1. Registry
  2. Packages
  3. Konnect Provider
  4. API Docs
  5. AiGatewayVault
Viewing docs for konnect 3.23.0
published on Friday, Sep 18, 2026 by kong
Viewing docs for konnect 3.23.0
published on Friday, Sep 18, 2026 by kong

    AIGatewayVault Resource

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as konnect from "@pulumi/konnect";
    
    const myAigatewayvault = new konnect.AiGatewayVault("my_aigatewayvault", {
        aws: {
            config: {
                assumeRoleArn: "...my_assume_role_arn...",
                base64Decode: true,
                endpointUrl: "...my_endpoint_url...",
                negTtl: 0,
                region: "us-east-1",
                resurrectTtl: 100000000,
                roleSessionName: "KongVault",
                stsEndpointUrl: "...my_sts_endpoint_url...",
                ttl: 0,
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        azure: {
            config: {
                base64Decode: true,
                clientId: "...my_client_id...",
                credentialsPrefix: "AZURE",
                location: "...my_location...",
                negTtl: 0,
                resurrectTtl: 100000000,
                tenantId: "...my_tenant_id...",
                ttl: 0,
                type: "secrets",
                vaultUri: "...my_vault_uri...",
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        conjur: {
            config: {
                account: "...my_account...",
                apiKey: "...my_api_key...",
                base64Decode: false,
                endpointUrl: "...my_endpoint_url...",
                login: "...my_login...",
                negTtl: 0,
                resurrectTtl: 100000000,
                ttl: 0,
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        env: {
            config: {
                base64Decode: false,
                prefix: "MY_SECRET_",
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        gatewayId: "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
        gcp: {
            config: {
                base64Decode: true,
                negTtl: 0,
                projectId: "...my_project_id...",
                resurrectTtl: 100000000,
                ttl: 0,
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        hcv: {
            config: {
                jwt: {
                    audiences: "...my_audiences...",
                    base64Decode: true,
                    clientId: "...my_client_id...",
                    clientSecret: "...my_client_secret...",
                    host: "...my_host...",
                    kv: "v1",
                    mount: "secret",
                    namespace: "...my_namespace...",
                    negTtl: 0,
                    port: 5,
                    protocol: "https",
                    resurrectTtl: 100000000,
                    role: "demo",
                    sslVerify: true,
                    tokenEndpoint: "...my_token_endpoint...",
                    ttl: 0,
                },
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
        konnect: {
            config: {
                configStoreId: "77426bee-2bca-4005-81af-284868fd3038",
            },
            description: "This vault is used to retrieve redis database access credentials",
            labels: {
                key: "value",
            },
            managedBy: {
                key: "value",
            },
            name: "my-awesome-vault",
        },
    });
    
    import pulumi
    import pulumi_konnect as konnect
    
    my_aigatewayvault = konnect.AiGatewayVault("my_aigatewayvault",
        aws={
            "config": {
                "assume_role_arn": "...my_assume_role_arn...",
                "base64_decode": True,
                "endpoint_url": "...my_endpoint_url...",
                "neg_ttl": 0,
                "region": "us-east-1",
                "resurrect_ttl": 100000000,
                "role_session_name": "KongVault",
                "sts_endpoint_url": "...my_sts_endpoint_url...",
                "ttl": 0,
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        azure={
            "config": {
                "base64_decode": True,
                "client_id": "...my_client_id...",
                "credentials_prefix": "AZURE",
                "location": "...my_location...",
                "neg_ttl": 0,
                "resurrect_ttl": 100000000,
                "tenant_id": "...my_tenant_id...",
                "ttl": 0,
                "type": "secrets",
                "vault_uri": "...my_vault_uri...",
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        conjur={
            "config": {
                "account": "...my_account...",
                "api_key": "...my_api_key...",
                "base64_decode": False,
                "endpoint_url": "...my_endpoint_url...",
                "login": "...my_login...",
                "neg_ttl": 0,
                "resurrect_ttl": 100000000,
                "ttl": 0,
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        env={
            "config": {
                "base64_decode": False,
                "prefix": "MY_SECRET_",
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        gateway_id="5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
        gcp={
            "config": {
                "base64_decode": True,
                "neg_ttl": 0,
                "project_id": "...my_project_id...",
                "resurrect_ttl": 100000000,
                "ttl": 0,
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        hcv={
            "config": {
                "jwt": {
                    "audiences": "...my_audiences...",
                    "base64_decode": True,
                    "client_id": "...my_client_id...",
                    "client_secret": "...my_client_secret...",
                    "host": "...my_host...",
                    "kv": "v1",
                    "mount": "secret",
                    "namespace": "...my_namespace...",
                    "neg_ttl": 0,
                    "port": 5,
                    "protocol": "https",
                    "resurrect_ttl": 100000000,
                    "role": "demo",
                    "ssl_verify": True,
                    "token_endpoint": "...my_token_endpoint...",
                    "ttl": 0,
                },
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        },
        konnect={
            "config": {
                "config_store_id": "77426bee-2bca-4005-81af-284868fd3038",
            },
            "description": "This vault is used to retrieve redis database access credentials",
            "labels": {
                "key": "value",
            },
            "managed_by": {
                "key": "value",
            },
            "name": "my-awesome-vault",
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/konnect/v3/konnect"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := konnect.NewAiGatewayVault(ctx, "my_aigatewayvault", &konnect.AiGatewayVaultArgs{
    			Aws: &konnect.AiGatewayVaultAwsArgs{
    				Config: &konnect.AiGatewayVaultAwsConfigArgs{
    					AssumeRoleArn:   pulumi.String("...my_assume_role_arn..."),
    					Base64Decode:    pulumi.Bool(true),
    					EndpointUrl:     pulumi.String("...my_endpoint_url..."),
    					NegTtl:          pulumi.Float64(0),
    					Region:          pulumi.String("us-east-1"),
    					ResurrectTtl:    pulumi.Float64(100000000),
    					RoleSessionName: pulumi.String("KongVault"),
    					StsEndpointUrl:  pulumi.String("...my_sts_endpoint_url..."),
    					Ttl:             pulumi.Float64(0),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			Azure: &konnect.AiGatewayVaultAzureArgs{
    				Config: &konnect.AiGatewayVaultAzureConfigArgs{
    					Base64Decode:      pulumi.Bool(true),
    					ClientId:          pulumi.String("...my_client_id..."),
    					CredentialsPrefix: pulumi.String("AZURE"),
    					Location:          pulumi.String("...my_location..."),
    					NegTtl:            pulumi.Float64(0),
    					ResurrectTtl:      pulumi.Float64(100000000),
    					TenantId:          pulumi.String("...my_tenant_id..."),
    					Ttl:               pulumi.Float64(0),
    					Type:              pulumi.String("secrets"),
    					VaultUri:          pulumi.String("...my_vault_uri..."),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			Conjur: &konnect.AiGatewayVaultConjurArgs{
    				Config: &konnect.AiGatewayVaultConjurConfigArgs{
    					Account:      pulumi.String("...my_account..."),
    					ApiKey:       pulumi.String("...my_api_key..."),
    					Base64Decode: pulumi.Bool(false),
    					EndpointUrl:  pulumi.String("...my_endpoint_url..."),
    					Login:        pulumi.String("...my_login..."),
    					NegTtl:       pulumi.Float64(0),
    					ResurrectTtl: pulumi.Float64(100000000),
    					Ttl:          pulumi.Float64(0),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			Env: &konnect.AiGatewayVaultEnvArgs{
    				Config: &konnect.AiGatewayVaultEnvConfigArgs{
    					Base64Decode: pulumi.Bool(false),
    					Prefix:       pulumi.String("MY_SECRET_"),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			GatewayId: pulumi.String("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"),
    			Gcp: &konnect.AiGatewayVaultGcpArgs{
    				Config: &konnect.AiGatewayVaultGcpConfigArgs{
    					Base64Decode: pulumi.Bool(true),
    					NegTtl:       pulumi.Float64(0),
    					ProjectId:    pulumi.String("...my_project_id..."),
    					ResurrectTtl: pulumi.Float64(100000000),
    					Ttl:          pulumi.Float64(0),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			Hcv: &konnect.AiGatewayVaultHcvArgs{
    				Config: &konnect.AiGatewayVaultHcvConfigArgs{
    					Jwt: &konnect.AiGatewayVaultHcvConfigJwtArgs{
    						Audiences:     pulumi.String("...my_audiences..."),
    						Base64Decode:  pulumi.Bool(true),
    						ClientId:      pulumi.String("...my_client_id..."),
    						ClientSecret:  pulumi.String("...my_client_secret..."),
    						Host:          pulumi.String("...my_host..."),
    						Kv:            pulumi.String("v1"),
    						Mount:         pulumi.String("secret"),
    						Namespace:     pulumi.String("...my_namespace..."),
    						NegTtl:        pulumi.Float64(0),
    						Port:          pulumi.Float64(5),
    						Protocol:      pulumi.String("https"),
    						ResurrectTtl:  pulumi.Float64(100000000),
    						Role:          pulumi.String("demo"),
    						SslVerify:     pulumi.Bool(true),
    						TokenEndpoint: pulumi.String("...my_token_endpoint..."),
    						Ttl:           pulumi.Float64(0),
    					},
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    			Konnect: &konnect.AiGatewayVaultKonnectArgs{
    				Config: &konnect.AiGatewayVaultKonnectConfigArgs{
    					ConfigStoreId: pulumi.String("77426bee-2bca-4005-81af-284868fd3038"),
    				},
    				Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
    				Labels: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				ManagedBy: pulumi.StringMap{
    					"key": pulumi.String("value"),
    				},
    				Name: pulumi.String("my-awesome-vault"),
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Konnect = Pulumi.Konnect;
    
