Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Packages
  2. HashiCorp Vault Provider
  3. API Docs
  4. azure
  5. BackendRole
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

vault.azure.BackendRole

Explore with Pulumi AI

vault logo
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const azure = new vault.azure.Backend("azure", {
    subscriptionId: subscriptionId,
    tenantId: tenantId,
    clientSecret: clientSecret,
    clientId: clientId,
});
const generatedRole = new vault.azure.BackendRole("generated_role", {
    backend: azure.path,
    role: "generated_role",
    signInAudience: "AzureADMyOrg",
    tags: [
        "team:engineering",
        "environment:development",
    ],
    ttl: "300",
    maxTtl: "600",
    azureRoles: [{
        roleName: "Reader",
        scope: `/subscriptions/${subscriptionId}/resourceGroups/azure-vault-group`,
    }],
});
const existingObjectId = new vault.azure.BackendRole("existing_object_id", {
    backend: azure.path,
    role: "existing_object_id",
    applicationObjectId: "11111111-2222-3333-4444-44444444444",
    ttl: "300",
    maxTtl: "600",
});

    import pulumi
import pulumi_vault as vault

azure = vault.azure.Backend("azure",
    subscription_id=subscription_id,
    tenant_id=tenant_id,
    client_secret=client_secret,
    client_id=client_id)
generated_role = vault.azure.BackendRole("generated_role",
    backend=azure.path,
    role="generated_role",
    sign_in_audience="AzureADMyOrg",
    tags=[
        "team:engineering",
        "environment:development",
    ],
    ttl="300",
    max_ttl="600",
    azure_roles=[{
        "role_name": "Reader",
        "scope": f"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group",
    }])
existing_object_id = vault.azure.BackendRole("existing_object_id",
    backend=azure.path,
    role="existing_object_id",
    application_object_id="11111111-2222-3333-4444-44444444444",
    ttl="300",
    max_ttl="600")

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		azure, err := azure.NewBackend(ctx, "azure", &azure.BackendArgs{
			SubscriptionId: pulumi.Any(subscriptionId),
			TenantId:       pulumi.Any(tenantId),
			ClientSecret:   pulumi.Any(clientSecret),
			ClientId:       pulumi.Any(clientId),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "generated_role", &azure.BackendRoleArgs{
			Backend:        azure.Path,
			Role:           pulumi.String("generated_role"),
			SignInAudience: pulumi.String("AzureADMyOrg"),
			Tags: pulumi.StringArray{
				pulumi.String("team:engineering"),
				pulumi.String("environment:development"),
			},
			Ttl:    pulumi.String("300"),
			MaxTtl: pulumi.String("600"),
			AzureRoles: azure.BackendRoleAzureRoleArray{
				&azure.BackendRoleAzureRoleArgs{
					RoleName: pulumi.String("Reader"),
					Scope:    pulumi.Sprintf("/subscriptions/%v/resourceGroups/azure-vault-group", subscriptionId),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = azure.NewBackendRole(ctx, "existing_object_id", &azure.BackendRoleArgs{
			Backend:             azure.Path,
			Role:                pulumi.String("existing_object_id"),
			ApplicationObjectId: pulumi.String("11111111-2222-3333-4444-44444444444"),
			Ttl:                 pulumi.String("300"),
			MaxTtl:              pulumi.String("600"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var azure = new Vault.Azure.Backend("azure", new()
    {
        SubscriptionId = subscriptionId,
        TenantId = tenantId,
        ClientSecret = clientSecret,
        ClientId = clientId,
    });

    var generatedRole = new Vault.Azure.BackendRole("generated_role", new()
    {
        Backend = azure.Path,
        Role = "generated_role",
        SignInAudience = "AzureADMyOrg",
        Tags = new[]
        {
            "team:engineering",
            "environment:development",
        },
        Ttl = "300",
        MaxTtl = "600",
        AzureRoles = new[]
        {
            new Vault.Azure.Inputs.BackendRoleAzureRoleArgs
            {
                RoleName = "Reader",
                Scope = $"/subscriptions/{subscriptionId}/resourceGroups/azure-vault-group",
            },
        },
    });

    var existingObjectId = new Vault.Azure.BackendRole("existing_object_id", new()
    {
        Backend = azure.Path,
        Role = "existing_object_id",
        ApplicationObjectId = "11111111-2222-3333-4444-44444444444",
        Ttl = "300",
        MaxTtl = "600",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.azure.Backend;
import com.pulumi.vault.azure.BackendArgs;
import com.pulumi.vault.azure.BackendRole;
import com.pulumi.vault.azure.BackendRoleArgs;
import com.pulumi.vault.azure.inputs.BackendRoleAzureRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var azure = new Backend("azure", BackendArgs.builder()
            .subscriptionId(subscriptionId)
            .tenantId(tenantId)
            .clientSecret(clientSecret)
            .clientId(clientId)
            .build());

        var generatedRole = new BackendRole("generatedRole", BackendRoleArgs.builder()
            .backend(azure.path())
            .role("generated_role")
            .signInAudience("AzureADMyOrg")
            .tags(            
                "team:engineering",
                "environment:development")
            .ttl("300")
            .maxTtl("600")
            .azureRoles(BackendRoleAzureRoleArgs.builder()
                .roleName("Reader")
                .scope(String.format("/subscriptions/%s/resourceGroups/azure-vault-group", subscriptionId))
                .build())
            .build());

        var existingObjectId = new BackendRole("existingObjectId", BackendRoleArgs.builder()
            .backend(azure.path())
            .role("existing_object_id")
            .applicationObjectId("11111111-2222-3333-4444-44444444444")
            .ttl("300")
            .maxTtl("600")
            .build());

    }
}

    resources:
  azure:
    type: vault:azure:Backend
    properties:
      subscriptionId: ${subscriptionId}
      tenantId: ${tenantId}
      clientSecret: ${clientSecret}
      clientId: ${clientId}
  generatedRole:
    type: vault:azure:BackendRole
    name: generated_role
    properties:
      backend: ${azure.path}
      role: generated_role
      signInAudience: AzureADMyOrg
      tags:
        - team:engineering
        - environment:development
      ttl: 300
      maxTtl: 600
      azureRoles:
        - roleName: Reader
          scope: /subscriptions/${subscriptionId}/resourceGroups/azure-vault-group
  existingObjectId:
    type: vault:azure:BackendRole
    name: existing_object_id
    properties:
      backend: ${azure.path}
      role: existing_object_id
      applicationObjectId: 11111111-2222-3333-4444-44444444444
      ttl: 300
      maxTtl: 600

    Create BackendRole Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new BackendRole(name: string, args: BackendRoleArgs, opts?: CustomResourceOptions);
    @overload
def BackendRole(resource_name: str,
                args: BackendRoleArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def BackendRole(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                role: Optional[str] = None,
                backend: Optional[str] = None,
                azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
                application_object_id: Optional[str] = None,
                description: Optional[str] = None,
                explicit_max_ttl: Optional[str] = None,
                max_ttl: Optional[str] = None,
                namespace: Optional[str] = None,
                permanently_delete: Optional[bool] = None,
                azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
                sign_in_audience: Optional[str] = None,
                tags: Optional[Sequence[str]] = None,
                ttl: Optional[str] = None)
    func NewBackendRole(ctx *Context, name string, args BackendRoleArgs, opts ...ResourceOption) (*BackendRole, error)
    public BackendRole(string name, BackendRoleArgs args, CustomResourceOptions? opts = null)
    public BackendRole(String name, BackendRoleArgs args)
public BackendRole(String name, BackendRoleArgs args, CustomResourceOptions options)

    type: vault:azure:BackendRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args BackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args BackendRoleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args BackendRoleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args BackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args BackendRoleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var backendRoleResource = new Vault.Azure.BackendRole("backendRoleResource", new()
{
    Role = "string",
    Backend = "string",
    AzureRoles = new[]
    {
        new Vault.Azure.Inputs.BackendRoleAzureRoleArgs
        {
            Scope = "string",
            RoleId = "string",
            RoleName = "string",
        },
    },
    ApplicationObjectId = "string",
    Description = "string",
    ExplicitMaxTtl = "string",
    MaxTtl = "string",
    Namespace = "string",
    PermanentlyDelete = false,
    AzureGroups = new[]
    {
        new Vault.Azure.Inputs.BackendRoleAzureGroupArgs
        {
            GroupName = "string",
            ObjectId = "string",
        },
    },
    SignInAudience = "string",
    Tags = new[]
    {
        "string",
    },
    Ttl = "string",
});

    example, err := azure.NewBackendRole(ctx, "backendRoleResource", &azure.BackendRoleArgs{
	Role:    pulumi.String("string"),
	Backend: pulumi.String("string"),
	AzureRoles: azure.BackendRoleAzureRoleArray{
		&azure.BackendRoleAzureRoleArgs{
			Scope:    pulumi.String("string"),
			RoleId:   pulumi.String("string"),
			RoleName: pulumi.String("string"),
		},
	},
	ApplicationObjectId: pulumi.String("string"),
	Description:         pulumi.String("string"),
	ExplicitMaxTtl:      pulumi.String("string"),
	MaxTtl:              pulumi.String("string"),
	Namespace:           pulumi.String("string"),
	PermanentlyDelete:   pulumi.Bool(false),
	AzureGroups: azure.BackendRoleAzureGroupArray{
		&azure.BackendRoleAzureGroupArgs{
			GroupName: pulumi.String("string"),
			ObjectId:  pulumi.String("string"),
		},
	},
	SignInAudience: pulumi.String("string"),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	Ttl: pulumi.String("string"),
})

    var backendRoleResource = new BackendRole("backendRoleResource", BackendRoleArgs.builder()
    .role("string")
    .backend("string")
    .azureRoles(BackendRoleAzureRoleArgs.builder()
        .scope("string")
        .roleId("string")
        .roleName("string")
        .build())
    .applicationObjectId("string")
    .description("string")
    .explicitMaxTtl("string")
    .maxTtl("string")
    .namespace("string")
    .permanentlyDelete(false)
    .azureGroups(BackendRoleAzureGroupArgs.builder()
        .groupName("string")
        .objectId("string")
        .build())
    .signInAudience("string")
    .tags("string")
    .ttl("string")
    .build());

    backend_role_resource = vault.azure.BackendRole("backendRoleResource",
    role="string",
    backend="string",
    azure_roles=[{
        "scope": "string",
        "role_id": "string",
        "role_name": "string",
    }],
    application_object_id="string",
    description="string",
    explicit_max_ttl="string",
    max_ttl="string",
    namespace="string",
    permanently_delete=False,
    azure_groups=[{
        "group_name": "string",
        "object_id": "string",
    }],
    sign_in_audience="string",
    tags=["string"],
    ttl="string")

    const backendRoleResource = new vault.azure.BackendRole("backendRoleResource", {
    role: "string",
    backend: "string",
    azureRoles: [{
        scope: "string",
        roleId: "string",
        roleName: "string",
    }],
    applicationObjectId: "string",
    description: "string",
    explicitMaxTtl: "string",
    maxTtl: "string",
    namespace: "string",
    permanentlyDelete: false,
    azureGroups: [{
        groupName: "string",
        objectId: "string",
    }],
    signInAudience: "string",
    tags: ["string"],
    ttl: "string",
});

    type: vault:azure:BackendRole
properties:
    applicationObjectId: string
    azureGroups:
        - groupName: string
          objectId: string
    azureRoles:
        - roleId: string
          roleName: string
          scope: string
    backend: string
    description: string
    explicitMaxTtl: string
    maxTtl: string
    namespace: string
    permanentlyDelete: false
    role: string
    signInAudience: string
    tags:
        - string
    ttl: string

    BackendRole Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The BackendRole resource accepts the following input properties:

    Role string
    Name of the Azure role
    ApplicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    AzureGroups List<BackendRoleAzureGroup>
    List of Azure groups to be assigned to the generated service principal.
    AzureRoles List<BackendRoleAzureRole>
    List of Azure roles to be assigned to the generated service principal.
    Backend string
    Path to the mounted Azure auth backend
    Description string
    Human-friendly description of the mount for the backend.
    ExplicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    MaxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PermanentlyDelete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    SignInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    Tags List<string>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    Role string
    Name of the Azure role
    ApplicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    AzureGroups []BackendRoleAzureGroupArgs
    List of Azure groups to be assigned to the generated service principal.
    AzureRoles []BackendRoleAzureRoleArgs
    List of Azure roles to be assigned to the generated service principal.
    Backend string
    Path to the mounted Azure auth backend
    Description string
    Human-friendly description of the mount for the backend.
    ExplicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    MaxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PermanentlyDelete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    SignInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    Tags []string
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    role String
    Name of the Azure role
    applicationObjectId String
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups List<BackendRoleAzureGroup>
    List of Azure groups to be assigned to the generated service principal.
    azureRoles List<BackendRoleAzureRole>
    List of Azure roles to be assigned to the generated service principal.
    backend String
    Path to the mounted Azure auth backend
    description String
    Human-friendly description of the mount for the backend.
    explicitMaxTtl String
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl String
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete Boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    signInAudience String
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags List<String>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    role string
    Name of the Azure role
    applicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups BackendRoleAzureGroup[]
    List of Azure groups to be assigned to the generated service principal.
    azureRoles BackendRoleAzureRole[]
    List of Azure roles to be assigned to the generated service principal.
    backend string
    Path to the mounted Azure auth backend
    description string
    Human-friendly description of the mount for the backend.
    explicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    signInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags string[]
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    role str
    Name of the Azure role
    application_object_id str
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azure_groups Sequence[BackendRoleAzureGroupArgs]
    List of Azure groups to be assigned to the generated service principal.
    azure_roles Sequence[BackendRoleAzureRoleArgs]
    List of Azure roles to be assigned to the generated service principal.
    backend str
    Path to the mounted Azure auth backend
    description str
    Human-friendly description of the mount for the backend.
    explicit_max_ttl str
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    max_ttl str
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanently_delete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    sign_in_audience str
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags Sequence[str]
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl str
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    role String
    Name of the Azure role
    applicationObjectId String
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups List<Property Map>
    List of Azure groups to be assigned to the generated service principal.
    azureRoles List<Property Map>
    List of Azure roles to be assigned to the generated service principal.
    backend String
    Path to the mounted Azure auth backend
    description String
    Human-friendly description of the mount for the backend.
    explicitMaxTtl String
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl String
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete Boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    signInAudience String
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags List<String>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the BackendRole resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing BackendRole Resource

    Get an existing BackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: BackendRoleState, opts?: CustomResourceOptions): BackendRole
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_object_id: Optional[str] = None,
        azure_groups: Optional[Sequence[BackendRoleAzureGroupArgs]] = None,
        azure_roles: Optional[Sequence[BackendRoleAzureRoleArgs]] = None,
        backend: Optional[str] = None,
        description: Optional[str] = None,
        explicit_max_ttl: Optional[str] = None,
        max_ttl: Optional[str] = None,
        namespace: Optional[str] = None,
        permanently_delete: Optional[bool] = None,
        role: Optional[str] = None,
        sign_in_audience: Optional[str] = None,
        tags: Optional[Sequence[str]] = None,
        ttl: Optional[str] = None) -> BackendRole
    func GetBackendRole(ctx *Context, name string, id IDInput, state *BackendRoleState, opts ...ResourceOption) (*BackendRole, error)
    public static BackendRole Get(string name, Input<string> id, BackendRoleState? state, CustomResourceOptions? opts = null)
    public static BackendRole get(String name, Output<String> id, BackendRoleState state, CustomResourceOptions options)
    resources:  _:    type: vault:azure:BackendRole    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApplicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    AzureGroups List<BackendRoleAzureGroup>
    List of Azure groups to be assigned to the generated service principal.
    AzureRoles List<BackendRoleAzureRole>
    List of Azure roles to be assigned to the generated service principal.
    Backend string
    Path to the mounted Azure auth backend
    Description string
    Human-friendly description of the mount for the backend.
    ExplicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    MaxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PermanentlyDelete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    Role string
    Name of the Azure role
    SignInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    Tags List<string>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    ApplicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    AzureGroups []BackendRoleAzureGroupArgs
    List of Azure groups to be assigned to the generated service principal.
    AzureRoles []BackendRoleAzureRoleArgs
    List of Azure roles to be assigned to the generated service principal.
    Backend string
    Path to the mounted Azure auth backend
    Description string
    Human-friendly description of the mount for the backend.
    ExplicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    MaxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PermanentlyDelete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    Role string
    Name of the Azure role
    SignInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    Tags []string
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    applicationObjectId String
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups List<BackendRoleAzureGroup>
    List of Azure groups to be assigned to the generated service principal.
    azureRoles List<BackendRoleAzureRole>
    List of Azure roles to be assigned to the generated service principal.
    backend String
    Path to the mounted Azure auth backend
    description String
    Human-friendly description of the mount for the backend.
    explicitMaxTtl String
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl String
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete Boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    role String
    Name of the Azure role
    signInAudience String
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags List<String>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    applicationObjectId string
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups BackendRoleAzureGroup[]
    List of Azure groups to be assigned to the generated service principal.
    azureRoles BackendRoleAzureRole[]
    List of Azure roles to be assigned to the generated service principal.
    backend string
    Path to the mounted Azure auth backend
    description string
    Human-friendly description of the mount for the backend.
    explicitMaxTtl string
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl string
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    role string
    Name of the Azure role
    signInAudience string
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags string[]
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    application_object_id str
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azure_groups Sequence[BackendRoleAzureGroupArgs]
    List of Azure groups to be assigned to the generated service principal.
    azure_roles Sequence[BackendRoleAzureRoleArgs]
    List of Azure roles to be assigned to the generated service principal.
    backend str
    Path to the mounted Azure auth backend
    description str
    Human-friendly description of the mount for the backend.
    explicit_max_ttl str
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    max_ttl str
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanently_delete bool
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    role str
    Name of the Azure role
    sign_in_audience str
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags Sequence[str]
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl str
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    applicationObjectId String
    Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. If present, azure_roles and permanently_delete will be ignored.
    azureGroups List<Property Map>
    List of Azure groups to be assigned to the generated service principal.
    azureRoles List<Property Map>
    List of Azure roles to be assigned to the generated service principal.
    backend String
    Path to the mounted Azure auth backend
    description String
    Human-friendly description of the mount for the backend.
    explicitMaxTtl String
    Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
    maxTtl String
    Specifies the maximum TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    permanentlyDelete Boolean
    Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. Defaults to false. For Vault v1.12+.
    role String
    Name of the Azure role
    signInAudience String
    Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
    tags List<String>
    A list of Azure tags to attach to an application. Requires Vault 1.16+.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

    Supporting Types

    BackendRoleAzureGroup, BackendRoleAzureGroupArgs

    GroupName string
    ObjectId string
    GroupName string
    ObjectId string
    groupName String
    objectId String
    groupName string
    objectId string
    groupName String
    objectId String

    BackendRoleAzureRole, BackendRoleAzureRoleArgs

    Scope string
    RoleId string
    RoleName string
    Scope string
    RoleId string
    RoleName string
    scope String
    roleId String
    roleName String
    scope string
    roleId string
    roleName string
    scope String
    roleId String
    roleName String

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
    pulumi/pulumi-vault