published on Thursday, Feb 12, 2026 by Pulumi
published on Thursday, Feb 12, 2026 by Pulumi
This resource allows you to configure a trust store for your RabbitMQ broker. The trust store enables RabbitMQ to fetch and use CA certificates from an external source for validating client certificates, or upload multiple leaf certificates as an allow list.
The http.cacert and file.certificates fields use WriteOnly, meaning no information is
present in plan phase, logs or stored in the state for security purposes. To update these fields,
increment either the version or update the key_id attribute.
Note: Updates to write-only fields (
http.cacertorfile.certificates) are only applied whenversionis incremented orkey_idis changed. This design allows you to manage certificate rotation explicitly.
Note: After the trust store has been added, a restart of RabbitMQ is required for the changes to take effect.
Only available for dedicated subscription plans running RabbitMQ.
Example Usage
Trust store configuration with HTTP provider
import * as pulumi from "@pulumi/pulumi";
import * as cloudamqp from "@pulumi/cloudamqp";
const trustStore = new cloudamqp.TrustStore("trust_store", {
instanceId: instance.id,
http: {
url: "https://example.com/trust-store-certs",
},
refreshInterval: 30,
});
import pulumi
import pulumi_cloudamqp as cloudamqp
trust_store = cloudamqp.TrustStore("trust_store",
instance_id=instance["id"],
http={
"url": "https://example.com/trust-store-certs",
},
refresh_interval=30)
package main
import (
"github.com/pulumi/pulumi-cloudamqp/sdk/v3/go/cloudamqp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := cloudamqp.NewTrustStore(ctx, "trust_store", &cloudamqp.TrustStoreArgs{
InstanceId: pulumi.Any(instance.Id),
Http: &cloudamqp.TrustStoreHttpArgs{
Url: pulumi.String("https://example.com/trust-store-certs"),
},
RefreshInterval: pulumi.Int(30),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudAmqp = Pulumi.CloudAmqp;
return await Deployment.RunAsync(() =>
{
var trustStore = new CloudAmqp.TrustStore("trust_store", new()
{
InstanceId = instance.Id,
Http = new CloudAmqp.Inputs.TrustStoreHttpArgs
{
Url = "https://example.com/trust-store-certs",
},
RefreshInterval = 30,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudamqp.TrustStore;
import com.pulumi.cloudamqp.TrustStoreArgs;
import com.pulumi.cloudamqp.inputs.TrustStoreHttpArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var trustStore = new TrustStore("trustStore", TrustStoreArgs.builder()
.instanceId(instance.id())
.http(TrustStoreHttpArgs.builder()
.url("https://example.com/trust-store-certs")
.build())
.refreshInterval(30)
.build());
}
}
resources:
trustStore:
type: cloudamqp:TrustStore
name: trust_store
properties:
instanceId: ${instance.id}
http:
url: https://example.com/trust-store-certs
refreshInterval: 30
Trust store with HTTP provider and CA certificate
Create TrustStore Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new TrustStore(name: string, args: TrustStoreArgs, opts?: CustomResourceOptions);@overload
def TrustStore(resource_name: str,
args: TrustStoreArgs,
opts: Optional[ResourceOptions] = None)
@overload
def TrustStore(resource_name: str,
opts: Optional[ResourceOptions] = None,
instance_id: Optional[int] = None,
file: Optional[TrustStoreFileArgs] = None,
http: Optional[TrustStoreHttpArgs] = None,
key_id: Optional[str] = None,
refresh_interval: Optional[int] = None,
sleep: Optional[int] = None,
timeout: Optional[int] = None,
version: Optional[int] = None)func NewTrustStore(ctx *Context, name string, args TrustStoreArgs, opts ...ResourceOption) (*TrustStore, error)public TrustStore(string name, TrustStoreArgs args, CustomResourceOptions? opts = null)
public TrustStore(String name, TrustStoreArgs args)
public TrustStore(String name, TrustStoreArgs args, CustomResourceOptions options)
type: cloudamqp:TrustStore
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args TrustStoreArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args TrustStoreArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args TrustStoreArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args TrustStoreArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args TrustStoreArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var trustStoreResource = new CloudAmqp.TrustStore("trustStoreResource", new()
{
InstanceId = 0,
File = new CloudAmqp.Inputs.TrustStoreFileArgs
{
Certificates = new[]
{
new CloudAmqp.Inputs.TrustStoreFileCertificateArgs
{
Content = "string",
Name = "string",
},
},
},
Http = new CloudAmqp.Inputs.TrustStoreHttpArgs
{
Cacert = "string",
Url = "string",
},
KeyId = "string",
RefreshInterval = 0,
Sleep = 0,
Timeout = 0,
Version = 0,
});
example, err := cloudamqp.NewTrustStore(ctx, "trustStoreResource", &cloudamqp.TrustStoreArgs{
InstanceId: pulumi.Int(0),
File: &cloudamqp.TrustStoreFileArgs{
Certificates: cloudamqp.TrustStoreFileCertificateArray{
&cloudamqp.TrustStoreFileCertificateArgs{
Content: pulumi.String("string"),
Name: pulumi.String("string"),
},
},
},
Http: &cloudamqp.TrustStoreHttpArgs{
Cacert: pulumi.String("string"),
Url: pulumi.String("string"),
},
KeyId: pulumi.String("string"),
RefreshInterval: pulumi.Int(0),
Sleep: pulumi.Int(0),
Timeout: pulumi.Int(0),
Version: pulumi.Int(0),
})
var trustStoreResource = new TrustStore("trustStoreResource", TrustStoreArgs.builder()
.instanceId(0)
.file(TrustStoreFileArgs.builder()
