vault.AgentRegistration

Preview feature: This feature is currently available as a preview and is possibly incomplete and subject to change. We strongly discourage using preview or beta features with production workflows.

Manages Agent Registry records in Vault Enterprise. An Agent Registry record allows you to register Vault agents with specific identity entities and configure ceiling policies that limit the maximum permissions an agent can obtain.

Important This resource is available only in Vault Enterprise and requires Vault 2.0.1 or later.

Notes

• Mount: The Agent Registry is mounted by default. There is no need to take action to enable it.

• Ceiling Policies: Ceiling policies define the maximum permissions an agent can obtain. Even if the associated entity or token policies grant broader permissions, the agent will be limited to the intersection of all applicable policies and the ceiling policies.

• Default Ceiling Policy: By default, Vault applies a default ceiling policy to Agent Registry records. This policy is automatically filtered out when reading the resource state, so only user-specified ceiling policies appear in the ceilingPolicies attribute.

• Entity Requirement: The identity entity specified in entityId must exist before you create the Agent Registry record. The entity defines the base identity for the agent.

• Display Name Uniqueness: The displayName must be unique within the namespace. Attempting to create multiple Agent Registry records with the same display name will result in an error.

• Immutable Display Name: Changing the displayName requires destroying and recreating the Agent Registry record, as it serves as the unique identifier.

• Enterprise Feature: Agent Registry records are only available in Vault Enterprise. Attempting to use this resource with Vault Community Edition will result in an error.

• Version Requirement: This resource requires Vault 2.0.1 or later.

Create AgentRegistration Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new AgentRegistration(name: string, args: AgentRegistrationArgs, opts?: CustomResourceOptions);

@overload
def AgentRegistration(resource_name: str,
                      args: AgentRegistrationArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def AgentRegistration(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      display_name: Optional[str] = None,
                      entity_id: Optional[str] = None,
                      ceiling_policies: Optional[Sequence[str]] = None,
                      description: Optional[str] = None,
                      namespace: Optional[str] = None,
                      no_default_ceiling_policy: Optional[bool] = None,
                      optional_authorization_details: Optional[bool] = None,
                      owner: Optional[str] = None)

func NewAgentRegistration(ctx *Context, name string, args AgentRegistrationArgs, opts ...ResourceOption) (*AgentRegistration, error)

public AgentRegistration(string name, AgentRegistrationArgs args, CustomResourceOptions? opts = null)

public AgentRegistration(String name, AgentRegistrationArgs args)
public AgentRegistration(String name, AgentRegistrationArgs args, CustomResourceOptions options)

type: vault:AgentRegistration
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "vault_agent_registration" "name" {
    # resource properties
}

Parameters

Constructor example

The following reference example uses placeholder values for all input properties.

var agentRegistrationResource = new Vault.AgentRegistration("agentRegistrationResource", new()
{
    DisplayName = "string",
    EntityId = "string",
    CeilingPolicies = new[]
    {
        "string",
    },
    Description = "string",
    Namespace = "string",
    NoDefaultCeilingPolicy = false,
    OptionalAuthorizationDetails = false,
    Owner = "string",
});

example, err := vault.NewAgentRegistration(ctx, "agentRegistrationResource", &vault.AgentRegistrationArgs{
	DisplayName: pulumi.String("string"),
	EntityId:    pulumi.String("string"),
	CeilingPolicies: pulumi.StringArray{
		pulumi.String("string"),
	},
	Description:                  pulumi.String("string"),
	Namespace:                    pulumi.String("string"),
	NoDefaultCeilingPolicy:       pulumi.Bool(false),
	OptionalAuthorizationDetails: pulumi.Bool(false),
	Owner:                        pulumi.String("string"),
})

resource "vault_agent_registration" "agentRegistrationResource" {
  lifecycle {
    create_before_destroy = true
  }
  display_name                   = "string"
  entity_id                      = "string"
  ceiling_policies               = ["string"]
  description                    = "string"
  namespace                      = "string"
  no_default_ceiling_policy      = false
  optional_authorization_details = false
  owner                          = "string"
}

var agentRegistrationResource = new AgentRegistration("agentRegistrationResource", AgentRegistrationArgs.builder()
    .displayName("string")
    .entityId("string")
    .ceilingPolicies("string")
    .description("string")
    .namespace("string")
    .noDefaultCeilingPolicy(false)
    .optionalAuthorizationDetails(false)
    .owner("string")
    .build());

agent_registration_resource = vault.AgentRegistration("agentRegistrationResource",
    display_name="string",
    entity_id="string",
    ceiling_policies=["string"],
    description="string",
    namespace="string",
    no_default_ceiling_policy=False,
    optional_authorization_details=False,
    owner="string")

const agentRegistrationResource = new vault.AgentRegistration("agentRegistrationResource", {
    displayName: "string",
    entityId: "string",
    ceilingPolicies: ["string"],
    description: "string",
    namespace: "string",
    noDefaultCeilingPolicy: false,
    optionalAuthorizationDetails: false,
    owner: "string",
});

type: vault:AgentRegistration
properties:
    ceilingPolicies:
        - string
    description: string
    displayName: string
    entityId: string
    namespace: string
    noDefaultCeilingPolicy: false
    optionalAuthorizationDetails: false
    owner: string

AgentRegistration Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The AgentRegistration resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the AgentRegistration resource produces the following output properties:

Look up Existing AgentRegistration Resource

Get an existing AgentRegistration resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AgentRegistrationState, opts?: CustomResourceOptions): AgentRegistration

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ceiling_policies: Optional[Sequence[str]] = None,
        creation_time: Optional[str] = None,
        description: Optional[str] = None,
        display_name: Optional[str] = None,
        entity_id: Optional[str] = None,
        last_updated_time: Optional[str] = None,
        namespace: Optional[str] = None,
        no_default_ceiling_policy: Optional[bool] = None,
        optional_authorization_details: Optional[bool] = None,
        owner: Optional[str] = None) -> AgentRegistration

func GetAgentRegistration(ctx *Context, name string, id IDInput, state *AgentRegistrationState, opts ...ResourceOption) (*AgentRegistration, error)

public static AgentRegistration Get(string name, Input<string> id, AgentRegistrationState? state, CustomResourceOptions? opts = null)

public static AgentRegistration get(String name, Output<String> id, AgentRegistrationState state, CustomResourceOptions options)

resources:  _:    type: vault:AgentRegistration    get:      id: ${id}

import {
  to = vault_agent_registration.example
  id = "${id}"
}

Import

You can import Agent Registry records using either their displayName or their id (UUID). The provider auto-detects which you supplied: if the import string parses as a UUID, the provider reads the record by id; otherwise it reads the record by displayName.

$ pulumi import vault:index/agentRegistration:AgentRegistration example my-agent

To import a record by id:

$ pulumi import vault:index/agentRegistration:AgentRegistration example 550e8400-e29b-41d4-a716-446655440000

The import string does not encode the namespace. To import a record from a namespace, set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable:

$ TERRAFORM_VAULT_NAMESPACE_IMPORT=application terraform import vault_agent_registration.example my-agent

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository

Vault pulumi/pulumi-vault

License

Apache-2.0

Notes

This Pulumi package is based on the vault Terraform Provider.