    return await Deployment.RunAsync(() => 
    {
        var myAigatewayvault = new Konnect.AiGatewayVault("my_aigatewayvault", new()
        {
            Aws = new Konnect.Inputs.AiGatewayVaultAwsArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultAwsConfigArgs
                {
                    AssumeRoleArn = "...my_assume_role_arn...",
                    Base64Decode = true,
                    EndpointUrl = "...my_endpoint_url...",
                    NegTtl = 0,
                    Region = "us-east-1",
                    ResurrectTtl = 100000000,
                    RoleSessionName = "KongVault",
                    StsEndpointUrl = "...my_sts_endpoint_url...",
                    Ttl = 0,
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            Azure = new Konnect.Inputs.AiGatewayVaultAzureArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultAzureConfigArgs
                {
                    Base64Decode = true,
                    ClientId = "...my_client_id...",
                    CredentialsPrefix = "AZURE",
                    Location = "...my_location...",
                    NegTtl = 0,
                    ResurrectTtl = 100000000,
                    TenantId = "...my_tenant_id...",
                    Ttl = 0,
                    Type = "secrets",
                    VaultUri = "...my_vault_uri...",
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            Conjur = new Konnect.Inputs.AiGatewayVaultConjurArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultConjurConfigArgs
                {
                    Account = "...my_account...",
                    ApiKey = "...my_api_key...",
                    Base64Decode = false,
                    EndpointUrl = "...my_endpoint_url...",
                    Login = "...my_login...",
                    NegTtl = 0,
                    ResurrectTtl = 100000000,
                    Ttl = 0,
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            Env = new Konnect.Inputs.AiGatewayVaultEnvArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultEnvConfigArgs
                {
                    Base64Decode = false,
                    Prefix = "MY_SECRET_",
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            GatewayId = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
            Gcp = new Konnect.Inputs.AiGatewayVaultGcpArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultGcpConfigArgs
                {
                    Base64Decode = true,
                    NegTtl = 0,
                    ProjectId = "...my_project_id...",
                    ResurrectTtl = 100000000,
                    Ttl = 0,
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            Hcv = new Konnect.Inputs.AiGatewayVaultHcvArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultHcvConfigArgs
                {
                    Jwt = new Konnect.Inputs.AiGatewayVaultHcvConfigJwtArgs
                    {
                        Audiences = "...my_audiences...",
                        Base64Decode = true,
                        ClientId = "...my_client_id...",
                        ClientSecret = "...my_client_secret...",
                        Host = "...my_host...",
                        Kv = "v1",
                        Mount = "secret",
                        Namespace = "...my_namespace...",
                        NegTtl = 0,
                        Port = 5,
                        Protocol = "https",
                        ResurrectTtl = 100000000,
                        Role = "demo",
                        SslVerify = true,
                        TokenEndpoint = "...my_token_endpoint...",
                        Ttl = 0,
                    },
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
            Konnect = new Konnect.Inputs.AiGatewayVaultKonnectArgs
            {
                Config = new Konnect.Inputs.AiGatewayVaultKonnectConfigArgs
                {
                    ConfigStoreId = "77426bee-2bca-4005-81af-284868fd3038",
                },
                Description = "This vault is used to retrieve redis database access credentials",
                Labels = 
                {
                    { "key", "value" },
                },
                ManagedBy = 
                {
                    { "key", "value" },
                },
                Name = "my-awesome-vault",
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.konnect.AiGatewayVault;
    import com.pulumi.konnect.AiGatewayVaultArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultAwsArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultAwsConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultAzureArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultAzureConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultConjurArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultConjurConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultEnvArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultEnvConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultGcpArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultGcpConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultHcvArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultHcvConfigArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultHcvConfigJwtArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultKonnectArgs;
    import com.pulumi.konnect.inputs.AiGatewayVaultKonnectConfigArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var myAigatewayvault = new AiGatewayVault("myAigatewayvault", AiGatewayVaultArgs.builder()
                .aws(AiGatewayVaultAwsArgs.builder()
                    .config(AiGatewayVaultAwsConfigArgs.builder()
                        .assumeRoleArn("...my_assume_role_arn...")
                        .base64Decode(true)
                        .endpointUrl("...my_endpoint_url...")
                        .negTtl(0.0)
                        .region("us-east-1")
                        .resurrectTtl(100000000.0)
                        .roleSessionName("KongVault")
                        .stsEndpointUrl("...my_sts_endpoint_url...")
                        .ttl(0.0)
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .azure(AiGatewayVaultAzureArgs.builder()
                    .config(AiGatewayVaultAzureConfigArgs.builder()
                        .base64Decode(true)
                        .clientId("...my_client_id...")
                        .credentialsPrefix("AZURE")
                        .location("...my_location...")
                        .negTtl(0.0)
                        .resurrectTtl(100000000.0)
                        .tenantId("...my_tenant_id...")
                        .ttl(0.0)
                        .type("secrets")
                        .vaultUri("...my_vault_uri...")
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .conjur(AiGatewayVaultConjurArgs.builder()
                    .config(AiGatewayVaultConjurConfigArgs.builder()
                        .account("...my_account...")
                        .apiKey("...my_api_key...")
                        .base64Decode(false)
                        .endpointUrl("...my_endpoint_url...")
                        .login("...my_login...")
                        .negTtl(0.0)
                        .resurrectTtl(100000000.0)
                        .ttl(0.0)
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .env(AiGatewayVaultEnvArgs.builder()
                    .config(AiGatewayVaultEnvConfigArgs.builder()
                        .base64Decode(false)
                        .prefix("MY_SECRET_")
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .gatewayId("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7")
                .gcp(AiGatewayVaultGcpArgs.builder()
                    .config(AiGatewayVaultGcpConfigArgs.builder()
                        .base64Decode(true)
                        .negTtl(0.0)
                        .projectId("...my_project_id...")
                        .resurrectTtl(100000000.0)
                        .ttl(0.0)
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .hcv(AiGatewayVaultHcvArgs.builder()
                    .config(AiGatewayVaultHcvConfigArgs.builder()
                        .jwt(AiGatewayVaultHcvConfigJwtArgs.builder()
                            .audiences("...my_audiences...")
                            .base64Decode(true)
                            .clientId("...my_client_id...")
                            .clientSecret("...my_client_secret...")
                            .host("...my_host...")
                            .kv("v1")
                            .mount("secret")
                            .namespace("...my_namespace...")
                            .negTtl(0.0)
                            .port(5.0)
                            .protocol("https")
                            .resurrectTtl(100000000.0)
                            .role("demo")
                            .sslVerify(true)
                            .tokenEndpoint("...my_token_endpoint...")
                            .ttl(0.0)
                            .build())
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .konnect(AiGatewayVaultKonnectArgs.builder()
                    .config(AiGatewayVaultKonnectConfigArgs.builder()
                        .configStoreId("77426bee-2bca-4005-81af-284868fd3038")
                        .build())
                    .description("This vault is used to retrieve redis database access credentials")
                    .labels(Map.of("key", "value"))
                    .managedBy(Map.of("key", "value"))
                    .name("my-awesome-vault")
                    .build())
                .build());
    
        }
    }
    
    resources:
      myAigatewayvault:
        type: konnect:AiGatewayVault
        name: my_aigatewayvault
        properties:
          aws:
            config:
              assumeRoleArn: '...my_assume_role_arn...'
              base64Decode: true
              endpointUrl: '...my_endpoint_url...'
              negTtl: 0
              region: us-east-1
              resurrectTtl: 1e+08
              roleSessionName: KongVault
              stsEndpointUrl: '...my_sts_endpoint_url...'
              ttl: 0
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          azure:
            config:
              base64Decode: true
              clientId: '...my_client_id...'
              credentialsPrefix: AZURE
              location: '...my_location...'
              negTtl: 0
              resurrectTtl: 1e+08
              tenantId: '...my_tenant_id...'
              ttl: 0
              type: secrets
              vaultUri: '...my_vault_uri...'
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          conjur:
            config:
              account: '...my_account...'
              apiKey: '...my_api_key...'
              base64Decode: false
              endpointUrl: '...my_endpoint_url...'
              login: '...my_login...'
              negTtl: 0
              resurrectTtl: 1e+08
              ttl: 0
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          env:
            config:
              base64Decode: false
              prefix: MY_SECRET_
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          gatewayId: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
          gcp:
            config:
              base64Decode: true
              negTtl: 0
              projectId: '...my_project_id...'
              resurrectTtl: 1e+08
              ttl: 0
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          hcv:
            config:
              jwt:
                audiences: '...my_audiences...'
                base64Decode: true
                clientId: '...my_client_id...'
                clientSecret: '...my_client_secret...'
                host: '...my_host...'
                kv: v1
                mount: secret
                namespace: '...my_namespace...'
                negTtl: 0
                port: 5
                protocol: https
                resurrectTtl: 1e+08
                role: demo
                sslVerify: true
                tokenEndpoint: '...my_token_endpoint...'
                ttl: 0
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
          konnect:
            config:
              configStoreId: 77426bee-2bca-4005-81af-284868fd3038
            description: This vault is used to retrieve redis database access credentials
            labels:
              key: value
            managedBy:
              key: value
            name: my-awesome-vault
    
    Example coming soon!
    

