str
    The timestamp of the key vault resource creation (UTC).
    created_by str
    The identity that created the key vault resource.
    created_by_type str
    The type of identity that created the key vault resource.
    last_modified_at str
    The timestamp of the key vault resource last modification (UTC).
    last_modified_by str
    The identity that last modified the key vault resource.
    last_modified_by_type str
    The type of identity that last modified the key vault resource.
    createdAt String
    The timestamp of the key vault resource creation (UTC).
    createdBy String
    The identity that created the key vault resource.
    createdByType String
    The type of identity that created the key vault resource.
    lastModifiedAt String
    The timestamp of the key vault resource last modification (UTC).
    lastModifiedBy String
    The identity that last modified the key vault resource.
    lastModifiedByType String
    The type of identity that last modified the key vault resource.

    VaultProperties, VaultPropertiesArgs

    Sku Pulumi.AzureNative.KeyVault.Inputs.Sku
    SKU details
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    AccessPolicies List<Pulumi.AzureNative.KeyVault.Inputs.AccessPolicyEntry>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    CreateMode Pulumi.AzureNative.KeyVault.CreateMode
    The vault's create mode to indicate whether the vault need to be recovered or not.
    EnablePurgeProtection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    EnableRbacAuthorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    EnableSoftDelete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    EnabledForDeployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    EnabledForDiskEncryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    EnabledForTemplateDeployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    NetworkAcls Pulumi.AzureNative.KeyVault.Inputs.NetworkRuleSet
    Rules governing the accessibility of the key vault from specific network locations.
    PublicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    SoftDeleteRetentionInDays int
    softDelete data retention days. It accepts >=7 and <=90.
    Sku Sku
    SKU details
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    AccessPolicies []AccessPolicyEntry
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    CreateMode CreateMode
    The vault's create mode to indicate whether the vault need to be recovered or not.
    EnablePurgeProtection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    EnableRbacAuthorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    EnableSoftDelete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    EnabledForDeployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    EnabledForDiskEncryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    EnabledForTemplateDeployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    NetworkAcls NetworkRuleSet
    Rules governing the accessibility of the key vault from specific network locations.
    PublicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    SoftDeleteRetentionInDays int
    softDelete data retention days. It accepts >=7 and <=90.
    sku Sku
    SKU details
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    accessPolicies List<AccessPolicyEntry>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    createMode CreateMode
    The vault's create mode to indicate whether the vault need to be recovered or not.
    enablePurgeProtection Boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization Boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete Boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment Boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption Boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment Boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls NetworkRuleSet
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess String
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays Integer
    softDelete data retention days. It accepts >=7 and <=90.
    sku Sku
    SKU details
    tenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    accessPolicies AccessPolicyEntry[]
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    createMode CreateMode
    The vault's create mode to indicate whether the vault need to be recovered or not.
    enablePurgeProtection boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls NetworkRuleSet
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays number
    softDelete data retention days. It accepts >=7 and <=90.
    sku Sku
    SKU details
    tenant_id str
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    access_policies Sequence[AccessPolicyEntry]
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    create_mode CreateMode
    The vault's create mode to indicate whether the vault need to be recovered or not.
    enable_purge_protection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enable_rbac_authorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enable_soft_delete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabled_for_deployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabled_for_disk_encryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabled_for_template_deployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    network_acls NetworkRuleSet
    Rules governing the accessibility of the key vault from specific network locations.
    public_network_access str
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    soft_delete_retention_in_days int
    softDelete data retention days. It accepts >=7 and <=90.
    sku Property Map
    SKU details
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    accessPolicies List<Property Map>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    createMode "recover" | "default"
    The vault's create mode to indicate whether the vault need to be recovered or not.
    enablePurgeProtection Boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization Boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete Boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment Boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption Boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment Boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls Property Map
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess String
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays Number
    softDelete data retention days. It accepts >=7 and <=90.

    VaultPropertiesResponse, VaultPropertiesResponseArgs

    HsmPoolResourceId string
    The resource id of HSM Pool.
    PrivateEndpointConnections List<Pulumi.AzureNative.KeyVault.Inputs.PrivateEndpointConnectionItemResponse>
    List of private endpoint connections associated with the key vault.
    ProvisioningState string
    Provisioning state of the vault.
    Sku Pulumi.AzureNative.KeyVault.Inputs.SkuResponse
    SKU details
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    VaultUri string
    The URI of the vault for performing operations on keys and secrets.
    AccessPolicies List<Pulumi.AzureNative.KeyVault.Inputs.AccessPolicyEntryResponse>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    EnablePurgeProtection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    EnableRbacAuthorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    EnableSoftDelete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    EnabledForDeployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    EnabledForDiskEncryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    EnabledForTemplateDeployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    NetworkAcls Pulumi.AzureNative.KeyVault.Inputs.NetworkRuleSetResponse
    Rules governing the accessibility of the key vault from specific network locations.
    PublicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    SoftDeleteRetentionInDays int
    softDelete data retention days. It accepts >=7 and <=90.
    HsmPoolResourceId string
    The resource id of HSM Pool.
    PrivateEndpointConnections []PrivateEndpointConnectionItemResponse
    List of private endpoint connections associated with the key vault.
    ProvisioningState string
    Provisioning state of the vault.
    Sku SkuResponse
    SKU details
    TenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    VaultUri string
    The URI of the vault for performing operations on keys and secrets.
    AccessPolicies []AccessPolicyEntryResponse
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    EnablePurgeProtection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    EnableRbacAuthorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    EnableSoftDelete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    EnabledForDeployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    EnabledForDiskEncryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    EnabledForTemplateDeployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    NetworkAcls NetworkRuleSetResponse
    Rules governing the accessibility of the key vault from specific network locations.
    PublicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    SoftDeleteRetentionInDays int
    softDelete data retention days. It accepts >=7 and <=90.
    hsmPoolResourceId String
    The resource id of HSM Pool.
    privateEndpointConnections List<PrivateEndpointConnectionItemResponse>
    List of private endpoint connections associated with the key vault.
    provisioningState String
    Provisioning state of the vault.
    sku SkuResponse
    SKU details
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    vaultUri String
    The URI of the vault for performing operations on keys and secrets.
    accessPolicies List<AccessPolicyEntryResponse>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    enablePurgeProtection Boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization Boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete Boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment Boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption Boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment Boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls NetworkRuleSetResponse
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess String
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays Integer
    softDelete data retention days. It accepts >=7 and <=90.
    hsmPoolResourceId string
    The resource id of HSM Pool.
    privateEndpointConnections PrivateEndpointConnectionItemResponse[]
    List of private endpoint connections associated with the key vault.
    provisioningState string
    Provisioning state of the vault.
    sku SkuResponse
    SKU details
    tenantId string
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    vaultUri string
    The URI of the vault for performing operations on keys and secrets.
    accessPolicies AccessPolicyEntryResponse[]
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    enablePurgeProtection boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls NetworkRuleSetResponse
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess string
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays number
    softDelete data retention days. It accepts >=7 and <=90.
    hsm_pool_resource_id str
    The resource id of HSM Pool.
    private_endpoint_connections Sequence[PrivateEndpointConnectionItemResponse]
    List of private endpoint connections associated with the key vault.
    provisioning_state str
    Provisioning state of the vault.
    sku SkuResponse
    SKU details
    tenant_id str
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    vault_uri str
    The URI of the vault for performing operations on keys and secrets.
    access_policies Sequence[AccessPolicyEntryResponse]
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    enable_purge_protection bool
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enable_rbac_authorization bool
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enable_soft_delete bool
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabled_for_deployment bool
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabled_for_disk_encryption bool
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabled_for_template_deployment bool
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    network_acls NetworkRuleSetResponse
    Rules governing the accessibility of the key vault from specific network locations.
    public_network_access str
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    soft_delete_retention_in_days int
    softDelete data retention days. It accepts >=7 and <=90.
    hsmPoolResourceId String
    The resource id of HSM Pool.
    privateEndpointConnections List<Property Map>
    List of private endpoint connections associated with the key vault.
    provisioningState String
    Provisioning state of the vault.
    sku Property Map
    SKU details
    tenantId String
    The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
    vaultUri String
    The URI of the vault for performing operations on keys and secrets.
    accessPolicies List<Property Map>
    An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
    enablePurgeProtection Boolean
    Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
    enableRbacAuthorization Boolean
    Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
    enableSoftDelete Boolean
    Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
    enabledForDeployment Boolean
    Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
    enabledForDiskEncryption Boolean
    Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
    enabledForTemplateDeployment Boolean
    Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
    networkAcls Property Map
    Rules governing the accessibility of the key vault from specific network locations.
    publicNetworkAccess String
    Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
    softDeleteRetentionInDays Number
    softDelete data retention days. It accepts >=7 and <=90.

    VirtualNetworkRule, VirtualNetworkRuleArgs

    Id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    IgnoreMissingVnetServiceEndpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    Id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    IgnoreMissingVnetServiceEndpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id String
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint Boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id str
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignore_missing_vnet_service_endpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id String
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint Boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

    VirtualNetworkRuleResponse, VirtualNetworkRuleResponseArgs

    Id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    IgnoreMissingVnetServiceEndpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    Id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    IgnoreMissingVnetServiceEndpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id String
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint Boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id string
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id str
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignore_missing_vnet_service_endpoint bool
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
    id String
    Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
    ignoreMissingVnetServiceEndpoint Boolean
    Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

    Import

    An existing resource can be imported using its type token, name, and identifier, e.g.

    $ pulumi import azure-native:keyvault:Vault sample-vault /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Native pulumi/pulumi-azure-native
    License
    Apache-2.0
    azure-native logo
    This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
    Azure Native v3.4.0 published on Wednesday, May 7, 2025 by Pulumi
    pulumi/pulumi-azure-native