HashiCorp Vault v5.10.0, Mar 21 23

vault.azure.BackendRole

Example Usage

using System.Collections.Generic;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var azure = new Vault.Azure.Backend("azure", new()
    {
        SubscriptionId = @var.Subscription_id,
        TenantId = @var.Tenant_id,
        ClientSecret = @var.Client_secret,
        ClientId = @var.Client_id,
    });

    var generatedRole = new Vault.Azure.BackendRole("generatedRole", new()
    {
        Backend = azure.Path,
        Role = "generated_role",
        Ttl = "300",
        MaxTtl = "600",
        AzureRoles = new[]
        {
            new Vault.Azure.Inputs.BackendRoleAzureRoleArgs
            {
                RoleName = "Reader",
                Scope = $"/subscriptions/{@var.Subscription_id}/resourceGroups/azure-vault-group",
            },
        },
    });

    var existingObjectId = new Vault.Azure.BackendRole("existingObjectId", new()
    {
        Backend = azure.Path,
        Role = "existing_object_id",
        ApplicationObjectId = "11111111-2222-3333-4444-44444444444",
        Ttl = "300",
        MaxTtl = "600",
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-vault/sdk/v5/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		azure, err := azure.NewBackend(ctx, "azure", &azure.BackendArgs{
			SubscriptionId: pulumi.Any(_var.Subscription_id),
			TenantId:       pulumi.Any(_var.Tenant_id),
			ClientSecret:   pulumi.Any(_var.Client_secret),
			ClientId:       pulumi.Any(_var.Client_id),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "generatedRole", &azure.BackendRoleArgs{
			Backend: azure.Path,
			Role:    pulumi.String("generated_role"),
			Ttl:     pulumi.String("300"),
			MaxTtl:  pulumi.String("600"),
			AzureRoles: azure.BackendRoleAzureRoleArray{
				&azure.BackendRoleAzureRoleArgs{
					RoleName: pulumi.String("Reader"),
					Scope:    pulumi.String(fmt.Sprintf("/subscriptions/%v/resourceGroups/azure-vault-group", _var.Subscription_id)),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "existingObjectId", &azure.BackendRoleArgs{
			Backend:             azure.Path,
			Role:                pulumi.String("existing_object_id"),
			ApplicationObjectId: pulumi.String("11111111-2222-3333-4444-44444444444"),
			Ttl:                 pulumi.String("300"),
			MaxTtl:              pulumi.String("600"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.azure.Backend;
import com.pulumi.vault.azure.BackendArgs;
import com.pulumi.vault.azure.BackendRole;
import com.pulumi.vault.azure.BackendRoleArgs;
import com.pulumi.vault.azure.inputs.BackendRoleAzureRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var azure = new Backend("azure", BackendArgs.builder()        
            .subscriptionId(var_.subscription_id())
            .tenantId(var_.tenant_id())
            .clientSecret(var_.client_secret())
            .clientId(var_.client_id())
            .build());

        var generatedRole = new BackendRole("generatedRole", BackendRoleArgs.builder()        
            .backend(azure.path())
            .role("generated_role")
            .ttl(300)
            .maxTtl(600)
            .azureRoles(BackendRoleAzureRoleArgs.builder()
                .roleName("Reader")
                .scope(String.format("/subscriptions/%s/resourceGroups/azure-vault-group", var_.subscription_id()))
                .build())
            .build());

        var existingObjectId = new BackendRole("existingObjectId", BackendRoleArgs.builder()        
            .backend(azure.path())
            .role("existing_object_id")
            .applicationObjectId("11111111-2222-3333-4444-44444444444")
            .ttl(300)
            .maxTtl(600)
            .build());

    }
}

import pulumi
import pulumi_vault as vault

azure = vault.azure.Backend("azure",
    subscription_id=var["subscription_id"],
    tenant_id=var["tenant_id"],
    client_secret=var["client_secret"],
    client_id=var["client_id"])
generated_role = vault.azure.BackendRole("generatedRole",
    backend=azure.path,
    role="generated_role",
    ttl="300",
    max_ttl="600",
    azure_roles=[vault.azure.BackendRoleAzureRoleArgs(
        role_name="Reader",
        scope=f"/subscriptions/{var['subscription_id']}/resourceGroups/azure-vault-group",
    )])
existing_object_id = vault.azure.BackendRole("existingObjectId",
    backend=azure.path,
    role="existing_object_id",
    application_object_id="11111111-2222-3333-4444-44444444444",
    ttl="300",
    max_ttl="600")

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const azure = new vault.azure.Backend("azure", {
    subscriptionId: _var.subscription_id,
    tenantId: _var.tenant_id,
    clientSecret: _var.client_secret,
    clientId: _var.client_id,
});
const generatedRole = new vault.azure.BackendRole("generatedRole", {
    backend: azure.path,
    role: "generated_role",
    ttl: "300",
    maxTtl: "600",
    azureRoles: [{
        roleName: "Reader",
        scope: `/subscriptions/${_var.subscription_id}/resourceGroups/azure-vault-group`,
    }],
});
const existingObjectId = new vault.azure.BackendRole("existingObjectId", {
    backend: azure.path,
    role: "existing_object_id",
    applicationObjectId: "11111111-2222-3333-4444-44444444444",
    ttl: "300",
    maxTtl: "600",
});

resources:
  azure:
    type: vault:azure:Backend
    properties:
      subscriptionId: ${var.subscription_id}
      tenantId: ${var.tenant_id}
      clientSecret: ${var.client_secret}
      clientId: ${var.client_id}
  generatedRole:
    type: vault:azure:BackendRole
    properties:
      backend: ${azure.path}
      role: generated_role
      ttl: 300
      maxTtl: 600
      azureRoles:
        - roleName: Reader
          scope: /subscriptions/${var.subscription_id}/resourceGroups/azure-vault-group
  existingObjectId:
    type: vault:azure:BackendRole
    properties:
      backend: ${azure.path}
      role: existing_object_id
      applicationObjectId: 11111111-2222-3333-4444-44444444444
      ttl: 300
      maxTtl: 600

Create BackendRole Resource

new BackendRole(name: string, args: BackendRoleArgs, opts?: CustomResourceOptions);

@overload
def BackendRole(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                application_object_id: Optional[str] = None,
                azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
                azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
                backend: Optional[str] = None,
                description: Optional[str] = None,
                max_ttl: Optional[str] = None,
                namespace: Optional[str] = None,
                role: Optional[str] = None,
                ttl: Optional[str] = None)
@overload
def BackendRole(resource_name: str,
                args: BackendRoleArgs,
                opts: Optional[ResourceOptions] = None)

func NewBackendRole(ctx *Context, name string, args BackendRoleArgs, opts ...ResourceOption) (*BackendRole, error)

public BackendRole(string name, BackendRoleArgs args, CustomResourceOptions? opts = null)

public BackendRole(String name, BackendRoleArgs args)
public BackendRole(String name, BackendRoleArgs args, CustomResourceOptions options)

type: vault:azure:BackendRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args BackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args BackendRoleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args BackendRoleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args BackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args BackendRoleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

BackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The BackendRole resource accepts the following input properties:

Role string: Name of the Azure role
ApplicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
AzureGroups List<BackendRoleAzureGroupArgs>: List of Azure groups to be assigned to the generated service principal.
AzureRoles List<BackendRoleAzureRoleArgs>: List of Azure roles to be assigned to the generated service principal.
Backend string: Path to the mounted Azure auth backend
Description string: Human-friendly description of the mount for the backend.
MaxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
Ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

Role string: Name of the Azure role
ApplicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
AzureGroups []BackendRoleAzureGroupArgs: List of Azure groups to be assigned to the generated service principal.
AzureRoles []BackendRoleAzureRoleArgs: List of Azure roles to be assigned to the generated service principal.
Backend string: Path to the mounted Azure auth backend
Description string: Human-friendly description of the mount for the backend.
MaxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
Ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role String: Name of the Azure role
applicationObjectId String: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups List<BackendRoleAzureGroupArgs>: List of Azure groups to be assigned to the generated service principal.
azureRoles List<BackendRoleAzureRoleArgs>: List of Azure roles to be assigned to the generated service principal.
backend String: Path to the mounted Azure auth backend
description String: Human-friendly description of the mount for the backend.
maxTtl String: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
ttl String: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role string: Name of the Azure role
applicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups BackendRoleAzureGroupArgs[]: List of Azure groups to be assigned to the generated service principal.
azureRoles BackendRoleAzureRoleArgs[]: List of Azure roles to be assigned to the generated service principal.
backend string: Path to the mounted Azure auth backend
description string: Human-friendly description of the mount for the backend.
maxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role str: Name of the Azure role
application_object_id str: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azure_groups Sequence[BackendRoleAzureGroupArgs]: List of Azure groups to be assigned to the generated service principal.
azure_roles Sequence[BackendRoleAzureRoleArgs]: List of Azure roles to be assigned to the generated service principal.
backend str: Path to the mounted Azure auth backend
description str: Human-friendly description of the mount for the backend.
max_ttl str: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace str: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
ttl str: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role String: Name of the Azure role
applicationObjectId String: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups List<Property Map>: List of Azure groups to be assigned to the generated service principal.
azureRoles List<Property Map>: List of Azure roles to be assigned to the generated service principal.
backend String: Path to the mounted Azure auth backend
description String: Human-friendly description of the mount for the backend.
maxTtl String: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
ttl String: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

Outputs

All input properties are implicitly available as output properties. Additionally, the BackendRole resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing BackendRole Resource

Get an existing BackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: BackendRoleState, opts?: CustomResourceOptions): BackendRole

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_object_id: Optional[str] = None,
        azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
        azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
        backend: Optional[str] = None,
        description: Optional[str] = None,
        max_ttl: Optional[str] = None,
        namespace: Optional[str] = None,
        role: Optional[str] = None,
        ttl: Optional[str] = None) -> BackendRole

func GetBackendRole(ctx *Context, name string, id IDInput, state *BackendRoleState, opts ...ResourceOption) (*BackendRole, error)

public static BackendRole Get(string name, Input<string> id, BackendRoleState? state, CustomResourceOptions? opts = null)

public static BackendRole get(String name, Output<String> id, BackendRoleState state, CustomResourceOptions options)

Resource lookup is not supported in YAML

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

ApplicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
AzureGroups List<BackendRoleAzureGroupArgs>: List of Azure groups to be assigned to the generated service principal.
AzureRoles List<BackendRoleAzureRoleArgs>: List of Azure roles to be assigned to the generated service principal.
Backend string: Path to the mounted Azure auth backend
Description string: Human-friendly description of the mount for the backend.
MaxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
Role string: Name of the Azure role
Ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

ApplicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
AzureGroups []BackendRoleAzureGroupArgs: List of Azure groups to be assigned to the generated service principal.
AzureRoles []BackendRoleAzureRoleArgs: List of Azure roles to be assigned to the generated service principal.
Backend string: Path to the mounted Azure auth backend
Description string: Human-friendly description of the mount for the backend.
MaxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
Role string: Name of the Azure role
Ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId String: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups List<BackendRoleAzureGroupArgs>: List of Azure groups to be assigned to the generated service principal.
azureRoles List<BackendRoleAzureRoleArgs>: List of Azure roles to be assigned to the generated service principal.
backend String: Path to the mounted Azure auth backend
description String: Human-friendly description of the mount for the backend.
maxTtl String: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
role String: Name of the Azure role
ttl String: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId string: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups BackendRoleAzureGroupArgs[]: List of Azure groups to be assigned to the generated service principal.
azureRoles BackendRoleAzureRoleArgs[]: List of Azure roles to be assigned to the generated service principal.
backend string: Path to the mounted Azure auth backend
description string: Human-friendly description of the mount for the backend.
maxTtl string: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
role string: Name of the Azure role
ttl string: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

application_object_id str: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azure_groups Sequence[BackendRoleAzureGroupArgs]: List of Azure groups to be assigned to the generated service principal.
azure_roles Sequence[BackendRoleAzureRoleArgs]: List of Azure roles to be assigned to the generated service principal.
backend str: Path to the mounted Azure auth backend
description str: Human-friendly description of the mount for the backend.
max_ttl str: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace str: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
role str: Name of the Azure role
ttl str: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId String: Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.
azureGroups List<Property Map>: List of Azure groups to be assigned to the generated service principal.
azureRoles List<Property Map>: List of Azure roles to be assigned to the generated service principal.
backend String: Path to the mounted Azure auth backend
description String: Human-friendly description of the mount for the backend.
maxTtl String: Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
role String: Name of the Azure role
ttl String: Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.