    Create AiGatewayVault Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AiGatewayVault(name: string, args: AiGatewayVaultArgs, opts?: CustomResourceOptions);
    @overload
    def AiGatewayVault(resource_name: str,
                       args: AiGatewayVaultArgs,
                       opts: Optional[ResourceOptions] = None)
    
    @overload
    def AiGatewayVault(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       gateway_id: Optional[str] = None,
                       aws: Optional[AiGatewayVaultAwsArgs] = None,
                       azure: Optional[AiGatewayVaultAzureArgs] = None,
                       conjur: Optional[AiGatewayVaultConjurArgs] = None,
                       env: Optional[AiGatewayVaultEnvArgs] = None,
                       gcp: Optional[AiGatewayVaultGcpArgs] = None,
                       hcv: Optional[AiGatewayVaultHcvArgs] = None,
                       konnect: Optional[AiGatewayVaultKonnectArgs] = None)
    func NewAiGatewayVault(ctx *Context, name string, args AiGatewayVaultArgs, opts ...ResourceOption) (*AiGatewayVault, error)
    public AiGatewayVault(string name, AiGatewayVaultArgs args, CustomResourceOptions? opts = null)
    public AiGatewayVault(String name, AiGatewayVaultArgs args)
    public AiGatewayVault(String name, AiGatewayVaultArgs args, CustomResourceOptions options)
    
    type: konnect:AiGatewayVault
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    
    resource "konnect_ai_gateway_vault" "name" {
        # resource properties
    }

    Parameters

    name string
    The unique name of the resource.
    args AiGatewayVaultArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AiGatewayVaultArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AiGatewayVaultArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AiGatewayVaultArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AiGatewayVaultArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var aiGatewayVaultResource = new Konnect.AiGatewayVault("aiGatewayVaultResource", new()
    {
        GatewayId = "string",
        Aws = new Konnect.Inputs.AiGatewayVaultAwsArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultAwsConfigArgs
            {
                AssumeRoleArn = "string",
                Base64Decode = false,
                EndpointUrl = "string",
                NegTtl = 0.0,
                Region = "string",
                ResurrectTtl = 0.0,
                RoleSessionName = "string",
                StsEndpointUrl = "string",
                Ttl = 0.0,
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Azure = new Konnect.Inputs.AiGatewayVaultAzureArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultAzureConfigArgs
            {
                Base64Decode = false,
                ClientId = "string",
                CredentialsPrefix = "string",
                Location = "string",
                NegTtl = 0.0,
                ResurrectTtl = 0.0,
                TenantId = "string",
                Ttl = 0.0,
                Type = "string",
                VaultUri = "string",
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Conjur = new Konnect.Inputs.AiGatewayVaultConjurArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultConjurConfigArgs
            {
                Account = "string",
                ApiKey = "string",
                Base64Decode = false,
                EndpointUrl = "string",
                Login = "string",
                NegTtl = 0.0,
                ResurrectTtl = 0.0,
                Ttl = 0.0,
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Env = new Konnect.Inputs.AiGatewayVaultEnvArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultEnvConfigArgs
            {
                Base64Decode = false,
                Prefix = "string",
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Gcp = new Konnect.Inputs.AiGatewayVaultGcpArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultGcpConfigArgs
            {
                Base64Decode = false,
                NegTtl = 0.0,
                ProjectId = "string",
                ResurrectTtl = 0.0,
                Ttl = 0.0,
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Hcv = new Konnect.Inputs.AiGatewayVaultHcvArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultHcvConfigArgs
            {
                Approle = new Konnect.Inputs.AiGatewayVaultHcvConfigApproleArgs
                {
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Path = "string",
                    Port = 0.0,
                    Protocol = "string",
                    ResponseWrapping = false,
                    ResurrectTtl = 0.0,
                    RoleId = "string",
                    SecretId = "string",
                    SecretIdFile = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                AwsEc2 = new Konnect.Inputs.AiGatewayVaultHcvConfigAwsEc2Args
                {
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    LoginPath = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Nonce = "string",
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                AwsIam = new Konnect.Inputs.AiGatewayVaultHcvConfigAwsIamArgs
                {
                    AccessKeyId = "string",
                    AssumeRoleArn = "string",
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    LoginPath = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    Region = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    RoleSessionName = "string",
                    SecretAccessKey = "string",
                    SslVerify = false,
                    StsEndpointUrl = "string",
                    Ttl = 0.0,
                },
                Azure = new Konnect.Inputs.AiGatewayVaultHcvConfigAzureArgs
                {
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    LoginPath = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                Cert = new Konnect.Inputs.AiGatewayVaultHcvConfigCertArgs
                {
                    Base64Decode = false,
                    Cert = "string",
                    Host = "string",
                    Key = "string",
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    RoleName = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                GcpGce = new Konnect.Inputs.AiGatewayVaultHcvConfigGcpGceArgs
                {
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    LoginPath = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                GcpIam = new Konnect.Inputs.AiGatewayVaultHcvConfigGcpIamArgs
                {
                    Base64Decode = false,
                    Host = "string",
                    JwtExp = 0.0,
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    ServiceAccount = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                Jwt = new Konnect.Inputs.AiGatewayVaultHcvConfigJwtArgs
                {
                    Audiences = "string",
                    Base64Decode = false,
                    ClientId = "string",
                    ClientSecret = "string",
                    Host = "string",
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    SslVerify = false,
                    TokenEndpoint = "string",
                    Ttl = 0.0,
                },
                Kubernetes = new Konnect.Inputs.AiGatewayVaultHcvConfigKubernetesArgs
                {
                    ApiTokenFile = "string",
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Path = "string",
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    Role = "string",
                    SslVerify = false,
                    Ttl = 0.0,
                },
                Token = new Konnect.Inputs.AiGatewayVaultHcvConfigTokenArgs
                {
                    Base64Decode = false,
                    Host = "string",
                    Kv = "string",
                    Mount = "string",
                    Namespace = "string",
                    NegTtl = 0.0,
                    Port = 0.0,
                    Protocol = "string",
                    ResurrectTtl = 0.0,
                    SslVerify = false,
                    Token = "string",
                    Ttl = 0.0,
                },
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
        Konnect = new Konnect.Inputs.AiGatewayVaultKonnectArgs
        {
            Config = new Konnect.Inputs.AiGatewayVaultKonnectConfigArgs
            {
                ConfigStoreId = "string",
            },
            CreatedAt = "string",
            Description = "string",
            Id = "string",
            Labels = 
            {
                { "string", "string" },
            },
            ManagedBy = 
            {
                { "string", "string" },
            },
            Name = "string",
            UpdatedAt = "string",
        },
    });
    
    example, err := konnect.NewAiGatewayVault(ctx, "aiGatewayVaultResource", &konnect.AiGatewayVaultArgs{
    	GatewayId: pulumi.String("string"),
    	Aws: &konnect.AiGatewayVaultAwsArgs{
    		Config: &konnect.AiGatewayVaultAwsConfigArgs{
    			AssumeRoleArn:   pulumi.String("string"),
    			Base64Decode:    pulumi.Bool(false),
    			EndpointUrl:     pulumi.String("string"),
    			NegTtl:          pulumi.Float64(0),
    			Region:          pulumi.String("string"),
    			ResurrectTtl:    pulumi.Float64(0),
    			RoleSessionName: pulumi.String("string"),
    			StsEndpointUrl:  pulumi.String("string"),
    			Ttl:             pulumi.Float64(0),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Azure: &konnect.AiGatewayVaultAzureArgs{
    		Config: &konnect.AiGatewayVaultAzureConfigArgs{
    			Base64Decode:      pulumi.Bool(false),
    			ClientId:          pulumi.String("string"),
    			CredentialsPrefix: pulumi.String("string"),
    			Location:          pulumi.String("string"),
    			NegTtl:            pulumi.Float64(0),
    			ResurrectTtl:      pulumi.Float64(0),
    			TenantId:          pulumi.String("string"),
    			Ttl:               pulumi.Float64(0),
    			Type:              pulumi.String("string"),
    			VaultUri:          pulumi.String("string"),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Conjur: &konnect.AiGatewayVaultConjurArgs{
    		Config: &konnect.AiGatewayVaultConjurConfigArgs{
    			Account:      pulumi.String("string"),
    			ApiKey:       pulumi.String("string"),
    			Base64Decode: pulumi.Bool(false),
    			EndpointUrl:  pulumi.String("string"),
    			Login:        pulumi.String("string"),
    			NegTtl:       pulumi.Float64(0),
    			ResurrectTtl: pulumi.Float64(0),
    			Ttl:          pulumi.Float64(0),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Env: &konnect.AiGatewayVaultEnvArgs{
    		Config: &konnect.AiGatewayVaultEnvConfigArgs{
    			Base64Decode: pulumi.Bool(false),
    			Prefix:       pulumi.String("string"),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Gcp: &konnect.AiGatewayVaultGcpArgs{
    		Config: &konnect.AiGatewayVaultGcpConfigArgs{
    			Base64Decode: pulumi.Bool(false),
    			NegTtl:       pulumi.Float64(0),
    			ProjectId:    pulumi.String("string"),
    			ResurrectTtl: pulumi.Float64(0),
    			Ttl:          pulumi.Float64(0),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Hcv: &konnect.AiGatewayVaultHcvArgs{
    		Config: &konnect.AiGatewayVaultHcvConfigArgs{
    			Approle: &konnect.AiGatewayVaultHcvConfigApproleArgs{
    				Base64Decode:     pulumi.Bool(false),
    				Host:             pulumi.String("string"),
    				Kv:               pulumi.String("string"),
    				Mount:            pulumi.String("string"),
    				Namespace:        pulumi.String("string"),
    				NegTtl:           pulumi.Float64(0),
    				Path:             pulumi.String("string"),
    				Port:             pulumi.Float64(0),
    				Protocol:         pulumi.String("string"),
    				ResponseWrapping: pulumi.Bool(false),
    				ResurrectTtl:     pulumi.Float64(0),
    				RoleId:           pulumi.String("string"),
    				SecretId:         pulumi.String("string"),
    				SecretIdFile:     pulumi.String("string"),
    				SslVerify:        pulumi.Bool(false),
    				Ttl:              pulumi.Float64(0),
    			},
    			AwsEc2: &konnect.AiGatewayVaultHcvConfigAwsEc2Args{
    				Base64Decode: pulumi.Bool(false),
    				Host:         pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				LoginPath:    pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Nonce:        pulumi.String("string"),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				Role:         pulumi.String("string"),
    				SslVerify:    pulumi.Bool(false),
    				Ttl:          pulumi.Float64(0),
    			},
    			AwsIam: &konnect.AiGatewayVaultHcvConfigAwsIamArgs{
    				AccessKeyId:     pulumi.String("string"),
    				AssumeRoleArn:   pulumi.String("string"),
    				Base64Decode:    pulumi.Bool(false),
    				Host:            pulumi.String("string"),
    				Kv:              pulumi.String("string"),
    				LoginPath:       pulumi.String("string"),
    				Mount:           pulumi.String("string"),
    				Namespace:       pulumi.String("string"),
    				NegTtl:          pulumi.Float64(0),
    				Port:            pulumi.Float64(0),
    				Protocol:        pulumi.String("string"),
    				Region:          pulumi.String("string"),
    				ResurrectTtl:    pulumi.Float64(0),
    				Role:            pulumi.String("string"),
    				RoleSessionName: pulumi.String("string"),
    				SecretAccessKey: pulumi.String("string"),
    				SslVerify:       pulumi.Bool(false),
    				StsEndpointUrl:  pulumi.String("string"),
    				Ttl:             pulumi.Float64(0),
    			},
    			Azure: &konnect.AiGatewayVaultHcvConfigAzureArgs{
    				Base64Decode: pulumi.Bool(false),
    				Host:         pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				LoginPath:    pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				Role:         pulumi.String("string"),
    				SslVerify:    pulumi.Bool(false),
    				Ttl:          pulumi.Float64(0),
    			},
    			Cert: &konnect.AiGatewayVaultHcvConfigCertArgs{
    				Base64Decode: pulumi.Bool(false),
    				Cert:         pulumi.String("string"),
    				Host:         pulumi.String("string"),
    				Key:          pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				RoleName:     pulumi.String("string"),
    				SslVerify:    pulumi.Bool(false),
    				Ttl:          pulumi.Float64(0),
    			},
    			GcpGce: &konnect.AiGatewayVaultHcvConfigGcpGceArgs{
    				Base64Decode: pulumi.Bool(false),
    				Host:         pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				LoginPath:    pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				Role:         pulumi.String("string"),
    				SslVerify:    pulumi.Bool(false),
    				Ttl:          pulumi.Float64(0),
    			},
    			GcpIam: &konnect.AiGatewayVaultHcvConfigGcpIamArgs{
    				Base64Decode:   pulumi.Bool(false),
    				Host:           pulumi.String("string"),
    				JwtExp:         pulumi.Float64(0),
    				Kv:             pulumi.String("string"),
    				Mount:          pulumi.String("string"),
    				Namespace:      pulumi.String("string"),
    				NegTtl:         pulumi.Float64(0),
    				Port:           pulumi.Float64(0),
    				Protocol:       pulumi.String("string"),
    				ResurrectTtl:   pulumi.Float64(0),
    				Role:           pulumi.String("string"),
    				ServiceAccount: pulumi.String("string"),
    				SslVerify:      pulumi.Bool(false),
    				Ttl:            pulumi.Float64(0),
    			},
    			Jwt: &konnect.AiGatewayVaultHcvConfigJwtArgs{
    				Audiences:     pulumi.String("string"),
    				Base64Decode:  pulumi.Bool(false),
    				ClientId:      pulumi.String("string"),
    				ClientSecret:  pulumi.String("string"),
    				Host:          pulumi.String("string"),
    				Kv:            pulumi.String("string"),
    				Mount:         pulumi.String("string"),
    				Namespace:     pulumi.String("string"),
    				NegTtl:        pulumi.Float64(0),
    				Port:          pulumi.Float64(0),
    				Protocol:      pulumi.String("string"),
    				ResurrectTtl:  pulumi.Float64(0),
    				Role:          pulumi.String("string"),
    				SslVerify:     pulumi.Bool(false),
    				TokenEndpoint: pulumi.String("string"),
    				Ttl:           pulumi.Float64(0),
    			},
    			Kubernetes: &konnect.AiGatewayVaultHcvConfigKubernetesArgs{
    				ApiTokenFile: pulumi.String("string"),
    				Base64Decode: pulumi.Bool(false),
    				Host:         pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Path:         pulumi.String("string"),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				Role:         pulumi.String("string"),
    				SslVerify:    pulumi.Bool(false),
    				Ttl:          pulumi.Float64(0),
    			},
    			Token: &konnect.AiGatewayVaultHcvConfigTokenArgs{
    				Base64Decode: pulumi.Bool(false),
    				Host:         pulumi.String("string"),
    				Kv:           pulumi.String("string"),
    				Mount:        pulumi.String("string"),
    				Namespace:    pulumi.String("string"),
    				NegTtl:       pulumi.Float64(0),
    				Port:         pulumi.Float64(0),
    				Protocol:     pulumi.String("string"),
    				ResurrectTtl: pulumi.Float64(0),
    				SslVerify:    pulumi.Bool(false),
    				Token:        pulumi.String("string"),
    				Ttl:          pulumi.Float64(0),
    			},
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    	Konnect: &konnect.AiGatewayVaultKonnectArgs{
    		Config: &konnect.AiGatewayVaultKonnectConfigArgs{
    			ConfigStoreId: pulumi.String("string"),
    		},
    		CreatedAt:   pulumi.String("string"),
    		Description: pulumi.String("string"),
    		Id:          pulumi.String("string"),
    		Labels: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		ManagedBy: pulumi.StringMap{
    			"string": pulumi.String("string"),
    		},
    		Name:      pulumi.String("string"),
    		UpdatedAt: pulumi.String("string"),
    	},
    })
    
    resource "konnect_ai_gateway_vault" "aiGatewayVaultResource" {
      lifecycle {
        create_before_destroy = true
      }
      gateway_id = "string"
      aws = {
        config = {
          assume_role_arn   = "string"
          base64_decode     = false
          endpoint_url      = "string"
          neg_ttl           = 0
          region            = "string"
          resurrect_ttl     = 0
          role_session_name = "string"
          sts_endpoint_url  = "string"
          ttl               = 0
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      azure = {
        config = {
          base64_decode      = false
          client_id          = "string"
          credentials_prefix = "string"
          location           = "string"
          neg_ttl            = 0
          resurrect_ttl      = 0
          tenant_id          = "string"
          ttl                = 0
          type               = "string"
          vault_uri          = "string"
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      conjur = {
        config = {
          account       = "string"
          api_key       = "string"
          base64_decode = false
          endpoint_url  = "string"
          login         = "string"
          neg_ttl       = 0
          resurrect_ttl = 0
          ttl           = 0
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      env = {
        config = {
          base64_decode = false
          prefix        = "string"
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      gcp = {
        config = {
          base64_decode = false
          neg_ttl       = 0
          project_id    = "string"
          resurrect_ttl = 0
          ttl           = 0
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      hcv = {
        config = {
          approle = {
            base64_decode     = false
            host              = "string"
            kv                = "string"
            mount             = "string"
            namespace         = "string"
            neg_ttl           = 0
            path              = "string"
            port              = 0
            protocol          = "string"
            response_wrapping = false
            resurrect_ttl     = 0
            role_id           = "string"
            secret_id         = "string"
            secret_id_file    = "string"
            ssl_verify        = false
            ttl               = 0
          }
          aws_ec2 = {
            base64_decode = false
            host          = "string"
            kv            = "string"
            login_path    = "string"
            mount         = "string"
            namespace     = "string"
            neg_ttl       = 0
            nonce         = "string"
            port          = 0
            protocol      = "string"
            resurrect_ttl = 0
            role          = "string"
            ssl_verify    = false
            ttl           = 0
          }
          aws_iam = {
            access_key_id     = "string"
            assume_role_arn   = "string"
            base64_decode     = false
            host              = "string"
            kv                = "string"
            login_path        = "string"
            mount             = "string"
            namespace         = "string"
            neg_ttl           = 0
            port              = 0
            protocol          = "string"
            region            = "string"
            resurrect_ttl     = 0
            role              = "string"
            role_session_name = "string"
            secret_access_key = "string"
            ssl_verify        = false
            sts_endpoint_url  = "string"
            ttl               = 0
          }
          azure = {
            base64_decode = false
            host          = "string"
            kv            = "string"
            login_path    = "string"
            mount         = "string"
            namespace     = "string"
            neg_ttl       = 0
            port          = 0
            protocol      = "string"
            resurrect_ttl = 0
            role          = "string"
            ssl_verify    = false
            ttl           = 0
          }
          cert = {
            base64_decode = false
            cert          = "string"
            host          = "string"
            key           = "string"
            kv            = "string"
            mount         = "string"
            namespace     = "string"
            neg_ttl       = 0
            port          = 0
            protocol      = "string"
            resurrect_ttl = 0
            role_name     = "string"
            ssl_verify    = false
            ttl           = 0
          }
          gcp_gce = {
            base64_decode = false
            host          = "string"
            kv            = "string"
            login_path    = "string"
            mount         = "string"
            namespace     = "string"
            neg_ttl       = 0
            port          = 0
            protocol      = "string"
            resurrect_ttl = 0
            role          = "string"
            ssl_verify    = false
            ttl           = 0
          }
          gcp_iam = {
            base64_decode   = false
            host            = "string"
            jwt_exp         = 0
            kv              = "string"
            mount           = "string"
            namespace       = "string"
            neg_ttl         = 0
            port            = 0
            protocol        = "string"
            resurrect_ttl   = 0
            role            = "string"
            service_account = "string"
            ssl_verify      = false
            ttl             = 0
          }
          jwt = {
            audiences      = "string"
            base64_decode  = false
            client_id      = "string"
            client_secret  = "string"
            host           = "string"
            kv             = "string"
            mount          = "string"
            namespace      = "string"
            neg_ttl        = 0
            port           = 0
            protocol       = "string"
            resurrect_ttl  = 0
            role           = "string"
            ssl_verify     = false
            token_endpoint = "string"
            ttl            = 0
          }
          kubernetes = {
            api_token_file = "string"
            base64_decode  = false
            host           = "string"
            kv             = "string"
            mount          = "string"
            namespace      = "string"
            neg_ttl        = 0
            path           = "string"
            port           = 0
            protocol       = "string"
            resurrect_ttl  = 0
            role           = "string"
            ssl_verify     = false
            ttl            = 0
          }
          token = {
            base64_decode = false
            host          = "string"
            kv            = "string"
            mount         = "string"
            namespace     = "string"
            neg_ttl       = 0
            port          = 0
            protocol      = "string"
            resurrect_ttl = 0
            ssl_verify    = false
            token         = "string"
            ttl           = 0
          }
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
      konnect = {
        config = {
          config_store_id = "string"
        }
        created_at  = "string"
        description = "string"
        id          = "string"
        labels = {
          "string" = "string"
        }
        managed_by = {
          "string" = "string"
        }
        name       = "string"
        updated_at = "string"
      }
    }
    
    var aiGatewayVaultResource = new AiGatewayVault("aiGatewayVaultResource", AiGatewayVaultArgs.builder()
        .gatewayId("string")
        .aws(AiGatewayVaultAwsArgs.builder()
            .config(AiGatewayVaultAwsConfigArgs.builder()
                .assumeRoleArn("string")
                .base64Decode(false)
                .endpointUrl("string")
                .negTtl(0.0)
                .region("string")
                .resurrectTtl(0.0)
                .roleSessionName("string")
                .stsEndpointUrl("string")
                .ttl(0.0)
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .azure(AiGatewayVaultAzureArgs.builder()
            .config(AiGatewayVaultAzureConfigArgs.builder()
                .base64Decode(false)
                .clientId("string")
                .credentialsPrefix("string")
                .location("string")
                .negTtl(0.0)
                .resurrectTtl(0.0)
                .tenantId("string")
                .ttl(0.0)
                .type("string")
                .vaultUri("string")
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .conjur(AiGatewayVaultConjurArgs.builder()
            .config(AiGatewayVaultConjurConfigArgs.builder()
                .account("string")
                .apiKey("string")
                .base64Decode(false)
                .endpointUrl("string")
                .login("string")
                .negTtl(0.0)
                .resurrectTtl(0.0)
                .ttl(0.0)
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .env(AiGatewayVaultEnvArgs.builder()
            .config(AiGatewayVaultEnvConfigArgs.builder()
                .base64Decode(false)
                .prefix("string")
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .gcp(AiGatewayVaultGcpArgs.builder()
            .config(AiGatewayVaultGcpConfigArgs.builder()
                .base64Decode(false)
                .negTtl(0.0)
                .projectId("string")
                .resurrectTtl(0.0)
                .ttl(0.0)
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .hcv(AiGatewayVaultHcvArgs.builder()
            .config(AiGatewayVaultHcvConfigArgs.builder()
                .approle(AiGatewayVaultHcvConfigApproleArgs.builder()
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .path("string")
                    .port(0.0)
                    .protocol("string")
                    .responseWrapping(false)
                    .resurrectTtl(0.0)
                    .roleId("string")
                    .secretId("string")
                    .secretIdFile("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .awsEc2(AiGatewayVaultHcvConfigAwsEc2Args.builder()
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .loginPath("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .nonce("string")
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .awsIam(AiGatewayVaultHcvConfigAwsIamArgs.builder()
                    .accessKeyId("string")
                    .assumeRoleArn("string")
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .loginPath("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .region("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .roleSessionName("string")
                    .secretAccessKey("string")
                    .sslVerify(false)
                    .stsEndpointUrl("string")
                    .ttl(0.0)
                    .build())
                .azure(AiGatewayVaultHcvConfigAzureArgs.builder()
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .loginPath("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .cert(AiGatewayVaultHcvConfigCertArgs.builder()
                    .base64Decode(false)
                    .cert("string")
                    .host("string")
                    .key("string")
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .roleName("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .gcpGce(AiGatewayVaultHcvConfigGcpGceArgs.builder()
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .loginPath("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .gcpIam(AiGatewayVaultHcvConfigGcpIamArgs.builder()
                    .base64Decode(false)
                    .host("string")
                    .jwtExp(0.0)
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .serviceAccount("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .jwt(AiGatewayVaultHcvConfigJwtArgs.builder()
                    .audiences("string")
                    .base64Decode(false)
                    .clientId("string")
                    .clientSecret("string")
                    .host("string")
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .sslVerify(false)
                    .tokenEndpoint("string")
                    .ttl(0.0)
                    .build())
                .kubernetes(AiGatewayVaultHcvConfigKubernetesArgs.builder()
                    .apiTokenFile("string")
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .path("string")
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .role("string")
                    .sslVerify(false)
                    .ttl(0.0)
                    .build())
                .token(AiGatewayVaultHcvConfigTokenArgs.builder()
                    .base64Decode(false)
                    .host("string")
                    .kv("string")
                    .mount("string")
                    .namespace("string")
                    .negTtl(0.0)
                    .port(0.0)
                    .protocol("string")
                    .resurrectTtl(0.0)
                    .sslVerify(false)
                    .token("string")
                    .ttl(0.0)
                    .build())
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .konnect(AiGatewayVaultKonnectArgs.builder()
            .config(AiGatewayVaultKonnectConfigArgs.builder()
                .configStoreId("string")
                .build())
            .createdAt("string")
            .description("string")
            .id("string")
            .labels(Map.of("string", "string"))
            .managedBy(Map.of("string", "string"))
            .name("string")
            .updatedAt("string")
            .build())
        .build());
    
    ai_gateway_vault_resource = konnect.AiGatewayVault("aiGatewayVaultResource",
        gateway_id="string",
        aws={
            "config": {
                "assume_role_arn": "string",
                "base64_decode": False,
                "endpoint_url": "string",
                "neg_ttl": float(0),
                "region": "string",
                "resurrect_ttl": float(0),
                "role_session_name": "string",
                "sts_endpoint_url": "string",
                "ttl": float(0),
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        azure={
            "config": {
                "base64_decode": False,
                "client_id": "string",
                "credentials_prefix": "string",
                "location": "string",
                "neg_ttl": float(0),
                "resurrect_ttl": float(0),
                "tenant_id": "string",
                "ttl": float(0),
                "type": "string",
                "vault_uri": "string",
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        conjur={
            "config": {
                "account": "string",
                "api_key": "string",
                "base64_decode": False,
                "endpoint_url": "string",
                "login": "string",
                "neg_ttl": float(0),
                "resurrect_ttl": float(0),
                "ttl": float(0),
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        env={
            "config": {
                "base64_decode": False,
                "prefix": "string",
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        gcp={
            "config": {
                "base64_decode": False,
                "neg_ttl": float(0),
                "project_id": "string",
                "resurrect_ttl": float(0),
                "ttl": float(0),
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        hcv={
            "config": {
                "approle": {
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "path": "string",
                    "port": float(0),
                    "protocol": "string",
                    "response_wrapping": False,
                    "resurrect_ttl": float(0),
                    "role_id": "string",
                    "secret_id": "string",
                    "secret_id_file": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "aws_ec2": {
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "login_path": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "nonce": "string",
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "aws_iam": {
                    "access_key_id": "string",
                    "assume_role_arn": "string",
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "login_path": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "region": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "role_session_name": "string",
                    "secret_access_key": "string",
                    "ssl_verify": False,
                    "sts_endpoint_url": "string",
                    "ttl": float(0),
                },
                "azure": {
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "login_path": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "cert": {
                    "base64_decode": False,
                    "cert": "string",
                    "host": "string",
                    "key": "string",
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role_name": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "gcp_gce": {
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "login_path": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "gcp_iam": {
                    "base64_decode": False,
                    "host": "string",
                    "jwt_exp": float(0),
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "service_account": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "jwt": {
                    "audiences": "string",
                    "base64_decode": False,
                    "client_id": "string",
                    "client_secret": "string",
                    "host": "string",
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "ssl_verify": False,
                    "token_endpoint": "string",
                    "ttl": float(0),
                },
                "kubernetes": {
                    "api_token_file": "string",
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "path": "string",
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "role": "string",
                    "ssl_verify": False,
                    "ttl": float(0),
                },
                "token": {
                    "base64_decode": False,
                    "host": "string",
                    "kv": "string",
                    "mount": "string",
                    "namespace": "string",
                    "neg_ttl": float(0),
                    "port": float(0),
                    "protocol": "string",
                    "resurrect_ttl": float(0),
                    "ssl_verify": False,
                    "token": "string",
                    "ttl": float(0),
                },
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        },
        konnect={
            "config": {
                "config_store_id": "string",
            },
            "created_at": "string",
            "description": "string",
            "id": "string",
            "labels": {
                "string": "string",
            },
            "managed_by": {
                "string": "string",
            },
            "name": "string",
            "updated_at": "string",
        })
    
    const aiGatewayVaultResource = new konnect.AiGatewayVault("aiGatewayVaultResource", {
        gatewayId: "string",
        aws: {
            config: {
                assumeRoleArn: "string",
                base64Decode: false,
                endpointUrl: "string",
                negTtl: 0,
                region: "string",
                resurrectTtl: 0,
                roleSessionName: "string",
                stsEndpointUrl: "string",
                ttl: 0,
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        azure: {
            config: {
                base64Decode: false,
                clientId: "string",
                credentialsPrefix: "string",
                location: "string",
                negTtl: 0,
                resurrectTtl: 0,
                tenantId: "string",
                ttl: 0,
                type: "string",
                vaultUri: "string",
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        conjur: {
            config: {
                account: "string",
                apiKey: "string",
                base64Decode: false,
                endpointUrl: "string",
                login: "string",
                negTtl: 0,
                resurrectTtl: 0,
                ttl: 0,
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        env: {
            config: {
                base64Decode: false,
                prefix: "string",
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        gcp: {
            config: {
                base64Decode: false,
                negTtl: 0,
                projectId: "string",
                resurrectTtl: 0,
                ttl: 0,
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        hcv: {
            config: {
                approle: {
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    path: "string",
                    port: 0,
                    protocol: "string",
                    responseWrapping: false,
                    resurrectTtl: 0,
                    roleId: "string",
                    secretId: "string",
                    secretIdFile: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                awsEc2: {
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    loginPath: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    nonce: "string",
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                awsIam: {
                    accessKeyId: "string",
                    assumeRoleArn: "string",
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    loginPath: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    region: "string",
                    resurrectTtl: 0,
                    role: "string",
                    roleSessionName: "string",
                    secretAccessKey: "string",
                    sslVerify: false,
                    stsEndpointUrl: "string",
                    ttl: 0,
                },
                azure: {
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    loginPath: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                cert: {
                    base64Decode: false,
                    cert: "string",
                    host: "string",
                    key: "string",
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    roleName: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                gcpGce: {
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    loginPath: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                gcpIam: {
                    base64Decode: false,
                    host: "string",
                    jwtExp: 0,
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    serviceAccount: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                jwt: {
                    audiences: "string",
                    base64Decode: false,
                    clientId: "string",
                    clientSecret: "string",
                    host: "string",
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    sslVerify: false,
                    tokenEndpoint: "string",
                    ttl: 0,
                },
                kubernetes: {
                    apiTokenFile: "string",
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    path: "string",
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    role: "string",
                    sslVerify: false,
                    ttl: 0,
                },
                token: {
                    base64Decode: false,
                    host: "string",
                    kv: "string",
                    mount: "string",
                    namespace: "string",
                    negTtl: 0,
                    port: 0,
                    protocol: "string",
                    resurrectTtl: 0,
                    sslVerify: false,
                    token: "string",
                    ttl: 0,
                },
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
        konnect: {
            config: {
                configStoreId: "string",
            },
            createdAt: "string",
            description: "string",
            id: "string",
            labels: {
                string: "string",
            },
            managedBy: {
                string: "string",
            },
            name: "string",
            updatedAt: "string",
        },
    });
    
    type: konnect:AiGatewayVault
    properties:
        aws:
            config:
                assumeRoleArn: string
                base64Decode: false
                endpointUrl: string
                negTtl: 0
                region: string
                resurrectTtl: 0
                roleSessionName: string
                stsEndpointUrl: string
                ttl: 0
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        azure:
            config:
                base64Decode: false
                clientId: string
                credentialsPrefix: string
                location: string
                negTtl: 0
                resurrectTtl: 0
                tenantId: string
                ttl: 0
                type: string
                vaultUri: string
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        conjur:
            config:
                account: string
                apiKey: string
                base64Decode: false
                endpointUrl: string
                login: string
                negTtl: 0
                resurrectTtl: 0
                ttl: 0
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        env:
            config:
                base64Decode: false
                prefix: string
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        gatewayId: string
        gcp:
            config:
                base64Decode: false
                negTtl: 0
                projectId: string
                resurrectTtl: 0
                ttl: 0
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        hcv:
            config:
                approle:
                    base64Decode: false
                    host: string
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    path: string
                    port: 0
                    protocol: string
                    responseWrapping: false
                    resurrectTtl: 0
                    roleId: string
                    secretId: string
                    secretIdFile: string
                    sslVerify: false
                    ttl: 0
                awsEc2:
                    base64Decode: false
                    host: string
                    kv: string
                    loginPath: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    nonce: string
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    sslVerify: false
                    ttl: 0
                awsIam:
                    accessKeyId: string
                    assumeRoleArn: string
                    base64Decode: false
                    host: string
                    kv: string
                    loginPath: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    region: string
                    resurrectTtl: 0
                    role: string
                    roleSessionName: string
                    secretAccessKey: string
                    sslVerify: false
                    stsEndpointUrl: string
                    ttl: 0
                azure:
                    base64Decode: false
                    host: string
                    kv: string
                    loginPath: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    sslVerify: false
                    ttl: 0
                cert:
                    base64Decode: false
                    cert: string
                    host: string
                    key: string
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    roleName: string
                    sslVerify: false
                    ttl: 0
                gcpGce:
                    base64Decode: false
                    host: string
                    kv: string
                    loginPath: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    sslVerify: false
                    ttl: 0
                gcpIam:
                    base64Decode: false
                    host: string
                    jwtExp: 0
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    serviceAccount: string
                    sslVerify: false
                    ttl: 0
                jwt:
                    audiences: string
                    base64Decode: false
                    clientId: string
                    clientSecret: string
                    host: string
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    sslVerify: false
                    tokenEndpoint: string
                    ttl: 0
                kubernetes:
                    apiTokenFile: string
                    base64Decode: false
                    host: string
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    path: string
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    role: string
                    sslVerify: false
                    ttl: 0
                token:
                    base64Decode: false
                    host: string
                    kv: string
                    mount: string
                    namespace: string
                    negTtl: 0
                    port: 0
                    protocol: string
                    resurrectTtl: 0
                    sslVerify: false
                    token: string
                    ttl: 0
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
        konnect:
            config:
                configStoreId: string
            createdAt: string
            description: string
            id: string
            labels:
                string: string
            managedBy:
                string: string
            name: string
            updatedAt: string
    

    AiGatewayVault Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AiGatewayVault resource accepts the following input properties:

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AiGatewayVault resource produces the following output properties:

    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault.
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    Look up Existing AiGatewayVault Resource

    Get an existing AiGatewayVault resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AiGatewayVaultState, opts?: CustomResourceOptions): AiGatewayVault
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            aws: Optional[AiGatewayVaultAwsArgs] = None,
            azure: Optional[AiGatewayVaultAzureArgs] = None,
            conjur: Optional[AiGatewayVaultConjurArgs] = None,
            created_at: Optional[str] = None,
            description: Optional[str] = None,
            env: Optional[AiGatewayVaultEnvArgs] = None,
            gateway_id: Optional[str] = None,
            gcp: Optional[AiGatewayVaultGcpArgs] = None,
            hcv: Optional[AiGatewayVaultHcvArgs] = None,
            konnect: Optional[AiGatewayVaultKonnectArgs] = None,
            name: Optional[str] = None,
            updated_at: Optional[str] = None) -> AiGatewayVault
    func GetAiGatewayVault(ctx *Context, name string, id IDInput, state *AiGatewayVaultState, opts ...ResourceOption) (*AiGatewayVault, error)
    public static AiGatewayVault Get(string name, Input<string> id, AiGatewayVaultState? state, CustomResourceOptions? opts = null)
    public static AiGatewayVault get(String name, Output<String> id, AiGatewayVaultState state, CustomResourceOptions options)
    resources:  _:    type: konnect:AiGatewayVault    get:      id: ${id}
    import {
      to = konnect_ai_gateway_vault.example
      id = "${id}"
    }
    
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Aws AiGatewayVaultAws
    Azure AiGatewayVaultAzure
    Conjur AiGatewayVaultConjur
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault.
    Env AiGatewayVaultEnv
    GatewayId string
    The unique ID of the AI Gateway.
    Gcp AiGatewayVaultGcp
    Hcv AiGatewayVaultHcv
    Konnect AiGatewayVaultKonnect
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Aws AiGatewayVaultAwsArgs
    Azure AiGatewayVaultAzureArgs
    Conjur AiGatewayVaultConjurArgs
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault.
    Env AiGatewayVaultEnvArgs
    GatewayId string
    The unique ID of the AI Gateway.
    Gcp AiGatewayVaultGcpArgs
    Hcv AiGatewayVaultHcvArgs
    Konnect AiGatewayVaultKonnectArgs
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    aws object
    azure object
    conjur object
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault.
    env object
    gateway_id string
    The unique ID of the AI Gateway.
    gcp object
    hcv object
    konnect object
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    aws AiGatewayVaultAws
    azure AiGatewayVaultAzure
    conjur AiGatewayVaultConjur
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault.
    env AiGatewayVaultEnv
    gatewayId String
    The unique ID of the AI Gateway.
    gcp AiGatewayVaultGcp
    hcv AiGatewayVaultHcv
    konnect AiGatewayVaultKonnect
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    aws AiGatewayVaultAws
    azure AiGatewayVaultAzure
    conjur AiGatewayVaultConjur
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault.
    env AiGatewayVaultEnv
    gatewayId string
    The unique ID of the AI Gateway.
    gcp AiGatewayVaultGcp
    hcv AiGatewayVaultHcv
    konnect AiGatewayVaultKonnect
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    aws AiGatewayVaultAwsArgs
    azure AiGatewayVaultAzureArgs
    conjur AiGatewayVaultConjurArgs
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault.
    env AiGatewayVaultEnvArgs
    gateway_id str
    The unique ID of the AI Gateway.
    gcp AiGatewayVaultGcpArgs
    hcv AiGatewayVaultHcvArgs
    konnect AiGatewayVaultKonnectArgs
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    aws Property Map
    azure Property Map
    conjur Property Map
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault.
    env Property Map
    gatewayId String
    The unique ID of the AI Gateway.
    gcp Property Map
    hcv Property Map
    konnect Property Map
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    Supporting Types

    AiGatewayVaultAws, AiGatewayVaultAwsArgs

    Config AiGatewayVaultAwsConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultAwsConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAwsConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAwsConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAwsConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultAwsConfig, AiGatewayVaultAwsConfigArgs

    AssumeRoleArn string
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    EndpointUrl string
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Region string
    The AWS region where your vault is located.
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleSessionName string
    The session name used when assuming a role. Default: "KongVault"
    StsEndpointUrl string
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    AssumeRoleArn string
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    EndpointUrl string
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Region string
    The AWS region where your vault is located.
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleSessionName string
    The session name used when assuming a role. Default: "KongVault"
    StsEndpointUrl string
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    assume_role_arn string
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpoint_url string
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    region string
    The AWS region where your vault is located.
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_session_name string
    The session name used when assuming a role. Default: "KongVault"
    sts_endpoint_url string
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    assumeRoleArn String
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl String
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    region String
    The AWS region where your vault is located.
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleSessionName String
    The session name used when assuming a role. Default: "KongVault"
    stsEndpointUrl String
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    assumeRoleArn string
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl string
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    region string
    The AWS region where your vault is located.
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleSessionName string
    The session name used when assuming a role. Default: "KongVault"
    stsEndpointUrl string
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    assume_role_arn str
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpoint_url str
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    region str
    The AWS region where your vault is located.
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_session_name str
    The session name used when assuming a role. Default: "KongVault"
    sts_endpoint_url str
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    assumeRoleArn String
    The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl String
    The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    region String
    The AWS region where your vault is located.
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleSessionName String
    The session name used when assuming a role. Default: "KongVault"
    stsEndpointUrl String
    A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultAzure, AiGatewayVaultAzureArgs

    Config AiGatewayVaultAzureConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultAzureConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAzureConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAzureConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultAzureConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultAzureConfig, AiGatewayVaultAzureConfigArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    ClientId string
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    CredentialsPrefix string
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    Location string
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    TenantId string
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Type string
    Default: "secrets"; must be "secrets"
    VaultUri string
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    ClientId string
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    CredentialsPrefix string
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    Location string
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    TenantId string
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Type string
    Default: "secrets"; must be "secrets"
    VaultUri string
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    client_id string
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    credentials_prefix string
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    location string
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    tenant_id string
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    type string
    Default: "secrets"; must be "secrets"
    vault_uri string
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId String
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    credentialsPrefix String
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    location String
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    tenantId String
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    type String
    Default: "secrets"; must be "secrets"
    vaultUri String
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId string
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    credentialsPrefix string
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    location string
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    tenantId string
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    type string
    Default: "secrets"; must be "secrets"
    vaultUri string
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    client_id str
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    credentials_prefix str
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    location str
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    tenant_id str
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    type str
    Default: "secrets"; must be "secrets"
    vault_uri str
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId String
    The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
    credentialsPrefix String
    The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
    location String
    Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    tenantId String
    The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    type String
    Default: "secrets"; must be "secrets"
    vaultUri String
    The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null

    AiGatewayVaultConjur, AiGatewayVaultConjurArgs

    Config AiGatewayVaultConjurConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultConjurConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultConjurConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultConjurConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultConjurConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultConjurConfig, AiGatewayVaultConjurConfigArgs

    Account string
    The CyberArk Secrets Manager organization account name. Not Null
    ApiKey string
    The API key of the workload identity.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    EndpointUrl string
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    Login string
    The login name of the workload identity. Not Null
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Account string
    The CyberArk Secrets Manager organization account name. Not Null
    ApiKey string
    The API key of the workload identity.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    EndpointUrl string
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    Login string
    The login name of the workload identity. Not Null
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    account string
    The CyberArk Secrets Manager organization account name. Not Null
    api_key string
    The API key of the workload identity.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpoint_url string
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    login string
    The login name of the workload identity. Not Null
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    account String
    The CyberArk Secrets Manager organization account name. Not Null
    apiKey String
    The API key of the workload identity.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl String
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    login String
    The login name of the workload identity. Not Null
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    account string
    The CyberArk Secrets Manager organization account name. Not Null
    apiKey string
    The API key of the workload identity.
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl string
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    login string
    The login name of the workload identity. Not Null
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    account str
    The CyberArk Secrets Manager organization account name. Not Null
    api_key str
    The API key of the workload identity.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpoint_url str
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    login str
    The login name of the workload identity. Not Null
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    account String
    The CyberArk Secrets Manager organization account name. Not Null
    apiKey String
    The API key of the workload identity.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    endpointUrl String
    The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
    login String
    The login name of the workload identity. Not Null
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultEnv, AiGatewayVaultEnvArgs

    Config AiGatewayVaultEnvConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultEnvConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultEnvConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultEnvConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultEnvConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultEnvConfig, AiGatewayVaultEnvConfigArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Prefix string
    The prefix for the environment variable that the value will be stored in.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Prefix string
    The prefix for the environment variable that the value will be stored in.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    prefix string
    The prefix for the environment variable that the value will be stored in.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    prefix String
    The prefix for the environment variable that the value will be stored in.
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    prefix string
    The prefix for the environment variable that the value will be stored in.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    prefix str
    The prefix for the environment variable that the value will be stored in.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    prefix String
    The prefix for the environment variable that the value will be stored in.

    AiGatewayVaultGcp, AiGatewayVaultGcpArgs

    Config AiGatewayVaultGcpConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultGcpConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultGcpConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultGcpConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultGcpConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultGcpConfig, AiGatewayVaultGcpConfigArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ProjectId string
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    ProjectId string
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    project_id string
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    projectId String
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    projectId string
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    project_id str
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    projectId String
    The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcv, AiGatewayVaultHcvArgs

    Config AiGatewayVaultHcvConfig
    Configuration for an AI Gateway Vault. Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultHcvConfig
    Configuration for an AI Gateway Vault. Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Configuration for an AI Gateway Vault. Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultHcvConfig
    Configuration for an AI Gateway Vault. Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultHcvConfig
    Configuration for an AI Gateway Vault. Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultHcvConfig
    Configuration for an AI Gateway Vault. Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Configuration for an AI Gateway Vault. Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultHcvConfig, AiGatewayVaultHcvConfigArgs

    AiGatewayVaultHcvConfigApprole, AiGatewayVaultHcvConfigApproleArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Path string
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResponseWrapping bool
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleId string
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    SecretId string
    Defines the AppRole’s secret ID in HashiCorp Vault.
    SecretIdFile string
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Path string
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResponseWrapping bool
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleId string
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    SecretId string
    Defines the AppRole’s secret ID in HashiCorp Vault.
    SecretIdFile string
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path string
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    response_wrapping bool
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_id string
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    secret_id string
    Defines the AppRole’s secret ID in HashiCorp Vault.
    secret_id_file string
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path String
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    responseWrapping Boolean
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleId String
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    secretId String
    Defines the AppRole’s secret ID in HashiCorp Vault.
    secretIdFile String
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path string
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    responseWrapping boolean
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleId string
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    secretId string
    Defines the AppRole’s secret ID in HashiCorp Vault.
    secretIdFile string
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path str
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    response_wrapping bool
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_id str
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    secret_id str
    Defines the AppRole’s secret ID in HashiCorp Vault.
    secret_id_file str
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path String
    Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    responseWrapping Boolean
    Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleId String
    Specifies the AppRole role ID in HashiCorp Vault. Either role_id or secret_id_file must be set.
    secretId String
    Defines the AppRole’s secret ID in HashiCorp Vault.
    secretIdFile String
    Path to a file containing the AppRole secret ID. Either role_id or secret_id_file must be set.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigAwsEc2, AiGatewayVaultHcvConfigAwsEc2Args

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Nonce string
    The nonce for AWS EC2 auth. Not Null
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for AWS EC2 auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Nonce string
    The nonce for AWS EC2 auth. Not Null
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for AWS EC2 auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    nonce string
    The nonce for AWS EC2 auth. Not Null
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for AWS EC2 auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    nonce String
    The nonce for AWS EC2 auth. Not Null
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for AWS EC2 auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    nonce string
    The nonce for AWS EC2 auth. Not Null
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for AWS EC2 auth. Not Null
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path str
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    nonce str
    The nonce for AWS EC2 auth. Not Null
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The role to use for AWS EC2 auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    nonce String
    The nonce for AWS EC2 auth. Not Null
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for AWS EC2 auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigAwsIam, AiGatewayVaultHcvConfigAwsIamArgs

    AccessKeyId string
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    AssumeRoleArn string
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    Region string
    The AWS region for auth. Not Null
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for AWS IAM auth. Not Null
    RoleSessionName string
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    SecretAccessKey string
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    StsEndpointUrl string
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    AccessKeyId string
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    AssumeRoleArn string
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    Region string
    The AWS region for auth. Not Null
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for AWS IAM auth. Not Null
    RoleSessionName string
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    SecretAccessKey string
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    StsEndpointUrl string
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    access_key_id string
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    assume_role_arn string
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    region string
    The AWS region for auth. Not Null
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for AWS IAM auth. Not Null
    role_session_name string
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    secret_access_key string
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    sts_endpoint_url string
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    accessKeyId String
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    assumeRoleArn String
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    region String
    The AWS region for auth. Not Null
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for AWS IAM auth. Not Null
    roleSessionName String
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    secretAccessKey String
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    stsEndpointUrl String
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    accessKeyId string
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    assumeRoleArn string
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath string
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    region string
    The AWS region for auth. Not Null
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for AWS IAM auth. Not Null
    roleSessionName string
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    secretAccessKey string
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    stsEndpointUrl string
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    access_key_id str
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    assume_role_arn str
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path str
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    region str
    The AWS region for auth. Not Null
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The role to use for AWS IAM auth. Not Null
    role_session_name str
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    secret_access_key str
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    sts_endpoint_url str
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    accessKeyId String
    The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used. If set, secret_access_key must also be set.
    assumeRoleArn String
    The ARN of the role to assume for AWS IAM authentication. If set, role_session_name must also be set.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    region String
    The AWS region for auth. Not Null
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for AWS IAM auth. Not Null
    roleSessionName String
    The session name to use when assuming a role for AWS IAM authentication. If set, assume_role_arn must also be set.
    secretAccessKey String
    The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used. If set, access_key_id must also be set.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    stsEndpointUrl String
    The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigAzure, AiGatewayVaultHcvConfigAzureArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for Azure auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for Azure auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path string
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for Azure auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for Azure auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath string
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for Azure auth. Not Null
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path str
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The role to use for Azure auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for Azure auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigCert, AiGatewayVaultHcvConfigCertArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Cert string
    The client certificate. Not Null
    Host string
    The hostname of your HashiCorp vault. Not Null
    Key string
    The key for the client certificate.
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleName string
    The trusted certificate role name.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Cert string
    The client certificate. Not Null
    Host string
    The hostname of your HashiCorp vault. Not Null
    Key string
    The key for the client certificate.
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    RoleName string
    The trusted certificate role name.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    cert string
    The client certificate. Not Null
    host string
    The hostname of your HashiCorp vault. Not Null
    key string
    The key for the client certificate.
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_name string
    The trusted certificate role name.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    cert String
    The client certificate. Not Null
    host String
    The hostname of your HashiCorp vault. Not Null
    key String
    The key for the client certificate.
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleName String
    The trusted certificate role name.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    cert string
    The client certificate. Not Null
    host string
    The hostname of your HashiCorp vault. Not Null
    key string
    The key for the client certificate.
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleName string
    The trusted certificate role name.
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    cert str
    The client certificate. Not Null
    host str
    The hostname of your HashiCorp vault. Not Null
    key str
    The key for the client certificate.
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role_name str
    The trusted certificate role name.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    cert String
    The client certificate. Not Null
    host String
    The hostname of your HashiCorp vault. Not Null
    key String
    The key for the client certificate.
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    roleName String
    The trusted certificate role name.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigGcpGce, AiGatewayVaultHcvConfigGcpGceArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for GCP GCE auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    LoginPath string
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for GCP GCE auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path string
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for GCP GCE auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for GCP GCE auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath string
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for GCP GCE auth. Not Null
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    login_path str
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The role to use for GCP GCE auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    loginPath String
    The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for GCP GCE auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigGcpIam, AiGatewayVaultHcvConfigGcpIamArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    JwtExp double
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for GCP IAM auth. Not Null
    ServiceAccount string
    The GCP service account for GCE auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    JwtExp float64
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The role to use for GCP IAM auth. Not Null
    ServiceAccount string
    The GCP service account for GCE auth. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    jwt_exp number
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for GCP IAM auth. Not Null
    service_account string
    The GCP service account for GCE auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    jwtExp Double
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for GCP IAM auth. Not Null
    serviceAccount String
    The GCP service account for GCE auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    jwtExp number
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The role to use for GCP IAM auth. Not Null
    serviceAccount string
    The GCP service account for GCE auth. Not Null
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    jwt_exp float
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The role to use for GCP IAM auth. Not Null
    service_account str
    The GCP service account for GCE auth. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    jwtExp Number
    The JWT expiration time in seconds for GCP auth (0-900). Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The role to use for GCP IAM auth. Not Null
    serviceAccount String
    The GCP service account for GCE auth. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigJwt, AiGatewayVaultHcvConfigJwtArgs

    Audiences string
    Comma-separated list of OAuth2 audiences.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    ClientId string
    The OAuth2 client ID. Not Null
    ClientSecret string
    The OAuth2 client secret.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    TokenEndpoint string
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Audiences string
    Comma-separated list of OAuth2 audiences.
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    ClientId string
    The OAuth2 client ID. Not Null
    ClientSecret string
    The OAuth2 client secret.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    TokenEndpoint string
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    audiences string
    Comma-separated list of OAuth2 audiences.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    client_id string
    The OAuth2 client ID. Not Null
    client_secret string
    The OAuth2 client secret.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token_endpoint string
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    audiences String
    Comma-separated list of OAuth2 audiences.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId String
    The OAuth2 client ID. Not Null
    clientSecret String
    The OAuth2 client secret.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    tokenEndpoint String
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    audiences string
    Comma-separated list of OAuth2 audiences.
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId string
    The OAuth2 client ID. Not Null
    clientSecret string
    The OAuth2 client secret.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    tokenEndpoint string
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    audiences str
    Comma-separated list of OAuth2 audiences.
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    client_id str
    The OAuth2 client ID. Not Null
    client_secret str
    The OAuth2 client secret.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token_endpoint str
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    audiences String
    Comma-separated list of OAuth2 audiences.
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    clientId String
    The OAuth2 client ID. Not Null
    clientSecret String
    The OAuth2 client secret.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    The configured role name in HashiCorp Vault for JWT auth. When creating the role in HashiCorp Vault, make sure that the role_type is jwt and the token_policies have permissions to read the secrets. Not Null
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    tokenEndpoint String
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigKubernetes, AiGatewayVaultHcvConfigKubernetesArgs

    ApiTokenFile string
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Path string
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    Role assigned to the Kubernetes service account.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    ApiTokenFile string
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Path string
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    Role string
    Role assigned to the Kubernetes service account.
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    api_token_file string
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path string
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    Role assigned to the Kubernetes service account.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    apiTokenFile String
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path String
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    Role assigned to the Kubernetes service account.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    apiTokenFile string
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path string
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role string
    Role assigned to the Kubernetes service account.
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    api_token_file str
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path str
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role str
    Role assigned to the Kubernetes service account.
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    apiTokenFile String
    Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    path String
    Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    role String
    Role assigned to the Kubernetes service account.
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultHcvConfigToken, AiGatewayVaultHcvConfigTokenArgs

    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port double
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Token string
    The token string to be used for authentication.
    Ttl double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    Base64Decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    Host string
    The hostname of your HashiCorp vault. Not Null
    Kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    Mount string
    The mount point. Default: "secret"
    Namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    NegTtl float64
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    Port float64
    The port number of your HashiCorp vault. Not Null
    Protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    ResurrectTtl float64
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    SslVerify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    Token string
    The token string to be used for authentication.
    Ttl float64
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token string
    The token string to be used for authentication.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Double
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Double
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Double
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token String
    The token string to be used for authentication.
    ttl Double
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host string
    The hostname of your HashiCorp vault. Not Null
    kv string
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount string
    The mount point. Default: "secret"
    namespace string
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port number
    The port number of your HashiCorp vault. Not Null
    protocol string
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    sslVerify boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token string
    The token string to be used for authentication.
    ttl number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64_decode bool
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host str
    The hostname of your HashiCorp vault. Not Null
    kv str
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount str
    The mount point. Default: "secret"
    namespace str
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    neg_ttl float
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port float
    The port number of your HashiCorp vault. Not Null
    protocol str
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrect_ttl float
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    ssl_verify bool
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token str
    The token string to be used for authentication.
    ttl float
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
    base64Decode Boolean
    Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
    host String
    The hostname of your HashiCorp vault. Not Null
    kv String
    The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
    mount String
    The mount point. Default: "secret"
    namespace String
    Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
    negTtl Number
    Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
    port Number
    The port number of your HashiCorp vault. Not Null
    protocol String
    The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
    resurrectTtl Number
    Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
    sslVerify Boolean
    Whether to verify the TLS certificate of the vault when connecting. Default: true
    token String
    The token string to be used for authentication.
    ttl Number
    Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0

    AiGatewayVaultKonnect, AiGatewayVaultKonnectArgs

    Config AiGatewayVaultKonnectConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels Dictionary<string, string>
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy Dictionary<string, string>
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    Config AiGatewayVaultKonnectConfig
    Not Null
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Description string
    The description of the Vault. Default: ""
    Id string
    Contains a unique identifier used for this resource.
    Labels map[string]string
    Public labels store information about an entity that can be used for filtering a list of objects.
    ManagedBy map[string]string
    Name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config object
    Not Null
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels map(string)
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by map(string)
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultKonnectConfig
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String,String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String,String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultKonnectConfig
    Not Null
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    description string
    The description of the Vault. Default: ""
    id string
    Contains a unique identifier used for this resource.
    labels {[key: string]: string}
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy {[key: string]: string}
    name string
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    config AiGatewayVaultKonnectConfig
    Not Null
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    description str
    The description of the Vault. Default: ""
    id str
    Contains a unique identifier used for this resource.
    labels Mapping[str, str]
    Public labels store information about an entity that can be used for filtering a list of objects.
    managed_by Mapping[str, str]
    name str
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    config Property Map
    Not Null
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    description String
    The description of the Vault. Default: ""
    id String
    Contains a unique identifier used for this resource.
    labels Map<String>
    Public labels store information about an entity that can be used for filtering a list of objects.
    managedBy Map<String>
    name String
    A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    AiGatewayVaultKonnectConfig, AiGatewayVaultKonnectConfigArgs

    ConfigStoreId string
    The ID of the Konnect Config Store that contains the secrets. Not Null
    ConfigStoreId string
    The ID of the Konnect Config Store that contains the secrets. Not Null
    config_store_id string
    The ID of the Konnect Config Store that contains the secrets. Not Null
    configStoreId String
    The ID of the Konnect Config Store that contains the secrets. Not Null
    configStoreId string
    The ID of the Konnect Config Store that contains the secrets. Not Null
    config_store_id str
    The ID of the Konnect Config Store that contains the secrets. Not Null
    configStoreId String
    The ID of the Konnect Config Store that contains the secrets. Not Null

    Import

    In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

    terraform

    import {

    to = konnect_ai_gateway_vault.my_konnect_ai_gateway_vault

    id = jsonencode({

    gateway_id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
    
    id         = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
    

    })

    }

    The pulumi import command can be used, for example:

    $ pulumi import konnect:index/aiGatewayVault:AiGatewayVault my_konnect_ai_gateway_vault '{"gateway_id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7", "id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"}'
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    konnect kong/terraform-provider-konnect
    License
    Notes
    This Pulumi package is based on the konnect Terraform Provider.
    Viewing docs for konnect 3.23.0
    published on Friday, Sep 18, 2026 by kong

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial