Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Bytepluscc Provider
  4. API Docs
  5. kms
  6. Secret
Viewing docs for bytepluscc v0.0.43
published on Monday, Jul 27, 2026 by Byteplus
Schema (JSON)
byteplus-sdk/pulumi-bytepluscc

bytepluscc.kms.Secret

bytepluscc logo
Viewing docs for bytepluscc v0.0.43
published on Monday, Jul 27, 2026 by Byteplus
Schema (JSON)
byteplus-sdk/pulumi-bytepluscc

    Credential Manager is a credential management product based on the key management system. It is used to store sensitive credential information required by user business applications, such as AK/SK, account passwords, access keys, database passwords, and certificates. The product provides secure storage, access control, automatic rotation, and auditing capabilities. User business applications can securely and dynamically obtain credential information by integrating the KMS SDK or using the KMS OpenAPI, effectively preventing risks such as information leakage or unintended modification caused by storing sensitive information in plaintext

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as bytepluscc from "@byteplus/pulumi-bytepluscc";

const kMSSecretDemo = new bytepluscc.kms.Secret("KMSSecretDemo", {
    secretName: "secret-ccapi-Generic",
    versionName: "ccapi-v1",
    projectName: "default",
    description: "description test ccapi Generic",
    secretType: "Generic",
    encryptionKey: "trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101",
    secretValue: JSON.stringify({
        key1: "value1",
        key2: "value2",
    }),
});

    import pulumi
import json
import pulumi_bytepluscc as bytepluscc

k_ms_secret_demo = bytepluscc.kms.Secret("KMSSecretDemo",
    secret_name="secret-ccapi-Generic",
    version_name="ccapi-v1",
    project_name="default",
    description="description test ccapi Generic",
    secret_type="Generic",
    encryption_key="trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101",
    secret_value=json.dumps({
        "key1": "value1",
        "key2": "value2",
    }))

    package main

import (
	"encoding/json"

	"github.com/byteplus-sdk/pulumi-bytepluscc/sdk/go/bytepluscc/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"key1": "value1",
			"key2": "value2",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = kms.NewSecret(ctx, "KMSSecretDemo", &kms.SecretArgs{
			SecretName:    pulumi.String("secret-ccapi-Generic"),
			VersionName:   pulumi.String("ccapi-v1"),
			ProjectName:   pulumi.String("default"),
			Description:   pulumi.String("description test ccapi Generic"),
			SecretType:    pulumi.String("Generic"),
			EncryptionKey: pulumi.String("trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101"),
			SecretValue:   pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Bytepluscc = Byteplus.Pulumi.Bytepluscc;

return await Deployment.RunAsync(() => 
{
    var kMSSecretDemo = new Bytepluscc.Kms.Secret("KMSSecretDemo", new()
    {
        SecretName = "secret-ccapi-Generic",
        VersionName = "ccapi-v1",
        ProjectName = "default",
        Description = "description test ccapi Generic",
        SecretType = "Generic",
        EncryptionKey = "trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101",
        SecretValue = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["key1"] = "value1",
            ["key2"] = "value2",
        }),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.byteplus.bytepluscc.kms.Secret;
import com.byteplus.bytepluscc.kms.SecretArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kMSSecretDemo = new Secret("kMSSecretDemo", SecretArgs.builder()
            .secretName("secret-ccapi-Generic")
            .versionName("ccapi-v1")
            .projectName("default")
            .description("description test ccapi Generic")
            .secretType("Generic")
            .encryptionKey("trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101")
            .secretValue(serializeJson(
                jsonObject(
                    jsonProperty("key1", "value1"),
                    jsonProperty("key2", "value2")
                )))
            .build());

    }
}

    resources:
  kMSSecretDemo:
    type: bytepluscc:kms:Secret
    name: KMSSecretDemo
    properties:
      secretName: secret-ccapi-Generic
      versionName: ccapi-v1
      projectName: default
      description: description test ccapi Generic
      secretType: Generic
      encryptionKey: trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101
      secretValue:
        fn::toJSON:
          key1: value1
          key2: value2

    pulumi {
  required_providers {
    bytepluscc = {
      source = "pulumi/bytepluscc"
    }
  }
}

resource "bytepluscc_kms_secret" "KMSSecretDemo" {
  secret_name    = "secret-ccapi-Generic"
  version_name   = "ccapi-v1"
  project_name   = "default"
  description    = "description test ccapi Generic"
  secret_type    = "Generic"
  encryption_key = "trn:kms:cn-beijing:********:keyrings/ccapi-text/keys/ccapi-terraform-1101"
  secret_value = jsonencode({
    "key1" = "value1"
    "key2" = "value2"
  })
}

