vault logo
HashiCorp Vault v5.10.0, Mar 21 23

vault.azure.BackendRole

Example Usage

using System.Collections.Generic;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var azure = new Vault.Azure.Backend("azure", new()
    {
        SubscriptionId = @var.Subscription_id,
        TenantId = @var.Tenant_id,
        ClientSecret = @var.Client_secret,
        ClientId = @var.Client_id,
    });

    var generatedRole = new Vault.Azure.BackendRole("generatedRole", new()
    {
        Backend = azure.Path,
        Role = "generated_role",
        Ttl = "300",
        MaxTtl = "600",
        AzureRoles = new[]
        {
            new Vault.Azure.Inputs.BackendRoleAzureRoleArgs
            {
                RoleName = "Reader",
                Scope = $"/subscriptions/{@var.Subscription_id}/resourceGroups/azure-vault-group",
            },
        },
    });

    var existingObjectId = new Vault.Azure.BackendRole("existingObjectId", new()
    {
        Backend = azure.Path,
        Role = "existing_object_id",
        ApplicationObjectId = "11111111-2222-3333-4444-44444444444",
        Ttl = "300",
        MaxTtl = "600",
    });

});
package main

import (
	"fmt"

	"github.com/pulumi/pulumi-vault/sdk/v5/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		azure, err := azure.NewBackend(ctx, "azure", &azure.BackendArgs{
			SubscriptionId: pulumi.Any(_var.Subscription_id),
			TenantId:       pulumi.Any(_var.Tenant_id),
			ClientSecret:   pulumi.Any(_var.Client_secret),
			ClientId:       pulumi.Any(_var.Client_id),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "generatedRole", &azure.BackendRoleArgs{
			Backend: azure.Path,
			Role:    pulumi.String("generated_role"),
			Ttl:     pulumi.String("300"),
			MaxTtl:  pulumi.String("600"),
			AzureRoles: azure.BackendRoleAzureRoleArray{
				&azure.BackendRoleAzureRoleArgs{
					RoleName: pulumi.String("Reader"),
					Scope:    pulumi.String(fmt.Sprintf("/subscriptions/%v/resourceGroups/azure-vault-group", _var.Subscription_id)),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "existingObjectId", &azure.BackendRoleArgs{
			Backend:             azure.Path,
			Role:                pulumi.String("existing_object_id"),
			ApplicationObjectId: pulumi.String("11111111-2222-3333-4444-44444444444"),
			Ttl:                 pulumi.String("300"),
			MaxTtl:              pulumi.String("600"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.azure.Backend;
import com.pulumi.vault.azure.BackendArgs;
import com.pulumi.vault.azure.BackendRole;
import com.pulumi.vault.azure.BackendRoleArgs;
import com.pulumi.vault.azure.inputs.BackendRoleAzureRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var azure = new Backend("azure", BackendArgs.builder()        
            .subscriptionId(var_.subscription_id())
            .tenantId(var_.tenant_id())
            .clientSecret(var_.client_secret())
            .clientId(var_.client_id())
            .build());

        var generatedRole = new BackendRole("generatedRole", BackendRoleArgs.builder()        
            .backend(azure.path())
            .role("generated_role")
            .ttl(300)
            .maxTtl(600)
            .azureRoles(BackendRoleAzureRoleArgs.builder()
                .roleName("Reader")
                .scope(String.format("/subscriptions/%s/resourceGroups/azure-vault-group", var_.subscription_id()))
                .build())
            .build());

        var existingObjectId = new BackendRole("existingObjectId", BackendRoleArgs.builder()        
            .backend(azure.path())
            .role("existing_object_id")
            .applicationObjectId("11111111-2222-3333-4444-44444444444")
            .ttl(300)
            .maxTtl(600)
            .build());

    }
}
import pulumi
import pulumi_vault as vault

azure = vault.azure.Backend("azure",
    subscription_id=var["subscription_id"],
    tenant_id=var["tenant_id"],
    client_secret=var["client_secret"],
    client_id=var["client_id"])
generated_role = vault.azure.BackendRole("generatedRole",
    backend=azure.path,
    role="generated_role",
    ttl="300",
    max_ttl="600",
    azure_roles=[vault.azure.BackendRoleAzureRoleArgs(
        role_name="Reader",
        scope=f"/subscriptions/{var['subscription_id']}/resourceGroups/azure-vault-group",
    )])
existing_object_id = vault.azure.BackendRole("existingObjectId",
    backend=azure.path,
    role="existing_object_id",
    application_object_id="11111111-2222-3333-4444-44444444444",
    ttl="300",
    max_ttl="600")
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const azure = new vault.azure.Backend("azure", {
    subscriptionId: _var.subscription_id,
    tenantId: _var.tenant_id,
    clientSecret: _var.client_secret,
    clientId: _var.client_id,
});
const generatedRole = new vault.azure.BackendRole("generatedRole", {
    backend: azure.path,
    role: "generated_role",
    ttl: "300",
    maxTtl: "600",
    azureRoles: [{
        roleName: "Reader",
        scope: `/subscriptions/${_var.subscription_id}/resourceGroups/azure-vault-group`,
    }],
});
const existingObjectId = new vault.azure.BackendRole("existingObjectId", {
    backend: azure.path,
    role: "existing_object_id",
    applicationObjectId: "11111111-2222-3333-4444-44444444444",
    ttl: "300",
    maxTtl: "600",
});
resources:
  azure:
    type: vault:azure:Backend
    properties:
      subscriptionId: ${var.subscription_id}
      tenantId: ${var.tenant_id}
      clientSecret: ${var.client_secret}
      clientId: ${var.client_id}
  generatedRole:
    type: vault:azure:BackendRole
    properties:
      backend: ${azure.path}
      role: generated_role
      ttl: 300
      maxTtl: 600
      azureRoles:
        - roleName: Reader
          scope: /subscriptions/${var.subscription_id}/resourceGroups/azure-vault-group
  existingObjectId:
    type: vault:azure:BackendRole
    properties:
      backend: ${azure.path}
      role: existing_object_id
      applicationObjectId: 11111111-2222-3333-4444-44444444444
      ttl: 300
      maxTtl: 600

Create BackendRole Resource

new BackendRole(name: string, args: BackendRoleArgs, opts?: CustomResourceOptions);
@overload
def BackendRole(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                application_object_id: Optional[str] = None,
                azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
                azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
                backend: Optional[str] = None,
                description: Optional[str] = None,
                max_ttl: Optional[str] = None,
                namespace: Optional[str] = None,
                role: Optional[str] = None,
                ttl: Optional[str] = None)
@overload
def BackendRole(resource_name: str,
                args: BackendRoleArgs,
                opts: Optional[ResourceOptions] = None)
func NewBackendRole(ctx *Context, name string, args BackendRoleArgs, opts ...ResourceOption) (*BackendRole, error)
public BackendRole(string name, BackendRoleArgs args, CustomResourceOptions? opts = null)
public BackendRole(String name, BackendRoleArgs args)
public BackendRole(String name, BackendRoleArgs args, CustomResourceOptions options)
type: vault:azure:BackendRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string
The unique name of the resource.
args BackendRoleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args BackendRoleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args BackendRoleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args BackendRoleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args BackendRoleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

BackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The BackendRole resource accepts the following input properties:

Role string

Name of the Azure role

ApplicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

AzureGroups List<BackendRoleAzureGroupArgs>

List of Azure groups to be assigned to the generated service principal.

AzureRoles List<BackendRoleAzureRoleArgs>

List of Azure roles to be assigned to the generated service principal.

Backend string

Path to the mounted Azure auth backend

Description string

Human-friendly description of the mount for the backend.

MaxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

Namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

Role string

Name of the Azure role

ApplicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

AzureGroups []BackendRoleAzureGroupArgs

List of Azure groups to be assigned to the generated service principal.

AzureRoles []BackendRoleAzureRoleArgs

List of Azure roles to be assigned to the generated service principal.

Backend string

Path to the mounted Azure auth backend

Description string

Human-friendly description of the mount for the backend.

MaxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

Namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role String

Name of the Azure role

applicationObjectId String

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups List<BackendRoleAzureGroupArgs>

List of Azure groups to be assigned to the generated service principal.

azureRoles List<BackendRoleAzureRoleArgs>

List of Azure roles to be assigned to the generated service principal.

backend String

Path to the mounted Azure auth backend

description String

Human-friendly description of the mount for the backend.

maxTtl String

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace String

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

ttl String

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role string

Name of the Azure role

applicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups BackendRoleAzureGroupArgs[]

List of Azure groups to be assigned to the generated service principal.

azureRoles BackendRoleAzureRoleArgs[]

List of Azure roles to be assigned to the generated service principal.

backend string

Path to the mounted Azure auth backend

description string

Human-friendly description of the mount for the backend.

maxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role str

Name of the Azure role

application_object_id str

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azure_groups Sequence[BackendRoleAzureGroupArgs]

List of Azure groups to be assigned to the generated service principal.

azure_roles Sequence[BackendRoleAzureRoleArgs]

List of Azure roles to be assigned to the generated service principal.

backend str

Path to the mounted Azure auth backend

description str

Human-friendly description of the mount for the backend.

max_ttl str

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace str

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

ttl str

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

role String

Name of the Azure role

applicationObjectId String

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups List<Property Map>

List of Azure groups to be assigned to the generated service principal.

azureRoles List<Property Map>

List of Azure roles to be assigned to the generated service principal.

backend String

Path to the mounted Azure auth backend

description String

Human-friendly description of the mount for the backend.

maxTtl String

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace String

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

ttl String

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

Outputs

All input properties are implicitly available as output properties. Additionally, the BackendRole resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id string

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

Look up Existing BackendRole Resource

Get an existing BackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: BackendRoleState, opts?: CustomResourceOptions): BackendRole
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_object_id: Optional[str] = None,
        azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
        azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
        backend: Optional[str] = None,
        description: Optional[str] = None,
        max_ttl: Optional[str] = None,
        namespace: Optional[str] = None,
        role: Optional[str] = None,
        ttl: Optional[str] = None) -> BackendRole
func GetBackendRole(ctx *Context, name string, id IDInput, state *BackendRoleState, opts ...ResourceOption) (*BackendRole, error)
public static BackendRole Get(string name, Input<string> id, BackendRoleState? state, CustomResourceOptions? opts = null)
public static BackendRole get(String name, Output<String> id, BackendRoleState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
ApplicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

AzureGroups List<BackendRoleAzureGroupArgs>

List of Azure groups to be assigned to the generated service principal.

AzureRoles List<BackendRoleAzureRoleArgs>

List of Azure roles to be assigned to the generated service principal.

Backend string

Path to the mounted Azure auth backend

Description string

Human-friendly description of the mount for the backend.

MaxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

Namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Role string

Name of the Azure role

Ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

ApplicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

AzureGroups []BackendRoleAzureGroupArgs

List of Azure groups to be assigned to the generated service principal.

AzureRoles []BackendRoleAzureRoleArgs

List of Azure roles to be assigned to the generated service principal.

Backend string

Path to the mounted Azure auth backend

Description string

Human-friendly description of the mount for the backend.

MaxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

Namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Role string

Name of the Azure role

Ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId String

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups List<BackendRoleAzureGroupArgs>

List of Azure groups to be assigned to the generated service principal.

azureRoles List<BackendRoleAzureRoleArgs>

List of Azure roles to be assigned to the generated service principal.

backend String

Path to the mounted Azure auth backend

description String

Human-friendly description of the mount for the backend.

maxTtl String

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace String

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

role String

Name of the Azure role

ttl String

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId string

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups BackendRoleAzureGroupArgs[]

List of Azure groups to be assigned to the generated service principal.

azureRoles BackendRoleAzureRoleArgs[]

List of Azure roles to be assigned to the generated service principal.

backend string

Path to the mounted Azure auth backend

description string

Human-friendly description of the mount for the backend.

maxTtl string

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

role string

Name of the Azure role

ttl string

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

application_object_id str

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azure_groups Sequence[BackendRoleAzureGroupArgs]

List of Azure groups to be assigned to the generated service principal.

azure_roles Sequence[BackendRoleAzureRoleArgs]

List of Azure roles to be assigned to the generated service principal.

backend str

Path to the mounted Azure auth backend

description str

Human-friendly description of the mount for the backend.

max_ttl str

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace str

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

role str

Name of the Azure role

ttl str

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

applicationObjectId String

Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles will be ignored.

azureGroups List<Property Map>

List of Azure groups to be assigned to the generated service principal.

azureRoles List<Property Map>

List of Azure roles to be assigned to the generated service principal.

backend String

Path to the mounted Azure auth backend

description String

Human-friendly description of the mount for the backend.

maxTtl String

Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.

namespace String

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

role String

Name of the Azure role

ttl String

Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

Supporting Types

BackendRoleAzureGroup

GroupName string
ObjectId string
GroupName string
ObjectId string
groupName String
objectId String
groupName string
objectId string
groupName String
objectId String

BackendRoleAzureRole

Scope string
RoleId string
RoleName string
Scope string
RoleId string
RoleName string
scope String
roleId String
roleName String
scope string
roleId string
roleName string
scope String
roleId String
roleName String

Package Details

Repository
Vault pulumi/pulumi-vault
License
Apache-2.0
Notes

This Pulumi package is based on the vault Terraform Provider.