OVHCloud v2.9.0, Nov 7 25

OVHCloud v2.9.0 published on Friday, Nov 7, 2025 by OVHcloud

Schema (JSON)

ovh/pulumi-ovh

OVHCloud v2.9.0 published on Friday, Nov 7, 2025 by OVHcloud

Schema (JSON)

ovh/pulumi-ovh

subcategory : “Key Management Service (KMS)”

ovh.Okms.Secret (Resource)

Manages a secret stored in OVHcloud KMS.

WARNING: version.data is marked Sensitive but still ends up in the state file. To mitigate that, it is recommended to protect your state with encryption and access controls. Avoid committing it to source control.

Create Secret Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Secret(name: string, args: SecretArgs, opts?: CustomResourceOptions);

@overload
def Secret(resource_name: str,
           args: SecretArgs,
           opts: Optional[ResourceOptions] = None)

@overload
def Secret(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           okms_id: Optional[str] = None,
           path: Optional[str] = None,
           version: Optional[SecretVersionArgs] = None,
           cas: Optional[float] = None,
           include_data: Optional[bool] = None,
           metadata: Optional[SecretMetadataArgs] = None)

func NewSecret(ctx *Context, name string, args SecretArgs, opts ...ResourceOption) (*Secret, error)

public Secret(string name, SecretArgs args, CustomResourceOptions? opts = null)

public Secret(String name, SecretArgs args)
public Secret(String name, SecretArgs args, CustomResourceOptions options)

type: ovh:Okms:Secret
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args SecretArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args SecretArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SecretArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecretArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args SecretArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var secretResource = new Ovh.Okms.Secret("secretResource", new()
{
    OkmsId = "string",
    Path = "string",
    Version = new Ovh.Okms.Inputs.SecretVersionArgs
    {
        Data = "string",
        CreatedAt = "string",
        DeactivatedAt = "string",
        Id = 0,
        State = "string",
    },
    Cas = 0,
    Metadata = new Ovh.Okms.Inputs.SecretMetadataArgs
    {
        CasRequired = false,
        CreatedAt = "string",
        CurrentVersion = 0,
        CustomMetadata = 
        {
            { "string", "string" },
        },
        DeactivateVersionAfter = "string",
        MaxVersions = 0,
        OldestVersion = 0,
        UpdatedAt = "string",
    },
});

example, err := okms.NewSecret(ctx, "secretResource", &okms.SecretArgs{
	OkmsId: pulumi.String("string"),
	Path:   pulumi.String("string"),
	Version: &okms.SecretVersionArgs{
		Data:          pulumi.String("string"),
		CreatedAt:     pulumi.String("string"),
		DeactivatedAt: pulumi.String("string"),
		Id:            pulumi.Float64(0),
		State:         pulumi.String("string"),
	},
	Cas: pulumi.Float64(0),
	Metadata: &okms.SecretMetadataArgs{
		CasRequired:    pulumi.Bool(false),
		CreatedAt:      pulumi.String("string"),
		CurrentVersion: pulumi.Float64(0),
		CustomMetadata: pulumi.StringMap{
			"string": pulumi.String("string"),
		},
		DeactivateVersionAfter: pulumi.String("string"),
		MaxVersions:            pulumi.Float64(0),
		OldestVersion:          pulumi.Float64(0),
		UpdatedAt:              pulumi.String("string"),
	},
})

var secretResource = new Secret("secretResource", SecretArgs.builder()
    .okmsId("string")
    .path("string")
    .version(SecretVersionArgs.builder()
        .data("string")
        .createdAt("string")
        .deactivatedAt("string")
        .id(0.0)
        .state("string")
        .build())
    .cas(0.0)
    .metadata(SecretMetadataArgs.builder()
        .casRequired(false)
        .createdAt("string")
        .currentVersion(0.0)
        .customMetadata(Map.of("string", "string"))
        .deactivateVersionAfter("string")
        .maxVersions(0.0)
        .oldestVersion(0.0)
        .updatedAt("string")
        .build())
    .build());