    Create Secret Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Secret(name: string, args: SecretArgs, opts?: CustomResourceOptions);
    @overload
def Secret(resource_name: str,
           args: SecretArgs,
           opts: Optional[ResourceOptions] = None)

@overload
def Secret(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           secret_name: Optional[str] = None,
           secret_value: Optional[str] = None,
           secret_type: Optional[str] = None,
           encryption_key: Optional[str] = None,
           extended_config: Optional[str] = None,
           pending_window_in_days: Optional[int] = None,
           project_name: Optional[str] = None,
           rotation_interval: Optional[str] = None,
           secret_backup: Optional[bool] = None,
           automatic_rotation: Optional[bool] = None,
           secret_restore: Optional[SecretSecretRestoreArgs] = None,
           secret_rotate: Optional[bool] = None,
           description: Optional[str] = None,
           cancel_secret_deletion: Optional[bool] = None,
           version_name: Optional[str] = None)
    func NewSecret(ctx *Context, name string, args SecretArgs, opts ...ResourceOption) (*Secret, error)
    public Secret(string name, SecretArgs args, CustomResourceOptions? opts = null)
    public Secret(String name, SecretArgs args)
public Secret(String name, SecretArgs args, CustomResourceOptions options)

    type: bytepluscc:kms:Secret
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "bytepluscc_kms_secret" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretResource = new Bytepluscc.Kms.Secret("secretResource", new()
{
    SecretName = "string",
    SecretValue = "string",
    SecretType = "string",
    EncryptionKey = "string",
    ExtendedConfig = "string",
    PendingWindowInDays = 0,
    ProjectName = "string",
    RotationInterval = "string",
    SecretBackup = false,
    AutomaticRotation = false,
    SecretRestore = new Bytepluscc.Kms.Inputs.SecretSecretRestoreArgs
    {
        BackupData = "string",
        SecretDataKey = "string",
        Signature = "string",
    },
    SecretRotate = false,
    Description = "string",
    CancelSecretDeletion = false,
    VersionName = "string",
});

    example, err := kms.NewSecret(ctx, "secretResource", &kms.SecretArgs{
	SecretName:          pulumi.String("string"),
	SecretValue:         pulumi.String("string"),
	SecretType:          pulumi.String("string"),
	EncryptionKey:       pulumi.String("string"),
	ExtendedConfig:      pulumi.String("string"),
	PendingWindowInDays: pulumi.Int(0),
	ProjectName:         pulumi.String("string"),
	RotationInterval:    pulumi.String("string"),
	SecretBackup:        pulumi.Bool(false),
	AutomaticRotation:   pulumi.Bool(false),
	SecretRestore: &kms.SecretSecretRestoreArgs{
		BackupData:    pulumi.String("string"),
		SecretDataKey: pulumi.String("string"),
		Signature:     pulumi.String("string"),
	},
	SecretRotate:         pulumi.Bool(false),
	Description:          pulumi.String("string"),
	CancelSecretDeletion: pulumi.Bool(false),
	VersionName:          pulumi.String("string"),
})

    resource "bytepluscc_kms_secret" "secretResource" {
  lifecycle {
    create_before_destroy = true
  }
  secret_name            = "string"
  secret_value           = "string"
  secret_type            = "string"
  encryption_key         = "string"
  extended_config        = "string"
  pending_window_in_days = 0
  project_name           = "string"
  rotation_interval      = "string"
  secret_backup          = false
  automatic_rotation     = false
  secret_restore = {
    backup_data     = "string"
    secret_data_key = "string"
    signature       = "string"
  }
  secret_rotate          = false
  description            = "string"
  cancel_secret_deletion = false
  version_name           = "string"
}

    var secretResource = new Secret("secretResource", SecretArgs.builder()
    .secretName("string")
    .secretValue("string")
    .secretType("string")
    .encryptionKey("string")
    .extendedConfig("string")
    .pendingWindowInDays(0)
    .projectName("string")
    .rotationInterval("string")
    .secretBackup(false)
    .automaticRotation(false)
    .secretRestore(SecretSecretRestoreArgs.builder()
        .backupData("string")
        .secretDataKey("string")
        .signature("string")
        .build())
    .secretRotate(false)
    .description("string")
    .cancelSecretDeletion(false)
    .versionName("string")
    .build());

    secret_resource = bytepluscc.kms.Secret("secretResource",
    secret_name="string",
    secret_value="string",
    secret_type="string",
    encryption_key="string",
    extended_config="string",
    pending_window_in_days=0,
    project_name="string",
    rotation_interval="string",
    secret_backup=False,
    automatic_rotation=False,
    secret_restore={
        "backup_data": "string",
        "secret_data_key": "string",
        "signature": "string",
    },
    secret_rotate=False,
    description="string",
    cancel_secret_deletion=False,
    version_name="string")

    const secretResource = new bytepluscc.kms.Secret("secretResource", {
    secretName: "string",
    secretValue: "string",
    secretType: "string",
    encryptionKey: "string",
    extendedConfig: "string",
    pendingWindowInDays: 0,
    projectName: "string",
    rotationInterval: "string",
    secretBackup: false,
    automaticRotation: false,
    secretRestore: {
        backupData: "string",
        secretDataKey: "string",
        signature: "string",
    },
    secretRotate: false,
    description: "string",
    cancelSecretDeletion: false,
    versionName: "string",
});

    type: bytepluscc:kms:Secret
properties:
    automaticRotation: false
    cancelSecretDeletion: false
    description: string
    encryptionKey: string
    extendedConfig: string
    pendingWindowInDays: 0
    projectName: string
    rotationInterval: string
    secretBackup: false
    secretName: string
    secretRestore:
        backupData: string
        secretDataKey: string
        signature: string
    secretRotate: false
    secretType: string
    secretValue: string
    versionName: string

    Secret Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Secret resource accepts the following input properties:

    SecretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    SecretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    SecretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    AutomaticRotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    CancelSecretDeletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    Description string
    Credential description, length: 0 ~ 8192 characters
    EncryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    ExtendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    PendingWindowInDays int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    ProjectName string
    Credential project name. Default value: default
    RotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    SecretBackup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    SecretRestore Byteplus.SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    SecretRotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    VersionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    SecretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    SecretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    SecretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    AutomaticRotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    CancelSecretDeletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    Description string
    Credential description, length: 0 ~ 8192 characters
    EncryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    ExtendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    PendingWindowInDays int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    ProjectName string
    Credential project name. Default value: default
    RotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    SecretBackup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    SecretRestore SecretSecretRestoreArgs
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    SecretRotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    VersionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_name string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_type string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secret_value string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    automatic_rotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancel_secret_deletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    description string
    Credential description, length: 0 ~ 8192 characters
    encryption_key string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extended_config string
    Credential extension configuration, used to specify properties for non-Generic credentials
    pending_window_in_days number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    project_name string
    Credential project name. Default value: default
    rotation_interval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    secret_backup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secret_restore object
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secret_rotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    version_name string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretName String
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretType String
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue String
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    automaticRotation Boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion Boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    description String
    Credential description, length: 0 ~ 8192 characters
    encryptionKey String
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig String
    Credential extension configuration, used to specify properties for non-Generic credentials
    pendingWindowInDays Integer
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName String
    Credential project name. Default value: default
    rotationInterval String
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    secretBackup Boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretRestore SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRotate Boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    versionName String
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    automaticRotation boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    description string
    Credential description, length: 0 ~ 8192 characters
    encryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    pendingWindowInDays number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName string
    Credential project name. Default value: default
    rotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    secretBackup boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretRestore SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRotate boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    versionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_name str
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_type str
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secret_value str
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    automatic_rotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancel_secret_deletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    description str
    Credential description, length: 0 ~ 8192 characters
    encryption_key str
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extended_config str
    Credential extension configuration, used to specify properties for non-Generic credentials
    pending_window_in_days int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    project_name str
    Credential project name. Default value: default
    rotation_interval str
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    secret_backup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secret_restore SecretSecretRestoreArgs
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secret_rotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    version_name str
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretName String
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretType String
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue String
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    automaticRotation Boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion Boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    description String
    Credential description, length: 0 ~ 8192 characters
    encryptionKey String
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig String
    Credential extension configuration, used to specify properties for non-Generic credentials
    pendingWindowInDays Number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName String
    Credential project name. Default value: default
    rotationInterval String
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    secretBackup Boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretRestore Property Map
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRotate Boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    versionName String
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Secret resource produces the following output properties:

    CreatedTime int
    Credential creation time
    Id string
    The provider-assigned unique ID for this managed resource.
    LastRotationTime string
    Credential last rotation time
    Managed bool
    Is managed credential
    OwningService string
    Managed Cloud Service
    RotationIntervalRead int
    Automatic rotation interval, unit: seconds
    RotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    ScheduleDeleteTime string
    Credential Scheduled Deletion Time
    ScheduleRotationTime string
    Credential next rotation time
    SecretId string
    Credential unique identifier, UUID format
    SecretRestoreRead Byteplus.SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    SecretStateValue string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    SecretVersions List<Byteplus.SecretSecretVersion>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    Trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    Uid string
    Credential tenant ID
    UpdatedTime int
    Credential update date
    CreatedTime int
    Credential creation time
    Id string
    The provider-assigned unique ID for this managed resource.
    LastRotationTime string
    Credential last rotation time
    Managed bool
    Is managed credential
    OwningService string
    Managed Cloud Service
    RotationIntervalRead int
    Automatic rotation interval, unit: seconds
    RotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    ScheduleDeleteTime string
    Credential Scheduled Deletion Time
    ScheduleRotationTime string
    Credential next rotation time
    SecretId string
    Credential unique identifier, UUID format
    SecretRestoreRead SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    SecretState string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    SecretVersions []SecretSecretVersion
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    Trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    Uid string
    Credential tenant ID
    UpdatedTime int
    Credential update date
    created_time number
    Credential creation time
    id string
    The provider-assigned unique ID for this managed resource.
    last_rotation_time string
    Credential last rotation time
    managed bool
    Is managed credential
    owning_service string
    Managed Cloud Service
    rotation_interval_read number
    Automatic rotation interval, unit: seconds
    rotation_state string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    schedule_delete_time string
    Credential Scheduled Deletion Time
    schedule_rotation_time string
    Credential next rotation time
    secret_id string
    Credential unique identifier, UUID format
    secret_restore_read object
    Credential restore parameters. Returned only during backup.
    secret_state string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secret_versions list(object)
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid string
    Credential tenant ID
    updated_time number
    Credential update date
    createdTime Integer
    Credential creation time
    id String
    The provider-assigned unique ID for this managed resource.
    lastRotationTime String
    Credential last rotation time
    managed Boolean
    Is managed credential
    owningService String
    Managed Cloud Service
    rotationIntervalRead Integer
    Automatic rotation interval, unit: seconds
    rotationState String
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime String
    Credential Scheduled Deletion Time
    scheduleRotationTime String
    Credential next rotation time
    secretId String
    Credential unique identifier, UUID format
    secretRestoreRead SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    secretState String
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretVersions List<SecretSecretVersion>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn String
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid String
    Credential tenant ID
    updatedTime Integer
    Credential update date
    createdTime number
    Credential creation time
    id string
    The provider-assigned unique ID for this managed resource.
    lastRotationTime string
    Credential last rotation time
    managed boolean
    Is managed credential
    owningService string
    Managed Cloud Service
    rotationIntervalRead number
    Automatic rotation interval, unit: seconds
    rotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime string
    Credential Scheduled Deletion Time
    scheduleRotationTime string
    Credential next rotation time
    secretId string
    Credential unique identifier, UUID format
    secretRestoreRead SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    secretState string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretVersions SecretSecretVersion[]
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid string
    Credential tenant ID
    updatedTime number
    Credential update date
    created_time int
    Credential creation time
    id str
    The provider-assigned unique ID for this managed resource.
    last_rotation_time str
    Credential last rotation time
    managed bool
    Is managed credential
    owning_service str
    Managed Cloud Service
    rotation_interval_read int
    Automatic rotation interval, unit: seconds
    rotation_state str
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    schedule_delete_time str
    Credential Scheduled Deletion Time
    schedule_rotation_time str
    Credential next rotation time
    secret_id str
    Credential unique identifier, UUID format
    secret_restore_read SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    secret_state str
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secret_versions Sequence[SecretSecretVersion]
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn str
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid str
    Credential tenant ID
    updated_time int
    Credential update date
    createdTime Number
    Credential creation time
    id String
    The provider-assigned unique ID for this managed resource.
    lastRotationTime String
    Credential last rotation time
    managed Boolean
    Is managed credential
    owningService String
    Managed Cloud Service
    rotationIntervalRead Number
    Automatic rotation interval, unit: seconds
    rotationState String
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime String
    Credential Scheduled Deletion Time
    scheduleRotationTime String
    Credential next rotation time
    secretId String
    Credential unique identifier, UUID format
    secretRestoreRead Property Map
    Credential restore parameters. Returned only during backup.
    secretState String
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretVersions List<Property Map>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn String
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid String
    Credential tenant ID
    updatedTime Number
    Credential update date

    Look up Existing Secret Resource

    Get an existing Secret resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretState, opts?: CustomResourceOptions): Secret
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        automatic_rotation: Optional[bool] = None,
        cancel_secret_deletion: Optional[bool] = None,
        created_time: Optional[int] = None,
        description: Optional[str] = None,
        encryption_key: Optional[str] = None,
        extended_config: Optional[str] = None,
        last_rotation_time: Optional[str] = None,
        managed: Optional[bool] = None,
        owning_service: Optional[str] = None,
        pending_window_in_days: Optional[int] = None,
        project_name: Optional[str] = None,
        rotation_interval: Optional[str] = None,
        rotation_interval_read: Optional[int] = None,
        rotation_state: Optional[str] = None,
        schedule_delete_time: Optional[str] = None,
        schedule_rotation_time: Optional[str] = None,
        secret_backup: Optional[bool] = None,
        secret_id: Optional[str] = None,
        secret_name: Optional[str] = None,
        secret_restore: Optional[SecretSecretRestoreArgs] = None,
        secret_restore_read: Optional[SecretSecretRestoreReadArgs] = None,
        secret_rotate: Optional[bool] = None,
        secret_state: Optional[str] = None,
        secret_type: Optional[str] = None,
        secret_value: Optional[str] = None,
        secret_versions: Optional[Sequence[SecretSecretVersionArgs]] = None,
        trn: Optional[str] = None,
        uid: Optional[str] = None,
        updated_time: Optional[int] = None,
        version_name: Optional[str] = None) -> Secret
    func GetSecret(ctx *Context, name string, id IDInput, state *SecretState, opts ...ResourceOption) (*Secret, error)
    public static Secret Get(string name, Input<string> id, SecretState? state, CustomResourceOptions? opts = null)
    public static Secret get(String name, Output<String> id, SecretState state, CustomResourceOptions options)
    resources:  _:    type: bytepluscc:kms:Secret    get:      id: ${id}
    import {
  to = bytepluscc_kms_secret.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AutomaticRotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    CancelSecretDeletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    CreatedTime int
    Credential creation time
    Description string
    Credential description, length: 0 ~ 8192 characters
    EncryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    ExtendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    LastRotationTime string
    Credential last rotation time
    Managed bool
    Is managed credential
    OwningService string
    Managed Cloud Service
    PendingWindowInDays int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    ProjectName string
    Credential project name. Default value: default
    RotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    RotationIntervalRead int
    Automatic rotation interval, unit: seconds
    RotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    ScheduleDeleteTime string
    Credential Scheduled Deletion Time
    ScheduleRotationTime string
    Credential next rotation time
    SecretBackup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    SecretId string
    Credential unique identifier, UUID format
    SecretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    SecretRestore Byteplus.SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    SecretRestoreRead Byteplus.SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    SecretRotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    SecretStateValue string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    SecretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    SecretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    SecretVersions List<Byteplus.SecretSecretVersion>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    Trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    Uid string
    Credential tenant ID
    UpdatedTime int
    Credential update date
    VersionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    AutomaticRotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    CancelSecretDeletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    CreatedTime int
    Credential creation time
    Description string
    Credential description, length: 0 ~ 8192 characters
    EncryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    ExtendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    LastRotationTime string
    Credential last rotation time
    Managed bool
    Is managed credential
    OwningService string
    Managed Cloud Service
    PendingWindowInDays int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    ProjectName string
    Credential project name. Default value: default
    RotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    RotationIntervalRead int
    Automatic rotation interval, unit: seconds
    RotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    ScheduleDeleteTime string
    Credential Scheduled Deletion Time
    ScheduleRotationTime string
    Credential next rotation time
    SecretBackup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    SecretId string
    Credential unique identifier, UUID format
    SecretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    SecretRestore SecretSecretRestoreArgs
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    SecretRestoreRead SecretSecretRestoreReadArgs
    Credential restore parameters. Returned only during backup.
    SecretRotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    SecretState string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    SecretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    SecretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    SecretVersions []SecretSecretVersionArgs
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    Trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    Uid string
    Credential tenant ID
    UpdatedTime int
    Credential update date
    VersionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    automatic_rotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancel_secret_deletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    created_time number
    Credential creation time
    description string
    Credential description, length: 0 ~ 8192 characters
    encryption_key string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extended_config string
    Credential extension configuration, used to specify properties for non-Generic credentials
    last_rotation_time string
    Credential last rotation time
    managed bool
    Is managed credential
    owning_service string
    Managed Cloud Service
    pending_window_in_days number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    project_name string
    Credential project name. Default value: default
    rotation_interval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    rotation_interval_read number
    Automatic rotation interval, unit: seconds
    rotation_state string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    schedule_delete_time string
    Credential Scheduled Deletion Time
    schedule_rotation_time string
    Credential next rotation time
    secret_backup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secret_id string
    Credential unique identifier, UUID format
    secret_name string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_restore object
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secret_restore_read object
    Credential restore parameters. Returned only during backup.
    secret_rotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    secret_state string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secret_type string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secret_value string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    secret_versions list(object)
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid string
    Credential tenant ID
    updated_time number
    Credential update date
    version_name string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    automaticRotation Boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion Boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    createdTime Integer
    Credential creation time
    description String
    Credential description, length: 0 ~ 8192 characters
    encryptionKey String
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig String
    Credential extension configuration, used to specify properties for non-Generic credentials
    lastRotationTime String
    Credential last rotation time
    managed Boolean
    Is managed credential
    owningService String
    Managed Cloud Service
    pendingWindowInDays Integer
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName String
    Credential project name. Default value: default
    rotationInterval String
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    rotationIntervalRead Integer
    Automatic rotation interval, unit: seconds
    rotationState String
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime String
    Credential Scheduled Deletion Time
    scheduleRotationTime String
    Credential next rotation time
    secretBackup Boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretId String
    Credential unique identifier, UUID format
    secretName String
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretRestore SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRestoreRead SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    secretRotate Boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    secretState String
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretType String
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue String
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    secretVersions List<SecretSecretVersion>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn String
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid String
    Credential tenant ID
    updatedTime Integer
    Credential update date
    versionName String
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    automaticRotation boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    createdTime number
    Credential creation time
    description string
    Credential description, length: 0 ~ 8192 characters
    encryptionKey string
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig string
    Credential extension configuration, used to specify properties for non-Generic credentials
    lastRotationTime string
    Credential last rotation time
    managed boolean
    Is managed credential
    owningService string
    Managed Cloud Service
    pendingWindowInDays number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName string
    Credential project name. Default value: default
    rotationInterval string
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    rotationIntervalRead number
    Automatic rotation interval, unit: seconds
    rotationState string
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime string
    Credential Scheduled Deletion Time
    scheduleRotationTime string
    Credential next rotation time
    secretBackup boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretId string
    Credential unique identifier, UUID format
    secretName string
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretRestore SecretSecretRestore
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRestoreRead SecretSecretRestoreRead
    Credential restore parameters. Returned only during backup.
    secretRotate boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    secretState string
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretType string
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue string
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    secretVersions SecretSecretVersion[]
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn string
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid string
    Credential tenant ID
    updatedTime number
    Credential update date
    versionName string
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    automatic_rotation bool
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancel_secret_deletion bool
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    created_time int
    Credential creation time
    description str
    Credential description, length: 0 ~ 8192 characters
    encryption_key str
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extended_config str
    Credential extension configuration, used to specify properties for non-Generic credentials
    last_rotation_time str
    Credential last rotation time
    managed bool
    Is managed credential
    owning_service str
    Managed Cloud Service
    pending_window_in_days int
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    project_name str
    Credential project name. Default value: default
    rotation_interval str
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    rotation_interval_read int
    Automatic rotation interval, unit: seconds
    rotation_state str
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    schedule_delete_time str
    Credential Scheduled Deletion Time
    schedule_rotation_time str
    Credential next rotation time
    secret_backup bool
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secret_id str
    Credential unique identifier, UUID format
    secret_name str
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secret_restore SecretSecretRestoreArgs
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secret_restore_read SecretSecretRestoreReadArgs
    Credential restore parameters. Returned only during backup.
    secret_rotate bool
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    secret_state str
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secret_type str
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secret_value str
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    secret_versions Sequence[SecretSecretVersionArgs]
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn str
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid str
    Credential tenant ID
    updated_time int
    Credential update date
    version_name str
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]
    automaticRotation Boolean
    Whether to enable automatic rotation. Applies only to credentials of type IAM|RDS|Redis|ECS
    cancelSecretDeletion Boolean
    Trigger: When set to true, calls the KMS CancelSecretDeletion API to cancel the scheduled deletion of the credential.
    createdTime Number
    Credential creation time
    description String
    Credential description, length: 0 ~ 8192 characters
    encryptionKey String
    KMS key TRN for encrypting credential value. If not specified, the default key of Credential Manager is used
    extendedConfig String
    Credential extension configuration, used to specify properties for non-Generic credentials
    lastRotationTime String
    Credential last rotation time
    managed Boolean
    Is managed credential
    owningService String
    Managed Cloud Service
    pendingWindowInDays Number
    Credential pre-deletion period. During this time, you can revoke the deletion of credentials in pending deletion status; after the pre-deletion period, deletion cannot be revoked. Value range: 7 ~ 30. Unit: days. Default: 7. To cancel, use CancelSecretDeletion.
    projectName String
    Credential project name. Default value: default
    rotationInterval String
    Automatic rotation interval. Range: 1 ~ 365 days. Format: integer[unit], where integer is the duration and unit is the time unit. Unit value: d (days). For example: 7d means a 7-day interval
    rotationIntervalRead Number
    Automatic rotation interval, unit: seconds
    rotationState String
    Rotation status: Enable: automatic rotation enabled, Disable: automatic rotation disabled, Rotating: automatic rotation in progress, None: automatic rotation not supported
    scheduleDeleteTime String
    Credential Scheduled Deletion Time
    scheduleRotationTime String
    Credential next rotation time
    secretBackup Boolean
    Trigger: When set to true, calls the KMS BackupSecret API to back up the credential. The backup result is written to SecretRestoreRead. Please keep it safe.
    secretId String
    Credential unique identifier, UUID format
    secretName String
    Credential name. Valid characters: [a-zA-Z0-9/_+=.@-]
    secretRestore Property Map
    Credential restore parameters. Only effective during creation. If provided, calls the KMS RestoreSecret API to restore the credential from backup data. Other creation parameters such as SecretValue, SecretType, and SecretName will not take effect.
    secretRestoreRead Property Map
    Credential restore parameters. Returned only during backup.
    secretRotate Boolean
    Trigger: When set to true, calls the KMS RotateSecret API to manually rotate the credential.
    secretState String
    Credential status. Enable: enabled, Disable: disabled, PendingDelete: scheduled for deletion
    secretType String
    Credential type. Currently supports Generic|IAM|RDS|Redis|ECS|PGSQL|SQLServer
    secretValue String
    Credential value. When SecretType is Generic, users can customize it. It is recommended to use JSON key-value pairs
    secretVersions List<Property Map>
    Credential version information. Important Note: When using SetNestedAttribute, you must fully define all attributes of its nested structure. Incomplete definitions may cause Terraform to detect unexpected differences during plan comparison, triggering unnecessary resource updates and affecting resource stability and predictability.
    trn String
    Credential resource name. Format: trn:kms:${Region}:${AccountID}:secrets/${secret}
    uid String
    Credential tenant ID
    updatedTime Number
    Credential update date
    versionName String
    Version alias. Valid characters: [a-zA-Z0-9/_+=.@-]

    Supporting Types

    SecretSecretRestore, SecretSecretRestoreArgs

    BackupData string
    Complete credential data returned by backup, in JSON format.
    SecretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    Signature string
    Signature of the backup data, Base64 encoded.
    BackupData string
    Complete credential data returned by backup, in JSON format.
    SecretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    Signature string
    Signature of the backup data, Base64 encoded.
    backup_data string
    Complete credential data returned by backup, in JSON format.
    secret_data_key string
    Encrypted data key returned by backup, Base64 encoded.
    signature string
    Signature of the backup data, Base64 encoded.
    backupData String
    Complete credential data returned by backup, in JSON format.
    secretDataKey String
    Encrypted data key returned by backup, Base64 encoded.
    signature String
    Signature of the backup data, Base64 encoded.
    backupData string
    Complete credential data returned by backup, in JSON format.
    secretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    signature string
    Signature of the backup data, Base64 encoded.
    backup_data str
    Complete credential data returned by backup, in JSON format.
    secret_data_key str
    Encrypted data key returned by backup, Base64 encoded.
    signature str
    Signature of the backup data, Base64 encoded.
    backupData String
    Complete credential data returned by backup, in JSON format.
    secretDataKey String
    Encrypted data key returned by backup, Base64 encoded.
    signature String
    Signature of the backup data, Base64 encoded.

    SecretSecretRestoreRead, SecretSecretRestoreReadArgs

    BackupData string
    Complete credential data returned by backup, in JSON format.
    SecretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    Signature string
    Signature of the backup data, Base64 encoded.
    BackupData string
    Complete credential data returned by backup, in JSON format.
    SecretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    Signature string
    Signature of the backup data, Base64 encoded.
    backup_data string
    Complete credential data returned by backup, in JSON format.
    secret_data_key string
    Encrypted data key returned by backup, Base64 encoded.
    signature string
    Signature of the backup data, Base64 encoded.
    backupData String
    Complete credential data returned by backup, in JSON format.
    secretDataKey String
    Encrypted data key returned by backup, Base64 encoded.
    signature String
    Signature of the backup data, Base64 encoded.
    backupData string
    Complete credential data returned by backup, in JSON format.
    secretDataKey string
    Encrypted data key returned by backup, Base64 encoded.
    signature string
    Signature of the backup data, Base64 encoded.
    backup_data str
    Complete credential data returned by backup, in JSON format.
    secret_data_key str
    Encrypted data key returned by backup, Base64 encoded.
    signature str
    Signature of the backup data, Base64 encoded.
    backupData String
    Complete credential data returned by backup, in JSON format.
    secretDataKey String
    Encrypted data key returned by backup, Base64 encoded.
    signature String
    Signature of the backup data, Base64 encoded.

    SecretSecretVersion, SecretSecretVersionArgs

    CreationDate int
    Credential version creation time.
    VersionId string
    Unique identifier for the credential version, in UUID format.
    VersionStage string
    Credential version tags.
    CreationDate int
    Credential version creation time.
    VersionId string
    Unique identifier for the credential version, in UUID format.
    VersionStage string
    Credential version tags.
    creation_date number
    Credential version creation time.
    version_id string
    Unique identifier for the credential version, in UUID format.
    version_stage string
    Credential version tags.
    creationDate Integer
    Credential version creation time.
    versionId String
    Unique identifier for the credential version, in UUID format.
    versionStage String
    Credential version tags.
    creationDate number
    Credential version creation time.
    versionId string
    Unique identifier for the credential version, in UUID format.
    versionStage string
    Credential version tags.
    creation_date int
    Credential version creation time.
    version_id str
    Unique identifier for the credential version, in UUID format.
    version_stage str
    Credential version tags.
    creationDate Number
    Credential version creation time.
    versionId String
    Unique identifier for the credential version, in UUID format.
    versionStage String
    Credential version tags.

    Import

    $ pulumi import bytepluscc:kms/secret:Secret example "secret_name"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    bytepluscc byteplus-sdk/pulumi-bytepluscc
    License
    MPL-2.0
    Notes
    This Pulumi package is based on the bytepluscc Terraform Provider.
    bytepluscc logo
    Viewing docs for bytepluscc v0.0.43
    published on Monday, Jul 27, 2026 by Byteplus
    Schema (JSON)
    byteplus-sdk/pulumi-bytepluscc

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial