HashiCorp Vault
SecretLibrary
Import
AD secret backend libraries can be imported using the path
, e.g.
$ pulumi import vault:ad/secretLibrary:SecretLibrary role ad/library/bob
Example Usage
using Pulumi;
using Vault = Pulumi.Vault;
class MyStack : Stack
{
public MyStack()
{
var config = new Vault.AD.SecretBackend("config", new Vault.AD.SecretBackendArgs
{
Backend = "ad",
Binddn = "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
Bindpass = "SuperSecretPassw0rd",
Url = "ldaps://ad",
InsecureTls = true,
Userdn = "CN=Users,DC=corp,DC=example,DC=net",
});
var qa = new Vault.AD.SecretLibrary("qa", new Vault.AD.SecretLibraryArgs
{
Backend = config.Backend,
ServiceAccountNames =
{
"Bob",
"Mary",
},
Ttl = 60,
DisableCheckInEnforcement = true,
MaxTtl = 120,
});
}
}
package main
import (
"github.com/pulumi/pulumi-vault/sdk/v5/go/vault/ad"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
config, err := ad.NewSecretBackend(ctx, "config", &ad.SecretBackendArgs{
Backend: pulumi.String("ad"),
Binddn: pulumi.String("CN=Administrator,CN=Users,DC=corp,DC=example,DC=net"),
Bindpass: pulumi.String("SuperSecretPassw0rd"),
Url: pulumi.String("ldaps://ad"),
InsecureTls: pulumi.Bool(true),
Userdn: pulumi.String("CN=Users,DC=corp,DC=example,DC=net"),
})
if err != nil {
return err
}
_, err = ad.NewSecretLibrary(ctx, "qa", &ad.SecretLibraryArgs{
Backend: config.Backend,
ServiceAccountNames: pulumi.StringArray{
pulumi.String("Bob"),
pulumi.String("Mary"),
},
Ttl: pulumi.Int(60),
DisableCheckInEnforcement: pulumi.Bool(true),
MaxTtl: pulumi.Int(120),
})
if err != nil {
return err
}
return nil
})
}
Coming soon!
import pulumi
import pulumi_vault as vault
config = vault.ad.SecretBackend("config",
backend="ad",
binddn="CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
bindpass="SuperSecretPassw0rd",
url="ldaps://ad",
insecure_tls=True,
userdn="CN=Users,DC=corp,DC=example,DC=net")
qa = vault.ad.SecretLibrary("qa",
backend=config.backend,
service_account_names=[
"Bob",
"Mary",
],
ttl=60,
disable_check_in_enforcement=True,
max_ttl=120)
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const config = new vault.ad.SecretBackend("config", {
backend: "ad",
binddn: "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
bindpass: "SuperSecretPassw0rd",
url: "ldaps://ad",
insecureTls: true,
userdn: "CN=Users,DC=corp,DC=example,DC=net",
});
const qa = new vault.ad.SecretLibrary("qa", {
backend: config.backend,
serviceAccountNames: [
"Bob",
"Mary",
],
ttl: 60,
disableCheckInEnforcement: true,
maxTtl: 120,
});
Coming soon!
Create a SecretLibrary Resource
new SecretLibrary(name: string, args: SecretLibraryArgs, opts?: CustomResourceOptions);
@overload
def SecretLibrary(resource_name: str,
opts: Optional[ResourceOptions] = None,
backend: Optional[str] = None,
disable_check_in_enforcement: Optional[bool] = None,
max_ttl: Optional[int] = None,
name: Optional[str] = None,
service_account_names: Optional[Sequence[str]] = None,
ttl: Optional[int] = None)
@overload
def SecretLibrary(resource_name: str,
args: SecretLibraryArgs,
opts: Optional[ResourceOptions] = None)
func NewSecretLibrary(ctx *Context, name string, args SecretLibraryArgs, opts ...ResourceOption) (*SecretLibrary, error)
public SecretLibrary(string name, SecretLibraryArgs args, CustomResourceOptions? opts = null)
public SecretLibrary(String name, SecretLibraryArgs args)
public SecretLibrary(String name, SecretLibraryArgs args, CustomResourceOptions options)
type: vault:ad:SecretLibrary
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecretLibraryArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecretLibraryArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecretLibraryArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecretLibraryArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecretLibraryArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
SecretLibrary Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The SecretLibrary resource accepts the following input properties:
- Backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- Service
Account List<string>Names Specifies the slice of service accounts mapped to this set.
- Disable
Check boolIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- Max
Ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- Name string
The name to identify this set of service accounts. Must be unique within the backend.
- Ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- Backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- Service
Account []stringNames Specifies the slice of service accounts mapped to this set.
- Disable
Check boolIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- Max
Ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- Name string
The name to identify this set of service accounts. Must be unique within the backend.
- Ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend String
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- service
Account List<String>Names Specifies the slice of service accounts mapped to this set.
- disable
Check BooleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl Integer The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name String
The name to identify this set of service accounts. Must be unique within the backend.
- ttl Integer
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- service
Account string[]Names Specifies the slice of service accounts mapped to this set.
- disable
Check booleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl number The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name string
The name to identify this set of service accounts. Must be unique within the backend.
- ttl number
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend str
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- service_
account_ Sequence[str]names Specifies the slice of service accounts mapped to this set.
- disable_
check_ boolin_ enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max_
ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name str
The name to identify this set of service accounts. Must be unique within the backend.
- ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend String
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- service
Account List<String>Names Specifies the slice of service accounts mapped to this set.
- disable
Check BooleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl Number The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name String
The name to identify this set of service accounts. Must be unique within the backend.
- ttl Number
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
Outputs
All input properties are implicitly available as output properties. Additionally, the SecretLibrary resource produces the following output properties:
- Id string
The provider-assigned unique ID for this managed resource.
- Id string
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
- id string
The provider-assigned unique ID for this managed resource.
- id str
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
Look up an Existing SecretLibrary Resource
Get an existing SecretLibrary resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecretLibraryState, opts?: CustomResourceOptions): SecretLibrary
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
backend: Optional[str] = None,
disable_check_in_enforcement: Optional[bool] = None,
max_ttl: Optional[int] = None,
name: Optional[str] = None,
service_account_names: Optional[Sequence[str]] = None,
ttl: Optional[int] = None) -> SecretLibrary
func GetSecretLibrary(ctx *Context, name string, id IDInput, state *SecretLibraryState, opts ...ResourceOption) (*SecretLibrary, error)
public static SecretLibrary Get(string name, Input<string> id, SecretLibraryState? state, CustomResourceOptions? opts = null)
public static SecretLibrary get(String name, Output<String> id, SecretLibraryState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- Disable
Check boolIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- Max
Ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- Name string
The name to identify this set of service accounts. Must be unique within the backend.
- Service
Account List<string>Names Specifies the slice of service accounts mapped to this set.
- Ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- Backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- Disable
Check boolIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- Max
Ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- Name string
The name to identify this set of service accounts. Must be unique within the backend.
- Service
Account []stringNames Specifies the slice of service accounts mapped to this set.
- Ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend String
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- disable
Check BooleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl Integer The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name String
The name to identify this set of service accounts. Must be unique within the backend.
- service
Account List<String>Names Specifies the slice of service accounts mapped to this set.
- ttl Integer
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend string
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- disable
Check booleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl number The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name string
The name to identify this set of service accounts. Must be unique within the backend.
- service
Account string[]Names Specifies the slice of service accounts mapped to this set.
- ttl number
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend str
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- disable_
check_ boolin_ enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max_
ttl int The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name str
The name to identify this set of service accounts. Must be unique within the backend.
- service_
account_ Sequence[str]names Specifies the slice of service accounts mapped to this set.
- ttl int
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
- backend String
The path the AD secret backend is mounted at, with no leading or trailing
/
s.- disable
Check BooleanIn Enforcement Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.
- max
Ttl Number The maximum password time-to-live in seconds. Defaults to the configuration max_ttl if not provided.
- name String
The name to identify this set of service accounts. Must be unique within the backend.
- service
Account List<String>Names Specifies the slice of service accounts mapped to this set.
- ttl Number
The password time-to-live in seconds. Defaults to the configuration ttl if not provided.
Package Details
- Repository
- https://github.com/pulumi/pulumi-vault
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
vault
Terraform Provider.