secret_resource = ovh.okms.Secret("secretResource",
    okms_id="string",
    path="string",
    version={
        "data": "string",
        "created_at": "string",
        "deactivated_at": "string",
        "id": 0,
        "state": "string",
    },
    cas=0,
    metadata={
        "cas_required": False,
        "created_at": "string",
        "current_version": 0,
        "custom_metadata": {
            "string": "string",
        },
        "deactivate_version_after": "string",
        "max_versions": 0,
        "oldest_version": 0,
        "updated_at": "string",
    })

const secretResource = new ovh.okms.Secret("secretResource", {
    okmsId: "string",
    path: "string",
    version: {
        data: "string",
        createdAt: "string",
        deactivatedAt: "string",
        id: 0,
        state: "string",
    },
    cas: 0,
    metadata: {
        casRequired: false,
        createdAt: "string",
        currentVersion: 0,
        customMetadata: {
            string: "string",
        },
        deactivateVersionAfter: "string",
        maxVersions: 0,
        oldestVersion: 0,
        updatedAt: "string",
    },
});

type: ovh:Okms:Secret
properties:
    cas: 0
    metadata:
        casRequired: false
        createdAt: string
        currentVersion: 0
        customMetadata:
            string: string
        deactivateVersionAfter: string
        maxVersions: 0
        oldestVersion: 0
        updatedAt: string
    okmsId: string
    path: string
    version:
        createdAt: string
        data: string
        deactivatedAt: string
        id: 0
        state: string

Secret Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Secret resource accepts the following input properties:

OkmsId string: Okms ID
Path string: Secret path
Version SecretVersion: Create an OKMS secret version
Cas double: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
IncludeData bool: Deprecated: No effect; will be removed in a future version.
Metadata SecretMetadata: Create a secret metadata

OkmsId string: Okms ID
Path string: Secret path
Version SecretVersionArgs: Create an OKMS secret version
Cas float64: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
IncludeData bool: Deprecated: No effect; will be removed in a future version.
Metadata SecretMetadataArgs: Create a secret metadata

okmsId String: Okms ID
path String: Secret path
version SecretVersion: Create an OKMS secret version
cas Double: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
includeData Boolean: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadata: Create a secret metadata

okmsId string: Okms ID
path string: Secret path
version SecretVersion: Create an OKMS secret version
cas number: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
includeData boolean: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadata: Create a secret metadata

okms_id str: Okms ID
path str: Secret path
version SecretVersionArgs: Create an OKMS secret version
cas float: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
include_data bool: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadataArgs: Create a secret metadata

okmsId String: Okms ID
path String: Secret path
version Property Map: Create an OKMS secret version
cas Number: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
includeData Boolean: Deprecated: No effect; will be removed in a future version.
metadata Property Map: Create a secret metadata

Outputs

All input properties are implicitly available as output properties. Additionally, the Secret resource produces the following output properties:

Iam SecretIam: IAM resource metadata embedded in services models
Id string: The provider-assigned unique ID for this managed resource.

Iam SecretIam: IAM resource metadata embedded in services models
Id string: The provider-assigned unique ID for this managed resource.

iam SecretIam: IAM resource metadata embedded in services models
id String: The provider-assigned unique ID for this managed resource.

iam SecretIam: IAM resource metadata embedded in services models
id string: The provider-assigned unique ID for this managed resource.

iam SecretIam: IAM resource metadata embedded in services models
id str: The provider-assigned unique ID for this managed resource.

iam Property Map: IAM resource metadata embedded in services models
id String: The provider-assigned unique ID for this managed resource.

Look up Existing Secret Resource

Get an existing Secret resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecretState, opts?: CustomResourceOptions): Secret

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cas: Optional[float] = None,
        iam: Optional[SecretIamArgs] = None,
        include_data: Optional[bool] = None,
        metadata: Optional[SecretMetadataArgs] = None,
        okms_id: Optional[str] = None,
        path: Optional[str] = None,
        version: Optional[SecretVersionArgs] = None) -> Secret

func GetSecret(ctx *Context, name string, id IDInput, state *SecretState, opts ...ResourceOption) (*Secret, error)

public static Secret Get(string name, Input<string> id, SecretState? state, CustomResourceOptions? opts = null)

public static Secret get(String name, Output<String> id, SecretState state, CustomResourceOptions options)

resources:  _:    type: ovh:Okms:Secret    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Cas double: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
Iam SecretIam: IAM resource metadata embedded in services models
IncludeData bool: Deprecated: No effect; will be removed in a future version.
Metadata SecretMetadata: Create a secret metadata
OkmsId string: Okms ID
Path string: Secret path
Version SecretVersion: Create an OKMS secret version

Cas float64: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
Iam SecretIamArgs: IAM resource metadata embedded in services models
IncludeData bool: Deprecated: No effect; will be removed in a future version.
Metadata SecretMetadataArgs: Create a secret metadata
OkmsId string: Okms ID
Path string: Secret path
Version SecretVersionArgs: Create an OKMS secret version

cas Double: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
iam SecretIam: IAM resource metadata embedded in services models
includeData Boolean: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadata: Create a secret metadata
okmsId String: Okms ID
path String: Secret path
version SecretVersion: Create an OKMS secret version

cas number: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
iam SecretIam: IAM resource metadata embedded in services models
includeData boolean: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadata: Create a secret metadata
okmsId string: Okms ID
path string: Secret path
version SecretVersion: Create an OKMS secret version

cas float: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
iam SecretIamArgs: IAM resource metadata embedded in services models
include_data bool: Deprecated: No effect; will be removed in a future version.
metadata SecretMetadataArgs: Create a secret metadata
okms_id str: Okms ID
path str: Secret path
version SecretVersionArgs: Create an OKMS secret version

cas Number: Check-and-set guard. Only used on update operations: must equal the current secret version for the update to succeed. Ignored on create.
iam Property Map: IAM resource metadata embedded in services models
includeData Boolean: Deprecated: No effect; will be removed in a future version.
metadata Property Map: Create a secret metadata
okmsId String: Okms ID
path String: Secret path
version Property Map: Create an OKMS secret version

Supporting Types

SecretIam, SecretIamArgs

DisplayName string: Resource display name
Id string: Unique identifier of the resource
Tags Dictionary<string, string>: Resource tags. Tags that were internally computed are prefixed with ovh:
Urn string: Unique resource name used in policies

DisplayName string: Resource display name
Id string: Unique identifier of the resource
Tags map[string]string: Resource tags. Tags that were internally computed are prefixed with ovh:
Urn string: Unique resource name used in policies

displayName String: Resource display name
id String: Unique identifier of the resource
tags Map<String,String>: Resource tags. Tags that were internally computed are prefixed with ovh:
urn String: Unique resource name used in policies

displayName string: Resource display name
id string: Unique identifier of the resource
tags {[key: string]: string}: Resource tags. Tags that were internally computed are prefixed with ovh:
urn string: Unique resource name used in policies

display_name str: Resource display name
id str: Unique identifier of the resource
tags Mapping[str, str]: Resource tags. Tags that were internally computed are prefixed with ovh:
urn str: Unique resource name used in policies

displayName String: Resource display name
id String: Unique identifier of the resource
tags Map<String>: Resource tags. Tags that were internally computed are prefixed with ovh:
urn String: Unique resource name used in policies

SecretMetadata, SecretMetadataArgs

CasRequired bool: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
CreatedAt string: Time of creation of the secret
CurrentVersion double: The secret version
CustomMetadata Dictionary<string, string>: Custom metadata
DeactivateVersionAfter string: Time duration before a version is deactivated
MaxVersions double: The number of versions to keep (10 default)
OldestVersion double: The secret oldest version
UpdatedAt string: Time of the last update of the secret

CasRequired bool: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
CreatedAt string: Time of creation of the secret
CurrentVersion float64: The secret version
CustomMetadata map[string]string: Custom metadata
DeactivateVersionAfter string: Time duration before a version is deactivated
MaxVersions float64: The number of versions to keep (10 default)
OldestVersion float64: The secret oldest version
UpdatedAt string: Time of the last update of the secret

casRequired Boolean: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
createdAt String: Time of creation of the secret
currentVersion Double: The secret version
customMetadata Map<String,String>: Custom metadata
deactivateVersionAfter String: Time duration before a version is deactivated
maxVersions Double: The number of versions to keep (10 default)
oldestVersion Double: The secret oldest version
updatedAt String: Time of the last update of the secret

casRequired boolean: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
createdAt string: Time of creation of the secret
currentVersion number: The secret version
customMetadata {[key: string]: string}: Custom metadata
deactivateVersionAfter string: Time duration before a version is deactivated
maxVersions number: The number of versions to keep (10 default)
oldestVersion number: The secret oldest version
updatedAt string: Time of the last update of the secret

cas_required bool: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
created_at str: Time of creation of the secret
current_version float: The secret version
custom_metadata Mapping[str, str]: Custom metadata
deactivate_version_after str: Time duration before a version is deactivated
max_versions float: The number of versions to keep (10 default)
oldest_version float: The secret oldest version
updated_at str: Time of the last update of the secret

casRequired Boolean: The “Cas” parameter will be required for each write request if set to true. When the “cas” (Check and set) is specified, the current version of the secret is verified before updating it.
createdAt String: Time of creation of the secret
currentVersion Number: The secret version
customMetadata Map<String>: Custom metadata
deactivateVersionAfter String: Time duration before a version is deactivated
maxVersions Number: The number of versions to keep (10 default)
oldestVersion Number: The secret oldest version
updatedAt String: Time of the last update of the secret

SecretVersion, SecretVersionArgs

Data string
CreatedAt string: Time of creation of the secret version
DeactivatedAt string: Time of deactivation of the secret version
Id double: Secret version
State string: State of the secret version

Data string
CreatedAt string: Time of creation of the secret version
DeactivatedAt string: Time of deactivation of the secret version
Id float64: Secret version
State string: State of the secret version

data String
createdAt String: Time of creation of the secret version
deactivatedAt String: Time of deactivation of the secret version
id Double: Secret version
state String: State of the secret version

data string
createdAt string: Time of creation of the secret version
deactivatedAt string: Time of deactivation of the secret version
id number: Secret version
state string: State of the secret version

data str
created_at str: Time of creation of the secret version
deactivated_at str: Time of deactivation of the secret version
id float: Secret version
state str: State of the secret version

data String
createdAt String: Time of creation of the secret version
deactivatedAt String: Time of deactivation of the secret version
id Number: Secret version
state String: State of the secret version

Package Details

Repository: ovh ovh/pulumi-ovh
License: Apache-2.0
Notes: This Pulumi package is based on the ovh Terraform Provider.

OVHCloud v2.9.0 published on Friday, Nov 7, 2025 by OVHcloud

Schema (JSON)

ovh/pulumi-ovh

ovh.Okms.Secret

On this page

On this page

subcategory : “Key Management Service (KMS)”

ovh.Okms.Secret (Resource)

Create Secret Resource

Constructor syntax

Parameters

Constructor example

Secret Resource Properties

Inputs

Outputs

Look up Existing Secret Resource

Supporting Types

SecretIam, SecretIamArgs

SecretMetadata, SecretMetadataArgs

SecretVersion, SecretVersionArgs

Package Details

On this page

On this page