.certificates(TrustStoreFileCertificateArgs.builder()
.content("string")
.name("string")
.build())
.build())
.http(TrustStoreHttpArgs.builder()
.cacert("string")
.url("string")
.build())
.keyId("string")
.refreshInterval(0)
.sleep(0)
.timeout(0)
.version(0)
.build());
trust_store_resource = cloudamqp.TrustStore("trustStoreResource",
instance_id=0,
file={
"certificates": [{
"content": "string",
"name": "string",
}],
},
http={
"cacert": "string",
"url": "string",
},
key_id="string",
refresh_interval=0,
sleep=0,
timeout=0,
version=0)
const trustStoreResource = new cloudamqp.TrustStore("trustStoreResource", {
instanceId: 0,
file: {
certificates: [{
content: "string",
name: "string",
}],
},
http: {
cacert: "string",
url: "string",
},
keyId: "string",
refreshInterval: 0,
sleep: 0,
timeout: 0,
version: 0,
});
type: cloudamqp:TrustStore
properties:
file:
certificates:
- content: string
name: string
http:
cacert: string
url: string
instanceId: 0
keyId: string
refreshInterval: 0
sleep: 0
timeout: 0
version: 0
TrustStore Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The TrustStore resource accepts the following input properties:
- Instance
Id int - The CloudAMQP instance identifier.
- File
Pulumi.
Cloud Amqp. Inputs. Trust Store File - File trust store configuration block. See File Block below.
- Http
Pulumi.
Cloud Amqp. Inputs. Trust Store Http - HTTP trust store configuration block. See HTTP Block below.
- Key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- Refresh
Interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- Sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- Timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- Version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- Instance
Id int - The CloudAMQP instance identifier.
- File
Trust
Store File Args - File trust store configuration block. See File Block below.
- Http
Trust
Store Http Args - HTTP trust store configuration block. See HTTP Block below.
- Key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- Refresh
Interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- Sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- Timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- Version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- instance
Id Integer - The CloudAMQP instance identifier.
- file
Trust
Store File - File trust store configuration block. See File Block below.
- http
Trust
Store Http - HTTP trust store configuration block. See HTTP Block below.
- key
Id String - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval Integer - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep Integer
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout Integer
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version Integer
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- instance
Id number - The CloudAMQP instance identifier.
- file
Trust
Store File - File trust store configuration block. See File Block below.
- http
Trust
Store Http - HTTP trust store configuration block. See HTTP Block below.
- key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval number - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep number
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout number
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version number
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- instance_
id int - The CloudAMQP instance identifier.
- file
Trust
Store File Args - File trust store configuration block. See File Block below.
- http
Trust
Store Http Args - HTTP trust store configuration block. See HTTP Block below.
- key_
id str - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh_
interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- instance
Id Number - The CloudAMQP instance identifier.
- file Property Map
- File trust store configuration block. See File Block below.
- http Property Map
- HTTP trust store configuration block. See HTTP Block below.
- key
Id String - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval Number - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep Number
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout Number
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version Number
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
Outputs
All input properties are implicitly available as output properties. Additionally, the TrustStore resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing TrustStore Resource
Get an existing TrustStore resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: TrustStoreState, opts?: CustomResourceOptions): TrustStore@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
file: Optional[TrustStoreFileArgs] = None,
http: Optional[TrustStoreHttpArgs] = None,
instance_id: Optional[int] = None,
key_id: Optional[str] = None,
refresh_interval: Optional[int] = None,
sleep: Optional[int] = None,
timeout: Optional[int] = None,
version: Optional[int] = None) -> TrustStorefunc GetTrustStore(ctx *Context, name string, id IDInput, state *TrustStoreState, opts ...ResourceOption) (*TrustStore, error)public static TrustStore Get(string name, Input<string> id, TrustStoreState? state, CustomResourceOptions? opts = null)public static TrustStore get(String name, Output<String> id, TrustStoreState state, CustomResourceOptions options)resources: _: type: cloudamqp:TrustStore get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- File
Pulumi.
Cloud Amqp. Inputs. Trust Store File - File trust store configuration block. See File Block below.
- Http
Pulumi.
Cloud Amqp. Inputs. Trust Store Http - HTTP trust store configuration block. See HTTP Block below.
- Instance
Id int - The CloudAMQP instance identifier.
- Key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- Refresh
Interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- Sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- Timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- Version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- File
Trust
Store File Args - File trust store configuration block. See File Block below.
- Http
Trust
Store Http Args - HTTP trust store configuration block. See HTTP Block below.
- Instance
Id int - The CloudAMQP instance identifier.
- Key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- Refresh
Interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- Sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- Timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- Version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- file
Trust
Store File - File trust store configuration block. See File Block below.
- http
Trust
Store Http - HTTP trust store configuration block. See HTTP Block below.
- instance
Id Integer - The CloudAMQP instance identifier.
- key
Id String - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval Integer - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep Integer
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout Integer
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version Integer
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- file
Trust
Store File - File trust store configuration block. See File Block below.
- http
Trust
Store Http - HTTP trust store configuration block. See HTTP Block below.
- instance
Id number - The CloudAMQP instance identifier.
- key
Id string - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval number - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep number
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout number
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version number
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- file
Trust
Store File Args - File trust store configuration block. See File Block below.
- http
Trust
Store Http Args - HTTP trust store configuration block. See HTTP Block below.
- instance_
id int - The CloudAMQP instance identifier.
- key_
id str - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh_
interval int - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep int
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout int
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version int
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
- file Property Map
- File trust store configuration block. See File Block below.
- http Property Map
- HTTP trust store configuration block. See HTTP Block below.
- instance
Id Number - The CloudAMQP instance identifier.
- key
Id String - A string identifier to trigger updates of write-only certificate fields. Change this value to apply changes to http.cacert or file.certificates (default: "").
- refresh
Interval Number - Interval in seconds for RabbitMQ to refresh the trust store certificates (default: 30).
- sleep Number
- Configurable sleep time in seconds between retries for trust store operations (default: 10).
- timeout Number
Configurable timeout time in seconds for trust store operations (default: 1800).
Note: Either
httporfileconfiguration block must be specified, but not both.- version Number
- An integer to trigger updates of write-only certificate fields. Increment this value to apply changes to http.cacert or file.certificates (default: 1).
Supporting Types
TrustStoreFile, TrustStoreFileArgs
- Certificates
List<Pulumi.
Cloud Amqp. Inputs. Trust Store File Certificate> - A list of certificate blocks (1-100 certificates). Each certificate block contains:
- Certificates
[]Trust
Store File Certificate - A list of certificate blocks (1-100 certificates). Each certificate block contains:
- certificates
List<Trust
Store File Certificate> - A list of certificate blocks (1-100 certificates). Each certificate block contains:
- certificates
Trust
Store File Certificate[] - A list of certificate blocks (1-100 certificates). Each certificate block contains:
- certificates
Sequence[Trust
Store File Certificate] - A list of certificate blocks (1-100 certificates). Each certificate block contains:
- certificates List<Property Map>
- A list of certificate blocks (1-100 certificates). Each certificate block contains:
TrustStoreFileCertificate, TrustStoreFileCertificateArgs
TrustStoreHttp, TrustStoreHttpArgs
- Cacert string
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - Url string
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
- Cacert string
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - Url string
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
- cacert String
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - url String
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
- cacert string
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - url string
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
- cacert str
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - url str
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
- cacert String
- NOTE: This field is write-only and its value will not be updated in state as part of read operations.
PEM-encoded CA certificates used to verify the HTTPS connection to
the trust store URL. Updates require incrementing
versionor changingkey_id. - url String
- URL to fetch trust store certificates from. RabbitMQ will periodically fetch
CA certificates from this URL according to the
refresh_interval.
Import
cloudamqp_trust_store can be imported using the CloudAMQP instance identifier.
fields (http.cacert or file.certificates). You’ll need to set these in your configuration.
From Terraform v1.5.0, the import block can be used to import this resource:
hcl
import {
to = cloudamqp_trust_store.trust_store
id = cloudamqp_instance.instance.id
}
Or use Terraform CLI:
$ pulumi import cloudamqp:index/trustStore:TrustStore trust_store <instance_id>`
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- CloudAMQP pulumi/pulumi-cloudamqp
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
cloudamqpTerraform Provider.
published on Thursday, Feb 12, 2026 by Pulumi
